joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007d80
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rcx, qword [0x1400420c0]
test rcx, rcx
je 0x140007dbb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007de0
mov rcx, qword [0x1400420c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x1400430e0], 0
jne 0x140007df8
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [0x1400420c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140007dae
mov edx, 0x414
lea r12, [rsp + 0x20]
lea rsi, [0x14001e3d2]
mov qword [rsp + 0x20], 0
lea rdi, [0x140043100]
movq xmm0, rsi
mov rcx, r12
mov dword [rsp + 0x28], 3
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007ec4
test al, 0x10
je 0x140007dc4
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140007dc4
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140007e70
jmp 0x140007dc4

Function at 0x14000e530
Capabilities:
Create directory

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.140015b10
sub rsp, rax
mov eax, dword [0x140047100]
mov rsi, rcx
test eax, eax
je 0x14000e5d0
xor ebx, ebx
lea rdi, [0x140045100]
test eax, eax
jg 0x14000e56c
jmp 0x14000e580
add rbx, 1
cmp dword [0x140047100], ebx
jle 0x14000e580
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x14000e560
jmp 0x14000e5b7
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp rax, 2
jne 0x14000e595
cmp word [rsi + 2], 0x3a
je 0x14000e5b7
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000e620
movsxd rbx, dword [0x140047100]
cmp ebx, 0x3ff
jle 0x14000e638
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str.HOME
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call fcn.140007540
test al, al
je 0x14000e65a
movsxd rbx, dword [0x140047100]
mov rcx, rdi
lea rdi, [0x140045100]
call sub.msvcrt.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x140047100]
add eax, 1
mov dword [0x140047100], eax
jmp 0x14000e551
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000e5a4
xor eax, eax
jmp 0x14000e5bc
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add dword [0x140047100], 1
mov rdx, rax
lea rax, [0x140045100]
mov qword [rax + rbx*8], rdx
jmp 0x14000e5b7
mov rcx, rbx
call fcn.140007cc0
nop
nop word cs:[rax + rax]
nop
Function at 0x140011055
Capabilities:
Terminate process

Disassembly:
jmp 0x140019660
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x190
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1b8]
mov rax, qword [0x140033118]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011866
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
lea rax, [rbp + 0x68]
lea rcx, str.5985
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov byte [rbp + 0x94], 0
cmp dword [rbp + 0x190], 1
jle 0x1400198a5
mov eax, 8
imul rax, rax, 1
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x198]
mov rax, qword [rdx + rax]
movzx eax, word [rax + rcx]
cmp eax, 0x2d
jne 0x1400198a5
mov eax, 8
imul rax, rax, 1
mov ecx, 2
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x198]
mov rax, qword [rdx + rax]
movzx eax, word [rax + rcx]
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0x61
je 0x1400197b0
cmp dword [rbp + 0x164], 0x64
je 0x140019827
cmp dword [rbp + 0x164], 0x6c
je 0x1400197ed
cmp dword [rbp + 0x164], 0x70
je 0x140019773
jmp 0x140019850
mov rax, qword [rbp + 0x198]
add rax, 8
mov qword [rbp + 0x198], rax
mov eax, dword [rbp + 0x190]
dec eax
mov dword [rbp + 0x190], eax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x198]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x28], rax
jmp 0x140019880
mov rax, qword [rbp + 0x198]
add rax, 8
mov qword [rbp + 0x198], rax
mov eax, dword [rbp + 0x190]
dec eax
mov dword [rbp + 0x190], eax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x198]
mov rax, qword [rcx + rax]
mov qword [rbp + 8], rax
jmp 0x140019880
mov rax, qword [rbp + 0x198]
add rax, 8
mov qword [rbp + 0x198], rax
mov eax, dword [rbp + 0x190]
dec eax
mov dword [rbp + 0x190], eax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x198]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x48], rax
jmp 0x140019880
mov rax, qword [rbp + 0x198]
add rax, 8
mov qword [rbp + 0x198], rax
mov eax, dword [rbp + 0x190]
dec eax
mov dword [rbp + 0x190], eax
mov byte [rbp + 0x94], 1
jmp 0x140019880
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x198]
mov rdx, qword [rcx + rax]
lea rcx, str.Wrong_Argument:__s_n
call fcn.1400113f2
call fcn.14001185c
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
mov rax, qword [rbp + 0x198]
add rax, 8
mov qword [rbp + 0x198], rax
mov eax, dword [rbp + 0x190]
dec eax
mov dword [rbp + 0x190], eax
jmp 0x1400196e4
cmp qword [rbp + 0x28], 0
jne 0x1400198bc
call fcn.14001185c
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
cmp qword [rbp + 0x48], 0
jne 0x1400198cb
lea rax, [rbp + 0x68]
mov qword [rbp + 0x48], rax
movzx r9d, byte [rbp + 0x94]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call fcn.14001163b
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_exit]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14001171c
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011424
lea rsp, [rbp + 0x170]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001108c
Capabilities:
Query service status

Disassembly:
jmp 0x140018160
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140033118]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011866
mov dword [rbp + 0x84], 0xffffffff
mov byte [rbp + 0xa4], 0
mov r8d, 5
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x1400181e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._nSCM_Error._Skipping_BITS_check_..._nOpenSCManagerA_error:__d_n
call fcn.1400113f2
xor al, al
jmp 0x14001827c
mov r8d, 4
lea rdx, str.BITS
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14001821e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._nSCM_Error._Skipping_BITS_check_..._nOpenServiceA_error:__d_n
call fcn.1400113f2
xor al, al
jmp 0x14001827c
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jne 0x140018253
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._nSCM_Error._Skipping_BITS_check_..._nQueryServiceStatus_error:__d_n
call fcn.1400113f2
xor al, al
jmp 0x14001827c
cmp dword [rbp + 0x4c], 4
jne 0x14001826e
mov byte [rbp + 0xa4], 1
lea rcx, str.BITS_is_running..._Waiting_30_seconds_for_Timeout__usually_120_seconds_for_timeout_...__n
call fcn.1400113f2
jmp 0x140018275
mov byte [rbp + 0xa4], 0
movzx eax, byte [rbp + 0xa4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14001171c
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.140011424
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1400110ff
Capabilities:
Get inbound credentials handle via credssp

Disassembly:
jmp 0x140019c40
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0xce0
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x234
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xd08]
mov rax, qword [0x140033118]
xor rax, rbp
mov qword [rbp + 0xc80], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011866
lea rax, [rbp + 0x10]
lea rcx, str.Negotiate
mov rdi, rax
mov rsi, rcx
mov ecx, shutdown
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 0x7ec
rep stosb byte [rdi], al
mov rax, qword [rbp + 0xcb0]
add rax, 0x10
lea rcx, [rbp + 0x828]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
mov dword [rbp + 0x844], eax
cmp dword [rbp + 0x844], 0
je 0x140019d2d
lea rcx, str.Error_in_AquireCredentialsHandle
call fcn.1400113f2
mov eax, 0xffffffff
jmp 0x140019e65
mov rax, qword [rbp + 0xcb0]
add rax, 0x40
mov rcx, qword [rbp + 0xcb0]
add rcx, 0x20
mov rdx, rax
call fcn.14001182a
mov rax, qword [rbp + 0xcb0]
add rax, 0x50
mov rcx, qword [rbp + 0xcb0]
add rcx, 0x30
mov rdx, rax
call fcn.14001182a
mov ecx, reloc.WS2_32.dll_recv
call fcn.14001106e
mov qword [rbp + 0xc68], rax
cmp qword [rbp + 0xc68], 0
je 0x140019da4
mov rdi, qword [rbp + 0xc68]
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov rax, qword [rbp + 0xc68]
mov qword [rbp + 0xc78], rax
jmp 0x140019daf
mov qword [rbp + 0xc78], 0
mov rax, qword [rbp + 0xcb0]
mov rcx, qword [rbp + 0xc78]
mov qword [rax], rcx
mov rax, qword [rbp + 0xcb0]
mov ecx, dword [rbp + 0xcc0]
mov dword [rax + 0x40], ecx
mov rax, qword [rbp + 0xcb0]
mov rcx, qword [rbp + 0xcb8]
mov qword [rax + 0x48], rcx
mov rax, qword [rbp + 0xcb0]
add rax, 0x30
mov rcx, qword [rbp + 0xcb0]
add rcx, 0x20
mov rdx, qword [rbp + 0xcb0]
add rdx, 0x10
mov qword [rbp + 0xc78], rdx
lea rdi, [rbp + 0x888]
mov qword [rsp + 0x40], rdi
lea rdi, [rbp + 0x864]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0xcb0]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r9d, 0x900
mov r8, rcx
xor edx, edx
mov rax, qword [rbp + 0xc78]
mov rcx, rax
call qword [sym.imp.Secur32.dll_AcceptSecurityContext]
mov dword [rbp + 0x844], eax
mov eax, dword [rbp + 0x844]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14002d3f0]
call fcn.14001171c
mov rax, rdi
mov rcx, qword [rbp + 0xc80]
xor rcx, rbp
call fcn.140011424
lea rsp, [rbp + 0xc90]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400112da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140017a20
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011866
mov byte [rbp + 8], 0x4e
mov byte [rbp + 9], 0x65
mov byte [rbp + 0xa], 0x67
mov byte [rbp + 0xb], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp + 0xc], reloc.WS2_32.dll_WSACleanup
mov byte [rbp + 0xd], 0x69
mov byte [rbp + 0xe], 0x61
mov byte [rbp + 0xf], reloc.WS2_32.dll_WSACleanup
mov byte [rbp + 0x10], 0x65
mov byte [rbp + 0x11], 0x20
mov byte [rbp + 0x34], reloc.WS2_32.dll_listen
mov byte [rbp + 0x35], 0xa
mov dword [rbp + 0x54], 0
mov dword [rbp + 0x74], 0
jmp 0x140017aae
mov eax, dword [rbp + 0x74]
inc eax
mov dword [rbp + 0x74], eax
mov eax, dword [rbp + 0x1b8]
cmp dword [rbp + 0x74], eax
jge 0x140017abb
jmp 0x140017aa6
mov dword [rbp + 0x94], 0
jmp 0x140017ad5
mov eax, dword [rbp + 0x94]
inc eax
mov dword [rbp + 0x94], eax
mov eax, dword [rbp + 0x1b8]
cmp dword [rbp + 0x94], eax
jge 0x140017b23
movsxd rax, dword [rbp + 0x94]
mov rcx, qword [rbp + 0x1b0]
movsx eax, byte [rcx + rax]
movsxd rcx, dword [rbp + 0x54]
movsx ecx, byte [rbp + rcx + 8]
cmp eax, ecx
jne 0x140017b21
mov eax, dword [rbp + 0x54]
inc eax
mov dword [rbp + 0x54], eax
movsxd rax, dword [rbp + 0x54]
cmp rax, 0xa
jne 0x140017b21
mov eax, dword [rbp + 0x94]
inc eax
mov dword [rbp + 0x54], eax
jmp 0x140017b23
jmp 0x140017ac7
mov rax, qword [rbp + 0x1c8]
mov dword [rax], 0
mov eax, dword [rbp + 0x54]
mov dword [rbp + 0xb4], eax
jmp 0x140017b49
mov eax, dword [rbp + 0xb4]
inc eax
mov dword [rbp + 0xb4], eax
mov eax, dword [rbp + 0x1b8]
cmp dword [rbp + 0xb4], eax
jge 0x140017be8
movsxd rax, dword [rbp + 0xb4]
mov rcx, qword [rbp + 0x1b0]
movsx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
movsx ecx, byte [rbp + rcx + 0x34]
cmp eax, ecx
jne 0x140017ba8
mov eax, dword [rbp + 0xb4]
inc eax
cdqe
mov rcx, qword [rbp + 0x1b0]
movsx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 1
movsx ecx, byte [rbp + rcx + 0x34]
cmp eax, ecx
jne 0x140017ba8
jmp 0x140017be8
movsxd rax, dword [rbp + 0xb4]
mov rcx, qword [rbp + 0x1c8]
movsxd rcx, dword [rcx]
mov rdx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1b0]
movzx eax, byte [r8 + rax]
mov byte [rdx + rcx], al
mov rax, qword [rbp + 0x1c8]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x1c8]
mov dword [rcx], eax
jmp 0x140017b3b
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_bind
call fcn.14001171c
mov eax, edi
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1400112fd
Capabilities:
Create thread

Disassembly:
jmp 0x140018f30
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, reloc.WS2_32.dll_shutdown
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140033118]
xor rax, rbp
mov qword [rbp + 0x108], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.140011866
lea rax, [rbp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x30], rax
movzx eax, byte [rbp + 0x140]
mov byte [rbp + 0x38], al
mov rdx, qword [rbp + 0x130]
lea rcx, str._nListening_for_connection_on_port__s_....__n
call fcn.14001105a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x28]
lea r8, [0x14001181b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, reloc.WS2_32.dll_accept
call fcn.14001171c
mov rax, rdi
mov rcx, qword [rbp + 0x108]
xor rcx, rbp
call fcn.140011424
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x1400114d3
Capabilities:
Terminate process

Disassembly:
jmp 0x14001f460
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400115ff
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400210f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140021110
xor al, al
jmp 0x140021191
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140021123
xor al, al
jmp 0x140021191
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002114d
xor al, al
jmp 0x140021191
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140021161
xor al, al
jmp 0x140021191
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140021173
xor al, al
jmp 0x140021191
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002118f
xor al, al
jmp 0x140021191
mov al, 1
add rsp, 0x38
ret
Function at 0x1400118a7
Capabilities:
Print debug messages

Disassembly:
jmp 0x140022fa4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.140011690
and qword [rdi + 0x50], 0
lea rax, [0x140000000]
and dword [rdi + 0x58], 0
lea rcx, [rdi + 0x28]
and dword [rdi + 0x5c], 0
xor r8d, r8d
mov qword [rdi + 0x10], rax
xor edx, edx
mov qword [rdi + 8], rax
lea rax, [0x14002eed0]
mov qword [rdi + 0x20], rax
mov dword [rdi], 0x60
mov dword [rdi + 0x18], 0xe00
call fcn.1400113ed
test eax, eax
jne 0x14002303b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14002303b
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140023034
lea rcx, str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x140035d50], 1
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140671c00
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword gs:[0x60]
movabs r11, 0x671c70
movabs r10, 0x671c74
mov r9, qword [rax + 0x10]
xor eax, eax
movsxd rcx, dword [r9 + 0x3c]
movsxd r11, dword [r9 + r11]
add rcx, r9
mov r10d, dword [r9 + r10]
movzx r8d, word [rcx + 0x14]
add r8, rcx
cmp dword [r8 + 0x20], eax
jbe 0x140671c66
mov edx, eax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 0x24]
inc eax
add rcx, rdx
inc rdx
xor byte [rcx + r9], r10b
cmp eax, dword [r8 + 0x20]
jb 0x140671c50
lea rax, [r9 + r11]
jmp rax
Function at 0x140132b59
Capabilities:
Write file on windows

Disassembly:
jmp 0x14020a060
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1405ff003]
call fcn.14013994a
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14020a0b8
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14020a1ca
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14020a163
cmp qword [rbp + 0x28], 0
jle 0x14020a163
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14020a101
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14013914d
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14020a1b9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14020a1b9
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1401334af
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1401caee0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fe40a]
call fcn.14013994a
nop
mov qword [rbp + 8], 0
jmp 0x1401caf1f
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x1401caf75
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x1401caf14
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1401350b1
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14018f020
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x1405fe2b9]
call fcn.14013994a
nop
xor eax, eax
test eax, eax
je 0x14018f05b
movsx eax, byte [rbp + 0xf8]
or eax, 0x20
mov dword [rbp + 0xc0], eax
jmp 0x14018f068
movsx eax, byte [rbp + 0xf8]
mov dword [rbp + 0xc0], eax
mov eax, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xf0]
xor ecx, eax
mov eax, ecx
imul eax, eax, 0x1000193
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret