joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008b80
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008ba0
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008be8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008b94
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008bd5

Function at 0x140008c10
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x14001f2c0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008cc8
mov rdx, qword [0x14001f200]
lea rcx, [0x14001f200]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140008c98
cmp rdx, rcx
jne 0x140008c7a
mov qword [rdx], rax
cmp rax, rcx
je 0x140008c7f
nop dword [rax]
test rax, rax
je 0x140008caa
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140008c68
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140008caa
mov rdx, rax
jmp 0x140008c76
lea rcx, [0x14001f300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008ce6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140008caa
Function at 0x140c1d4c6
Capabilities:
Manually build aes constants

Disassembly:
neg dil
rol cl, 1
not cl
ror cl, 1
movzx r9d, di
or r8, 0xffffffffda238b20
mov qword [rsp + rsi*8 - 0x2f0], 0xe303d9a
dec cl
shr sil, 0x63
xor r11b, cl
ror dil, 0x81
lea rcx, [rsp + rcx + 8]
ror dil, 0xe4
mov word [rsp + r8 + 0x200c4442], di
bts r8d, 0x8f
mov qword [rsi + rcx - 0xb], rdx
not byte [rsp + rsi - 0xb]
and dil, r8b
lea rbx, [rbx + rsi - 0xf]
sal r9, 0xc1
mov edx, dword [rsi + rbx - 0xb]
xor edx, r11d
xor r8, rdi
inc esi
sbb r8b, 0x98
bswap edx
lea rdi, [rsi*8 - 0x716005c7]
add dword [rsp + rdi + 0x7160056a], r8d
sbb byte [rsp + rdi + 0x71600568], dil
dec edx
mov ecx, esi
pop rdi
rol edx, 3
sub r9b, cl
call fcn.140c6380d
xor edi, r11d
mov esi, 0xe32db02b
neg edi
movsx r9d, sil
lea edi, [rdi + rsi - 0x5b96f3f0]
movsx eax, r9w
shr r9w, 0x67
movsx edx, r9w
xor edi, 0x9d0d41b7
ror edi, 1
xadd r9d, esi
lea r8, [rdx + 0x628b0b92]
setne r9b
sbb edi, 0xa4181227
cdq
push r11
shr r8w, 0xa6
sar dx, 0x89
xor dword [rsp + rcx - 0x51020438], edi
shr r8w, 0x89
pop r11
rol cl, 0x23
call fcn.140c4db5f
Function at 0x140c203be
Capabilities:
Encode data using base64

Disassembly:
pop r9
mov edi, dword [rbx]
call fcn.140c1f853

Function at 0x140c238ed
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ecx
mov qword [rsp], 0x696851c
inc byte [rsp + 6]
cmp ebx, 4
jmp 0x140c23907
lea rsp, [rsp + 8]
jbe 0x140c2393a
push 0x57130b85
mov edx, 0xaf231716
movzx ecx, byte [rsp]
lea edx, [rcx - 0x81]
sar ecx, 0xde
xor ecx, dword [rsp + rcx*4 + 3]
lea ecx, [rbx + rcx*2 - 0xb2]
lea rsp, [rsp + 8]
mov eax, 0x7a37979e
bt ax, ax
bt ax, ax
sal ecx, 3
and al, 0x2e
jge 0x140c1a47d

Function at 0x140c28127
Capabilities:
Encode data using base64

Disassembly:
je 0x140c5dd5b
jno 0x140c454ad
add rax, rdx
mov qword [rsp], 0xffffffffe4bdd50a
jmp 0x140c1137b
mov esi, dword [rbx + rax - 0x578842ac]
movzx r9d, al
mov edi, r9d
xor esi, r11d
bt ax, 0x39
movsx r8d, di
jae 0x140c29a19
rol esi, 3
xor esi, 0x5a11013c
movzx ecx, ax
lea rdx, [r8 + r8*2 + 0x2f29090c]
inc cl
dec esi
xadd dil, r9b
not esi
lea rcx, [rax + r9 + 0x5d2d3998]
btr cx, di
sbb esi, 0xe423eb16
and dil, 6
cdq
sbb rdx, rax
push r11
xor dword [rsp + r9 - 0xac], esi
bt ecx, eax
sub di, 0xe127
pop r11
movsxd rsi, esi
inc dl
sub dx, cx
sbb r8d, 0x66014c8d
add rbp, rsi
inc r8b
sal dl, 0xc7
mov r10, qword [r10 + r9*4 - 0x2b0]
or cl, al
xchg dl, r8b
bts r8d, r8d
jae fcn.140c42e49

Function at 0x140c317a2
Capabilities:
Encode data using base64

Disassembly:
adc r9, 0x149c
jmp r9
xor dword [rsp + r9 - 0x1fb3a001], edi
pop r11
add ecx, 0x93b1aabb
movsx r8d, dx
imul edx, edx
movsxd rdi, edi
sbb r8b, 0xbb
neg r9d
sub r8b, r8b
adc rbp, rdi
xor r9b, cl
ror r8, 0xd3
neg edx
lea rbx, [rbx + rdx - 1]
js 0x140c1a101
movzx edi, byte [rdx + rbx]
lea rdx, [rax*4 - 0x6df6a16c]
xchg r9, rdx
push rsi
xor dil, r11b
sar r9w, 0xa1
xor dil, 0xbe
or word [rsp + r9 + 0x6df6cf79], 0x5db4
xadd qword [rsp + r9 + 0x6df6cf76], r8
and r9b, al
inc dil
add byte [rsp + r9 + 0x6df6cf82], cl
not byte [rsp + r9 + 0x6df6cf85]
not dil
shl cl, 0xa4
xchg r8w, ax
adc dil, sil
inc byte [rsp + rsi*2 - 0x36a3fffb]
cdqe
not dil
sal rsi, cl
sbb dil, 0xb4
sar dword [rsp + rsi*4 + 1], 0x41
not dil
xchg byte [rsp + rsi + 1], r8b
call fcn.140c2ad85
mov esi, edx
dec edi
mov qword [rsp + r9 - 0x1fb3a000], rsi
pop rcx
ror edi, 2
mov qword [rsp + r9 - 0x1fb3a000], r9
movzx eax, byte [rsp + r9*2 - 0x3f673fff]
mov qword [rsp + r9*2 - 0x3f674000], r11
inc r9d
sal dx, 0x47
jns 0x140c2030c

Function at 0x140c33949
Capabilities:
Manually build aes constants

Disassembly:
adc rbp, rdx
push rcx
pop r8
pop rdx
pop rcx
jmp fcn.140c42e49
mov qword [rsp + rsi + 7], r11
bts rsi, 0xa6
xor dword [rsp + r9 + 6], edx
sal ax, cl
mov r11, qword [rsp + r9*4]
mov qword [rsp + r9*2 - 4], r9
jge 0x140c4fdca
movsx eax, r9b
movzx esi, di
neg r8b
xor ax, 0xb5bb
neg rdi
rol r8b, 1
shl r9b, 0x21
neg r9
cwde
xor r11b, r8b
neg r9
shl r9b, 0x81
neg sil
add r8, rsp
dec dl
movzx si, byte [r8 + r9 - 0x558]
or r9d, 0x7d938032
lea r10, [rdx + r10 - 0x68bd0597]
inc cl
mov word [rdi + r10 + 0x68bd0596], si
call fcn.140c391de
movsxd rdx, edx
rol cl, 0xa3
not si
jne 0x140c31333
Function at 0x140c3717b
Capabilities:
Manually build aes constants

Disassembly:
call fcn.140c186d9
test ebx, ebx
jmp 0x140c33944

Function at 0x140c3a53b
Capabilities:
Encode data using base64

Disassembly:
add dil, 0x15
lea rax, [rsp + rax + 0x18]
lea r8, [rdx + rdi - 0x30e2ea56]
mov qword [rsp + rdi*2 - 0x22], 0x729971aa
mov ecx, dword [rax + rdi*2 - 0x2a]
sbb rdi, 0xfffffffff130bf81
lea r10, [r10 + rdi*4 - 0x3b3d0254]
mov dword [r10 + rdi*8 - 0x767a04a0], ecx
movzx eax, r9w
lea rbx, [rbx + rdi*2 - 0x1d9e812c]
xadd edx, edi
mov r9d, dword [rdi + rbx - 0x3d8]
xor r9d, r11d
ror r9d, 3
and dx, word [rsp + rdi - 0x3c9]
jge 0x140c4dbc0
cwd
neg r9d
ror al, 0xc6
mov qword [rsp + rdi - 0x3d8], 0x2c035689
cqo
lea r9d, [rsi + r9 - 0x6d4928dc]
not word [rsp + rdi - 0x3d1]
inc qword [rsp + rdi - 0x3c8]
bswap r9d
mov qword [rsp + rdi - 0x3c8], r11
call fcn.140c33180
mov r9d, dword [rbx + riz]
movsx edx, cx
xor r9d, r11d
mov edi, 0x87a3549e
bswap r9d
lea r9d, [rcx + r9 - 0x1200cec6]
rol r9d, 3
xor r9d, 0x6fbb2cbe
dec dx
call fcn.140c4d1e2

Function at 0x140c407e8
Capabilities:
Manually build aes constants

Disassembly:
lea r9d, [r9 + rsi*8 - 0x4e844a34]
lea rcx, [rdx*2 + 0x497509c]
movsx r8d, cl
ror r9d, 3
btc r8, rcx
inc rsi
not r9d
or rdx, r8
jno 0x140c5f8b4
mov r9d, 0xbc3add04
sub rbx, 4
movsx esi, r9b
call fcn.140c265b5
neg sil
lea r9, [rdi + 0x2535aeb6]
add rsi, rbp
jmp rsi
mov qword [rsp + rax - 0x678c132e], rax
shl ax, 0x24
lea r10, [rax + r10 - 0x678c32d6]
inc word [rsp + rax - 0x678c32df]
mov word [rax + rdx - 0x678c32e0], r9w
je 0x140c5691c
lea rdx, [rax + rax*4 + 0x50fca05]
movsx esi, dl
lea rbx, [rsi + rbx - 0x69]
movsx ecx, si
sal eax, cl
mov r9d, dword [rbx + rsi - 0x65]
pop rcx
shl rdx, 0x66
xor r9d, r11d
cwd
jmp 0x140c3afc8
bt ecx, 0x38
movzx r9d, ax
push r11
xor dword [rsp + rax - 0x5400a09e], edi
call fcn.140c19e21

Function at 0x140c40e11
Capabilities:
Manually build aes constants

Disassembly:
not byte [rsp + r9 - 0x18b7ac32]
mov r8d, dword [rbx + r9 - 0x18b7ac37]
ror dword [rsp + r9*4 - 0x62deb0dc], 0xc4
movzx eax, r9w
lea rdi, [rdi + r9*2 - 0x5263d6cf]
xor r8d, r11d
movzx esi, word [rsp + r9 - 0x18b7ac35]
sub rsi, 0xffffffffe902e528
xor esi, r9d
neg r8d
sub rcx, 0xfffffffffeb81722
seto dil
lea r8d, [r8 + rcx + 0x8c46c13]
rol r8d, 1
dec r8d
not qword [rsp + r9 - 0x18b7ac37]
mov qword [rsp + r9 - 0x18b7ac37], r11
sar cl, 0x25
xor dword [rsp + r9 - 0x18b7ac37], r8d
cdq
or ecx, eax
pop r11
jbe 0x140c613c3
xor rdi, 0x4785a305
call fcn.140c62b5e
lea rbx, [r9 + rbx - 0x18b7ac3b]
dec dword [rsp + r9 - 0x18b7ac34]
jne 0x140c16e96
lea r10, [r10 + r9 - 0x18b7ac2d]
mov qword [rsp + r9*2 - 0x316f586e], r9
shr cl, 0x61
mov byte [r8 + r9*2 - 0x316f586e], dl
jg 0x140c29603
adc rbp, rdx
inc al
not r8d
mov rax, qword [r10 + rdi*2 - 0x68cca6f2]
mov sil, byte [rdi + r10 - 0x34665371]
btr ecx, 0xa1
movsx edx, r8b
adc dl, dil
lea r10, [r10 + rdi*2 - 0x68cca6e8]
bts rdi, rdi
sbb r9b, r9b
mov byte [rcx + rax - 0xf4b0], sil
movzx eax, cx
jmp rbp
Function at 0x140c41de9
Capabilities:
Encode data using base64

Disassembly:
lea esi, [rsi + r8*2 - 0x7c7c8299]
movzx r9d, r8b
push r11
neg rdi
xor dword [rsp + r8 - 0x3126122f], esi
lea rdi, [rdx + rax*8 + 0x2f264512]
movzx r11d, di
mov ecx, 0x182d2ba3
pop r11
movsxd rsi, esi
add rbp, rsi
xor di, 0xd4a8
sub di, r8w
mov r9, qword [r10 + r8 - 0x3126122f]
xadd rdx, rdi
mov rdx, qword [rax + r10 + 0x2352cd53]
neg rax
mov cl, byte [r10 + r8*2 - 0x624c244e]
push rdi
lea r10, [r10 + r8*2 - 0x624c2454]
js 0x140c263ab
jle 0x140c619d7
dec dword [rsp + rdi - 0x1274bdfd]
shrd r9, rdx, cl
pop rdx
mov qword [r10 + r8*2 - 0x624c245e], r9
sar di, 0x2f
sub di, 0x62bd
jmp rbp
call fcn.140c6413a
mov r8d, 0xed8b209a
mov edx, r8d
not edx
lea rbx, [rbx + rdx - 0x1274df69]
shr dl, 0x46
lea rax, [rdx*8 + 0x49063aad]
imul dx, dx
mov esi, dword [rbx + rdx*4 - 0x49d2f804]
movsx edi, ax
xor r8, rax
xor esi, r11d
rol esi, 1
inc esi
cdqe
rol esi, 3
jmp 0x140c1cbd1
mov rdi, qword [r10 + rdi - 0x6ea7ccc4]
adc r10, 8
mov esi, ecx
movzx eax, si
lea rbx, [rbx + rax - 0x60d9]
btc esi, 0x16
movzx ecx, word [rax + rbx - 0x60d7]
xor cx, r11w
movzx r8d, si
jmp 0x140c55c90

Function at 0x140c4a8b4
Capabilities:
Encode data using base64

Disassembly:
setp dl
add rbp, rdi
or rax, 0xffffffff8611eaaa
div r9d
sar rcx, 0x20
mov ax, word [r10 + rcx*2]
lea r10, [r10 + rcx*2 + 2]
movzx r9d, byte [rdx + rbx - 0x25c0d126]
lea rbx, [rbx + rdx*2 - 0x4b81a246]
xor r9b, r11b
inc r8b
and dx, 0xab93
xchg byte [rsp + rdx - 0x25c080fb], cl
adc r9b, 0x14
sal dword [rsp + rdx*2 - 0x4b8101ff], 0xe1
not rdx
rol r9b, 1
add r9b, 0xb0
xor r9b, 0xac
mov edi, r8d
sub edi, dword [rsp + rdx*2 + 0x4b810206]
adc r9b, 0xbc
xchg si, dx
not r8b
xor r9b, sil
xadd r8b, dl
call fcn.140c2458e
sub rbx, 4
mov r9d, 0xeba60087
mov esi, dword [rbx + riz]
movsx edx, r9w
mov eax, edx
movzx edi, ax
xor esi, r11d
dec rdi
inc esi
neg esi
imul di
ror esi, 3
lea esi, [rsi + r9 - 0x1e9b5468]
movsx ecx, r9w
sub r9, rax
movsx r8d, dil
push r11
xor dword [rsp + rdx*4], esi
dec r9
neg r8d
call fcn.140c41259
setae dl
xor r8d, r11d
not r8d
shl rdx, 0x49
neg r8d
jmp fcn.140c113fa
mov word [rdx + r10 - 0x949e], si
lea rsi, [r9 + r8*8 - 0x5fce0975]
mov edi, dword [rbx + rdx - 0x94a3]
movzx eax, word [rsp + rdx - 0x948a]
xor edi, r11d
and ecx, r8d
xor edi, 0x463be6a5
ror al, 0xa1
neg edi
btc r9, 0x39
rol edi, 3
and cx, r9w
xor edi, 0x4f8db6b1
mov qword [rsp + rdx*8 - 0x4a4e8], 0x63b4335
mul r8
mov qword [rsp + rdx*2 + 0x10], r11
xor dword [rsp + rdx + 0x10], edi
pop rsi
cdqe
cbw
mov r11, qword [rsp + rdx + 8]
movsx esi, word [rsp + rdx*4 + 4]
movsxd rdi, edi
inc rsi
jge 0x140c36e52
Function at 0x140c4c1d8
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jne 0x140c5a6e7
mov r9d, 0xe0a15384
lea r9, [r9 + r9*2 - 0x53fa2b6f]
mov r9, rax
jmp 0x140c37e7f
lea rsp, [rsp + 0x18]
jne 0x140c56824
mov r8d, 0xc6be85be
mov r8, rax
call fcn.140c2982e
lea r8, [rax + rax + 0x21837b90]
lea r10, [r10 + rax*2 - 0x7d6fbd28]
movzx r9d, r8b
and r8d, 0x1da1813a
xadd al, r8b
and rdx, rsi
not rdx
shl eax, 0x61
mov qword [r10 + rax - 0x7d6fbd30], rdx
lea rdi, [rax + r9*4 + 0x4176719]
cqo
lea rbx, [rbx + rax - 0x7d6fbd34]
inc r9w
mov edi, dword [rbx + r8 - 0x1ca10098]
mov ecx, eax
jae 0x140c37b62
mov r9d, 0x851f94a1
push r9
sub rbx, 4
mov r9d, dword [rbx + riz]
mov eax, 0x8292dd92
movzx edx, al
xor r9d, r11d
cwde
bswap r9d
dec r9d
mov esi, 0x1386b732
ror word [rsp + rdx - 0x8e], 0xa5
xor r9d, 0x28a82411
call fcn.140c2b9d7
cmp ebx, 4
push 0x123fd28a
jmp 0x140c2b7e9

Function at 0x140c4fdd9
Capabilities:
Manually build aes constants

Disassembly:
mov di, word es:[r8 + riz]
movsx r8d, cl
sal byte [rsp + 1], 0xe1
rol r9w, 0xcf
adc r10, 6
pop rdx
jmp 0x140c3e7fa
mov qword [rsp], rcx
jmp 0x140c1546d

Function at 0x140c58b56
Capabilities:
Manually build aes constants

Disassembly:
push 0xffffffff82bf089a
lea rsp, [rsp + 0x10]
sub rsp, rcx
call fcn.140c1db9e
Function at 0x140c60f6d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xadd dword [rsp + r9*2 - 0x159], edx
rol r9d, 0xf6
movsxd rax, eax
bt rsi, rdi
pop rdx
sal word [rsp + rsi + 0x63d8b386], 0x2d
adc rbp, rax
dec qword [rsp + rsi + 0x63d8b386]
mov eax, 0x5937bb37
pop rdi
pop r8
pop r8
jg fcn.140c42e49
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140015120
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001126c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012c70
xor al, al
jmp 0x140012cf1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012c83
xor al, al
jmp 0x140012cf1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012cad
xor al, al
jmp 0x140012cf1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012cc1
xor al, al
jmp 0x140012cf1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012cd3
xor al, al
jmp 0x140012cf1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012cef
xor al, al
jmp 0x140012cf1
mov al, 1
add rsp, 0x38
ret

Function at 0x140011a50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011389
movzx eax, al
test eax, eax
jne 0x140011a70
mov ecx, 7
call fcn.140011302
nop
mov byte [rsp + 0x20], 0
call fcn.140011316
mov byte [rsp + 0x21], al
cmp dword [0x14001c220], 1
jne 0x140011a94
mov ecx, 7
call fcn.140011302
nop
jmp 0x140011aec
cmp dword [0x14001c220], 0
jne 0x140011ae7
mov dword [0x14001c220], 1
lea rdx, [0x140019660]
lea rcx, [0x140019330]
call fcn.140011195
test eax, eax
je 0x140011ac8
mov eax, 0xff
jmp 0x140011bf1
lea rdx, [0x140019220]
lea rcx, [section..rdata]
call fcn.14001130c
mov dword [0x14001c220], 2
jmp 0x140011aec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400112f3
call fcn.14001128f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140011b49
mov rcx, qword [rsp + 0x30]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140011b49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140022020]
nop
call fcn.1400112c1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140011b7d
mov rcx, qword [rsp + 0x38]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140011b7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011348
nop
call fcn.140011ca0
mov dword [rsp + 0x28], eax
call fcn.14001126c
movzx eax, al
test eax, eax
jne 0x140011b9c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140011bab
call fcn.140011352
nop
xor edx, edx
mov cl, 1
call fcn.140011140
mov eax, dword [rsp + 0x28]
jmp 0x140011bf1
add rsp, 0x68
ret
Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor esi, dword [rbx]
xor esi, dword [rbx]
xor esi, dword [rbx]
cmp al, 0x8d
add byte [rax], al
push rdx
pop qword [rax]
add byte [rbp + 0x73], dh
Function at 0x140005f30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140005f58
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140005f7e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140005f80
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005fd9
test ecx, ecx
jle 0x140005fb9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005fd9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005fd9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140006000
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140006022
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140006038
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140006054
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140006056
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140006092
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000612e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400060cd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000610e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000612e
cmp rbx, rax
ja 0x1400060e0
test rbx, rbx
je 0x14000612e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140006560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400ca040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000658d
xor eax, eax
jmp 0x1400066f9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400065c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400065c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400066f9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400066ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000660a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140006635
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400066f1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400066a4
sub eax, 1
je 0x1400066a4
cmp eax, 2
jne 0x1400066ec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400066f1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400066d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400066ec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400066f1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14009c500
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140006e00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400ca040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006ed3
cmp byte [rcx + 0x71], 0
je 0x140006ed3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140006ecf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006e94
sub eax, 1
je 0x140006e98
cmp eax, 2
jne 0x140006ecf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14009c500
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006ec6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140006ecf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140006e7c
xor al, al
jmp 0x140006e7c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14009c500
add rsp, 0x60
pop rbx
ret