joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a52f0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r13, rcx
mov rdi, qword [rcx + 0x10]
mov rax, qword [rcx + 0x18]
cmp rdi, rax
jne 0x1400a5495
mov r15, qword [r13]
mov rbx, qword [r13 + 8]
mov rcx, rbx
sub rcx, r15
jbe 0x1400a5377
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
add rax, 1
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, rbx
sub r15, rax
sub rdi, rbx
je 0x1400a5363
mov rcx, r15
mov rdx, rbx
mov r8, rdi
call fcn.140135640
mov rbx, qword [r13 + 8]
add rdi, r15
mov qword [r13 + 0x10], rdi
lea rax, [rbx + r12*8]
mov qword [r13 + 8], rax
jmp 0x1400a5495
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov esi, 1
cmovne rsi, rcx
mov rax, rsi
shr rax, 0x3d
jne 0x1400a54b0
mov r12, rsi
shr r12, 2
lea rcx, [rsi*8]
call fcn.1401321a8
lea r11, [rax + r12*8]
mov r9, r11
lea r8, [rax + rsi*8]
sub rdi, rbx
je 0x1400a546f
lea r10, [rdi - 8]
mov ecx, r10d
shr ecx, 3
add ecx, 1
and rcx, 7
je 0x1400a53f5
neg rcx
mov rdx, r9
nop dword [rax + rax]
mov rsi, qword [rbx]
mov qword [rdx], rsi
add rdx, 8
add rbx, 8
inc rcx
jne 0x1400a53e0
jmp 0x1400a53f8
mov rdx, r9
add r11, rdi
cmp r10, 0x38
jb 0x1400a546b
sar rdi, 3
shl r12, 3
lea rdi, [r12 + rdi*8]
mov rcx, rax
add rcx, rdi
nop word cs:[rax + rax]
nop dword [rax]
mov rdi, qword [rbx]
mov qword [rdx], rdi
mov rdi, qword [rbx + 8]
mov qword [rdx + 8], rdi
mov rdi, qword [rbx + 0x10]
mov qword [rdx + 0x10], rdi
mov rdi, qword [rbx + 0x18]
mov qword [rdx + 0x18], rdi
mov rdi, qword [rbx + 0x20]
mov qword [rdx + 0x20], rdi
mov rdi, qword [rbx + 0x28]
mov qword [rdx + 0x28], rdi
mov rdi, qword [rbx + 0x30]
mov qword [rdx + 0x30], rdi
mov rdi, qword [rbx + 0x38]
mov qword [rdx + 0x38], rdi
add rdx, 0x40
add rbx, 0x40
cmp rcx, rdx
jne 0x1400a5420
mov r15, qword [r13]
mov qword [r13], rax
mov qword [r13 + 8], r9
mov qword [r13 + 0x10], r11
mov qword [r13 + 0x18], r8
test r15, r15
je 0x1400a5492
mov rcx, r15
call fcn.1401321e4
mov rdi, qword [r13 + 0x10]
jmp 0x1400a5495
mov rdi, r11
mov rax, qword [r14]
mov qword [rdi], rax
add qword [r13 + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1401457d4
int3
Function at 0x1400a54c0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov rsi, rcx
mov rcx, qword [rcx]
mov rbx, qword [rsi + 8]
cmp rbx, rcx
je 0x1400a54e9
mov r12, rbx
jmp 0x1400a565e
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x1400a553f
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea rdi, [rax + rcx]
add rdi, 1
sar rdi, 1
lea r12, [r15 + rdi*8]
mov r8, r15
sub r8, rbx
je 0x1400a552e
sub r12, r8
mov rcx, r12
mov rdx, rbx
call fcn.140135640
mov r15, qword [rsi + 0x10]
mov qword [rsi + 8], r12
lea rax, [r15 + rdi*8]
mov qword [rsi + 0x10], rax
jmp 0x1400a565e
sub rax, rcx
mov rcx, rax
sar rcx, 2
test rax, rax
mov edi, 1
cmovne rdi, rcx
mov rax, rdi
shr rax, 0x3d
jne 0x1400a567b
lea r13, [rdi + 3]
shr r13, 2
lea rcx, [rdi*8]
call fcn.1401321a8
lea r10, [rax + r13*8]
mov r12, r10
lea r8, [rax + rdi*8]
sub r15, rbx
je 0x1400a563e
lea r9, [r15 - 8]
mov edx, r9d
shr edx, 3
add edx, 1
and rdx, 7
je 0x1400a55c5
neg rdx
mov rdi, r12
nop word cs:[rax + rax]
nop
mov rcx, qword [rbx]
mov qword [rdi], rcx
add rdi, 8
add rbx, 8
inc rdx
jne 0x1400a55b0
jmp 0x1400a55c8
mov rdi, r12
add r10, r15
cmp r9, 0x38
jb 0x1400a563b
sar r15, 3
shl r13, 3
lea rcx, [r15*8]
add rcx, r13
mov rdx, rax
add rdx, rcx
nop word [rax + rax]
mov rcx, qword [rbx]
mov qword [rdi], rcx
mov rcx, qword [rbx + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 0x10]
mov qword [rdi + 0x10], rcx
mov rcx, qword [rbx + 0x18]
mov qword [rdi + 0x18], rcx
mov rcx, qword [rbx + 0x20]
mov qword [rdi + 0x20], rcx
mov rcx, qword [rbx + 0x28]
mov qword [rdi + 0x28], rcx
mov rcx, qword [rbx + 0x30]
mov qword [rdi + 0x30], rcx
mov rcx, qword [rbx + 0x38]
mov qword [rdi + 0x38], rcx
add rdi, 0x40
add rbx, 0x40
cmp rdx, rdi
jne 0x1400a55f0
mov rbx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
test rbx, rbx
je 0x1400a565e
mov rcx, rbx
call fcn.1401321e4
mov r12, qword [rsi + 8]
mov rax, qword [r14]
mov qword [r12 - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1401457d4
int3
Function at 0x1400a7740
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.1400a92f0
mov byte [rsi + 8], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
lea rax, [0x140174da0]
mov qword [rsi], rax
lea rax, [rsi + 0x20]
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rsi + 0x18], rax
je 0x1400a77e0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 0x18]
add rax, 1
cmp rax, 2
jb 0x1400a77c5
call fcn.14002da00
mov rcx, qword [rsi + 0x18]
call fcn.140042990
mov qword [rsi + 0x18], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400a77d8
mov qword [rsi + 0x18], rdi
call fcn.14002da00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400bb160
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x168
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword [0x1401b9ec0]
test rax, rax
jne 0x1400bb1a4
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call rdi
mov rax, qword [0x1401b9ec0]
test rax, rax
je 0x1400bb191
cmp eax, 2
jne 0x1400bb1f2
mov ecx, 2
call fcn.14002dd00
test al, al
je 0x1400bb28a
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0x84
mov r9d, 2
call fcn.14002dda0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
jmp 0x1400bb27d
mov eax, 1
lock xadd qword [0x1401b9ef8], rax
test rax, rax
jle 0x1400bb212
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1401b9e78], eax
mov qword [0x1401b9e70], rsi
mov rcx, qword [0x1401b48d8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 2
call fcn.14002dd00
test al, al
je 0x1400bb28a
lea rdx, str..._.._third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov r8d, 0xb0
mov r9d, 2
call fcn.14002dda0
lea rcx, [rsp + 0x30]
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
call fcn.140001e21
mov rcx, rsi
call fcn.14002e260
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140132550
xor eax, eax
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x1400bc42d
Capabilities:
Check if file exists
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x198], rax
lea rbx, [rcx + 2]
test byte [rcx], 1
mov rcx, rbx
je 0x1400bc45c
mov rcx, qword [rsi + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x1400bc562
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400bc49e
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140132550
mov rcx, rsi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
jmp fcn.1400bc57f
mov ecx, 2
call fcn.14002dd00
test al, al
je 0x1400bc560
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x261
mov r9d, 2
call fcn.14002ecb0
lea rcx, [rsp + 0x60]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.140001e21
movzx edx, byte [rsi]
mov rcx, rdx
shr rcx, 1
test dl, 1
cmovne rbx, qword [rsi + 0x10]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov qword [rdx], rbx
cmovne rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.14003a3d0
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400bc535
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
jmp 0x1400bc53d
shr r8, 1
lea rdx, [rsp + 0x39]
mov rcx, rdi
call fcn.140001e21
test byte [rsp + 0x38], 1
je 0x1400bc556
mov rcx, qword [rsp + 0x48]
call fcn.1401321e4
lea rcx, [rsp + 0x50]
call fcn.14002eda0
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.140132550
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400bc57f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rsi, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
lea rbx, [rcx + 2]
test byte [rcx], 1
mov rcx, rbx
je 0x1400bc5ae
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400bc65d
mov dil, 1
test al, 0x10
jne 0x1400bc763
mov ecx, 2
call fcn.14002dd00
test al, al
je 0x1400bc761
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x24f
mov r9d, 2
call fcn.14002dda0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140001e21
movzx edx, byte [rsi]
mov rcx, rdx
shr rcx, 1
test dl, 1
cmovne rbx, qword [rsi + 0x10]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov qword [rdx], rbx
cmovne rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14003a3d0
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400bc721
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
jmp 0x1400bc729
mov ecx, 2
call fcn.14002dd00
test al, al
je 0x1400bc761
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_client_crash_report_database_win.cc
lea rcx, [rsp + 0x60]
mov r8d, 0x24b
mov r9d, 2
call fcn.14002ecb0
lea rcx, [rsp + 0x70]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.140001e21
movzx edx, byte [rsi]
mov rcx, rdx
shr rcx, 1
test dl, 1
cmovne rbx, qword [rsi + 0x10]
mov rdi, rax
lea rdx, [rsp + 0x38]
mov qword [rdx], rbx
cmovne rcx, qword [rsi + 8]
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x48]
mov rcx, rsi
call fcn.14003a3d0
movzx r8d, byte [rsi]
test r8b, 1
je 0x1400bc6f4
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
jmp 0x1400bc6fc
shr r8, 1
lea rdx, [rsp + 0x49]
mov rcx, rdi
call fcn.140001e21
test byte [rsp + 0x48], 1
je 0x1400bc715
mov rcx, qword [rsp + 0x58]
call fcn.1401321e4
lea rcx, [rsp + 0x60]
call fcn.14002eda0
jmp 0x1400bc761
shr r8, 1
lea rdx, [rsp + 0x49]
mov rcx, rdi
call fcn.140001e21
lea rdx, str.:_not_a_directory
mov r8d, 0x11
mov rcx, rax
call fcn.140001e21
test byte [rsp + 0x48], 1
je 0x1400bc757
mov rcx, qword [rsp + 0x58]
call fcn.1401321e4
lea rcx, [rsp + 0x60]
call fcn.14002e260
xor edi, edi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140132550
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400bdf50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r14, r8
mov r15, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
mov rbx, qword [rcx + 0x38]
mov rsi, qword [rcx + 0x40]
cmp rbx, rsi
je 0x1400bdfbe
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400e2968
test al, al
jne 0x1400bdfbb
add rbx, 0x70
lea rdi, [rsp + 0x20]
cmp rsi, rbx
je 0x1400bdfbe
mov rcx, rbx
mov rdx, rdi
call fcn.1400e2968
add rbx, 0x70
test al, al
je 0x1400bdf9f
add rbx, 0xffffffffffffff90
mov rsi, rbx
cmp qword [r15 + 0x40], rsi
je 0x1400bdfd0
test byte [rsi + 0x10], 1
je 0x1400bdfd7
mov rcx, qword [rsi + 0x20]
jmp 0x1400bdfdb
mov edi, 1
jmp 0x1400bdffd
lea rcx, [rsi + 0x12]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov edi, 1
cmovne edi, ecx
test edi, edi
jne 0x1400bdffd
mov qword [r14], rsi
xor edi, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140132550
mov eax, edi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400bf6da
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0x68]
cmp eax, edx
jne 0x1400bf6f1
test byte [rcx + 0x10], 1
je 0x1400bf700
mov rcx, qword [rcx + 0x20]
jmp 0x1400bf704
xor ecx, ecx
cmp eax, 1
sete cl
lea eax, [rcx + rcx*2]
inc eax
jmp 0x1400bf71d
add rcx, 0x12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
mov eax, 1
cmovne eax, ecx
add rsp, 0x28
ret
Function at 0x1400c8e66
Capabilities:
Compare security identifiers

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [rcx + 0x6c], 0
je 0x1400c8fef
mov rsi, rdx
mov rbx, rcx
lea r9, [rsp + 0x44]
mov dword [r9], 0xaaaaaaaa
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x38]
mov qword [rdi], rax
lea rdx, [rcx + 0x60]
mov rcx, rdi
mov r8d, 2
call fcn.1400c9029
mov r13, qword [rdi]
test r13, r13
je 0x1400c8ff6
mov qword [rsp + 0x28], rbx
cmp dword [r13], 0
je 0x1400c8fda
lea r14, [r13 + 8]
mov rax, qword [rsp + 0x28]
add rax, 0x30
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov rbx, qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rbp, r12
shl rbp, 4
test dword [r14 + rbp + 8], 0xc0000020
jne 0x1400c8fca
add rbp, r14
test rsi, rsi
je 0x1400c8f7c
mov rax, qword [rsi]
cmp qword [rsi + 8], rax
je 0x1400c8f7c
mov r15d, 1
xor ecx, ecx
mov rdi, qword [rbp]
mov rdx, rcx
shl rdx, 6
lea rcx, [rdx + rcx*4]
add rcx, rax
call fcn.140008780
mov rcx, rax
mov rdx, rdi
call rbx
test eax, eax
jne 0x1400c8fca
mov ecx, r15d
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
sub rdx, rax
sar rdx, 2
movabs rdi, 0xf0f0f0f0f0f0f0f1
imul rdx, rdi
inc r15d
cmp rdx, rcx
ja 0x1400c8f32
mov r15, rbx
mov rdx, qword [rbp]
lea rbx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400c9a60
mov rbp, qword [rsp + 0x28]
mov rdi, qword [rbp + 0x38]
cmp rdi, qword [rbp + 0x40]
jae 0x1400c8fba
mov r8d, 0x44
mov rcx, rdi
mov rdx, rbx
call fcn.140135640
add rdi, 0x44
mov qword [rbp + 0x38], rdi
jmp 0x1400c8fc7
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call fcn.140096b32
mov rbx, r15
inc r12
mov eax, dword [r13]
cmp r12, rax
jb 0x1400c8f03
mov qword [rsp + 0x38], 0
mov rcx, r13
call fcn.140132224
xor esi, esi
jmp 0x1400c9003
mov esi, 0x3f0
jmp 0x1400c9003
mov esi, dword [rsp + 0x44]
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140132550
mov eax, esi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400cb441
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x34]
mov dword [r12], 0xaaaaaaaa
mov qword [rsp + 0x20], r12
mov r8, r9
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400cb4ef
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x28]
mov qword [rbp], rax
mov qword [rsp + 0x20], rbp
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r14d, eax
mov r15, qword [rbp]
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1400cb4ef
test r14d, r14d
setne al
cmp r15, rsi
sete sil
and sil, al
jmp 0x1400cb4f1
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140132550
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400cfc90
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
cmp dword [rcx + 0x10], 0
je 0x1400cfcac
mov rax, qword [rsi]
mov rcx, rax
jmp 0x1400cfcd7
mov rax, qword [rsi]
test rax, rax
je 0x1400cfcb9
mov rcx, rax
jmp 0x1400cfcd7
cmp dword [rsi + 0x14], 0
je 0x1400cfcc6
mov rcx, rax
xor eax, eax
jmp 0x1400cfcd7
mov rcx, rax
xor eax, eax
cmp qword [rsi + 8], 0
mov edx, 0
je 0x1400cfd2e
add rcx, 1
cmp rcx, 2
jb 0x1400cfcf7
call fcn.14002da00
mov rcx, qword [rsi]
call fcn.140042990
mov qword [rsi], 0
xor eax, eax
mov rcx, qword [rsi + 8]
lea rdx, [rcx + 1]
cmp rdx, 2
jb 0x1400cfd20
call fcn.14002da00
mov rcx, qword [rsi + 8]
call fcn.140042990
mov qword [rsi + 8], 0
mov rax, qword [rsi]
xor ecx, ecx
mov rdx, rax
mov qword [rsi + 0x10], 0
mov rax, rcx
mov rbx, qword [rdi]
cmp rdx, rbx
je 0x1400cfd7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x1400cfd5f
call fcn.14002da00
mov rcx, qword [rsi]
call fcn.140042990
mov qword [rsi], 0
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400cfd71
mov qword [rsi], rbx
call fcn.14002da00
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi + 8]
mov rbp, qword [rdi + 8]
cmp rax, rbp
je 0x1400cfdcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi + 8]
add rax, 1
cmp rax, 2
jb 0x1400cfdb2
call fcn.14002da00
mov rcx, qword [rsi + 8]
call fcn.140042990
mov qword [rsi + 8], 0
lea rax, [rbp + 1]
cmp rax, 2
jb 0x1400cfdc5
mov qword [rsi + 8], rbp
call fcn.14002da00
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x14], eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400cff00
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x1400cffb6
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], 0
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbp
mov rbx, rax
call rbp
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edi, eax
test eax, eax
je 0x1400cffba
mov rbx, qword [rsp + 0x38]
cmp qword [rsi], rbx
je 0x1400cffca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x1400cffa2
call fcn.14002da00
mov rcx, qword [rsi]
call fcn.140042990
mov qword [rsi], 0
lea rax, [rbx + 1]
cmp rax, 2
jb 0x1400cffc2
mov qword [rsi], rbx
call fcn.14002da00
jmp 0x1400cffc2
mov bl, 1
jmp 0x1400cffcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
setne bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140132550
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400d012c
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.1400cfe90
test al, al
je 0x1400d015a
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdi, [rsi + 0x38]
mov rcx, rdi
xor edx, edx
call fcn.1400d01c4
mov rcx, qword [rsi + 0x58]
test rcx, rcx
je 0x1400d017a
mov qword [rsi + 0x60], rcx
call fcn.1401321e4
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x50], 0
test rcx, rcx
je 0x1400d0190
call fcn.140042f50
mov rcx, rdi
xor edx, edx
call fcn.1400d01c4
lea rcx, [rsi + 0x28]
call fcn.1400067c0
lea rcx, [rsi + 0x20]
call fcn.1400067c0
lea rcx, [rsi + 0x18]
call fcn.1400067c0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400cfdf0
Function at 0x1400d094a
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400cfe90
test al, al
je 0x1400d096c
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x1400d3870
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [0x1401ba238]
mov ecx, dword [0x1401b7730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400d38ad
lea rcx, [0x1401ba230]
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14005c640
lea rcx, [0x1401ba238]
call fcn.140132300
cmp dword [0x1401ba238], 0xffffffff
jne 0x1400d3899
mov qword [0x1401ba230], 0
lea rcx, [0x1401ba230]
xor edx, edx
call fcn.14005c690
lea rcx, [0x1401ba238]
call fcn.140132398
jmp 0x1400d3899

Function at 0x1400d38f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1401ba238]
mov ecx, dword [0x1401b7730]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400d3925
lea rcx, [0x1401ba230]
add rsp, 0x28
jmp fcn.14005c600
lea rcx, [0x1401ba238]
call fcn.140132300
cmp dword [0x1401ba238], 0xffffffff
jne 0x1400d3915
mov qword [0x1401ba230], 0
lea rcx, [0x1401ba230]
xor edx, edx
call fcn.14005c690
lea rcx, [0x1401ba238]
call fcn.140132398
jmp 0x1400d3915

Function at 0x1400d3970
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1401b46a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebp, 0x57
test rcx, rcx
je 0x1400d3a40
mov rdi, rdx
test rdx, rdx
je 0x1400d3a40
mov ebx, r8d
test r8d, r8d
je 0x1400d3a40
mov rsi, rcx
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], 0
lea rdx, [rsp + 0x30]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400d3a38
test byte [rsp + 0x54], 0xf0
mov eax, 4
mov r8d, 0x40
cmove r8d, eax
movsxd rbx, ebx
lea r9, [rsp + 0x2c]
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400d3a38
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call fcn.140135640
mov r8d, dword [rsp + 0x2c]
lea r9, [rsp + 0x2c]
mov rcx, rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebp, ebp
jmp 0x1400d3a40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140132550
mov eax, ebp
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400d5700
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 8]
jmp 0x1400d5717
mov rsi, qword [rsi + 0x218]
test rsi, rsi
je 0x1400d574b
xor edi, edi
xchg qword [rsi], rdi
test rdi, rdi
je 0x1400d5710
nop word cs:[rax + rax]
bsf rcx, rdi
mov ebx, 1
shl rbx, cl
mov rcx, qword [rsi + rcx*8 + 0x10]
call qword [rcx + 8]
xor rdi, rbx
jne 0x1400d5730
jmp 0x1400d5710
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret