joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140085500
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor r9d, r9d
xor r8d, r8d
mov rdi, rcx
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
lea rbx, [rax*2 + 4]
call fcn.1400804a4
mov rcx, rax
mov rdx, rbx
call fcn.14007ffbc
mov rbx, rax
test rax, rax
je 0x140085573
lea r8, [rsi + 1]
mov r9, rbx
mov edx, 0xd
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.1400804a4
mov r9, rax
or r8, 0xffffffffffffffff
mov rdx, rbx
mov ecx, 0xfde9
call fcn.14008902c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140085be4
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea r8, [rsp + 0x30]
mov ecx, 0x400
mov dword [rsp + 0x30], ebx
lea r9d, [rbx + 2]
lea edx, [rbx + 0xd]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [rsp + 0x30], 0x30
setne bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140087430
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x500
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebx, eax
je 0x140087525
mov r8d, ebx
lea rdx, str._r_nThread:__x_r_n
mov rcx, rdi
call fcn.14007d820
xor edx, edx
mov r8d, ebx
lea ecx, [rdx + 0x4a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
jne 0x1400874a2
or r8, 0xffffffffffffffff
lea rdx, str.Failed_to_OpenThread___r_n
mov rcx, rdi
call fcn.14007d6e8
jmp 0x140087525
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1400874c5
or r8, 0xffffffffffffffff
lea rdx, str.Failed_to_SuspendThread___r_n
mov rcx, rdi
call fcn.14007d6e8
jmp 0x14008751c
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call fcn.1400eced0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x10000b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, rdi
test eax, eax
je 0x140087503
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.14008727c
jmp 0x140087513
or r8, 0xffffffffffffffff
lea rdx, str.Failed_to_GetThreadContext___r_n
call fcn.14007d6e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x520]
add rsp, 0x500
pop rdi
ret
Function at 0x140087688
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1400876bc
jmp 0x140087722
mov dword [rsp + 0x38], 0x1c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Thread32First]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140087717
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x44], eax
jne 0x140087701
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.140087430
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Thread32Next]
mov dword [rsp + 0x20], eax
jmp 0x1400876e2
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400eb9c0
add rsp, 0x68
ret

Function at 0x14008c324
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp byte [0x1401684f3], 0
lea rsi, [0x140169c20]
mov r11, r8
mov rbx, rdx
jne 0x14008c3a1
and dword [0x140169c20], 0
mov r10d, 1
lea r9d, [r10 + 0x7f]
mov eax, r10d
lea edi, [r9 + r9]
and al, 1
neg al
mov eax, r10d
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
mov r10d, ecx
xor r10d, eax
xor r8d, r8d
lea eax, [r8 + r9]
mov edx, r10d
xor edx, dword [rsi + r8*4]
add r8d, edi
mov dword [rsi + rax*4], edx
cmp r8d, 0x100
jb 0x14008c37b
shr r9d, 1
jne 0x14008c35a
mov byte [0x1401684f3], 1
or r8d, 0xffffffff
test r11, r11
je 0x14008c3c7
movzx ecx, byte [rbx]
mov eax, r8d
xor rcx, rax
shr r8d, 8
movzx edx, cl
inc rbx
xor r8d, dword [rsi + rdx*4]
sub r11, 1
jne 0x14008c3aa
mov rbx, qword [rsp + 8]
not r8d
mov rsi, qword [rsp + 0x10]
mov eax, r8d
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14008cad0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rdx
mov rdi, rcx
mov rdx, rcx
lea rcx, str.HttpGet:_url:__s_n
call fcn.14007fe80
or rdx, 0xffffffffffffffff
mov dword [rsp + 0x34], 4
mov rcx, rdi
xor esi, esi
call fcn.140080930
lea rdx, str.https
mov r15, rax
lea ebp, [rsi + 1]
cmp rdi, rdx
jne 0x14008cb36
mov edi, ebp
jmp 0x14008cb51
test rdi, rdi
je 0x14008cb51
mov r8d, 5
mov rcx, rdi
call fcn.140102768
xor edi, edi
test eax, eax
sete dil
and dword [rbx + 0x48], esi
lea rcx, str.SumatraPdfHTTP
and dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [0x140165220]
mov r14, rax
test rax, rax
jne 0x14008cb81
lea rcx, str.HttpGet:_InternetOpen_failed_n
jmp 0x14008cc40
and qword [rsp + 0x28], rsi
xor r9d, r9d
shl edi, 0x17
xor r8d, r8d
sub edi, 0x7bfff000
mov rdx, r15
mov rcx, r14
mov dword [rsp + 0x20], edi
call qword [0x140165228]
mov rsi, rax
test rax, rax
jne 0x14008cbb9
lea rcx, str.HttpGet:_InternetOpenUrl_failed_n
jmp 0x14008cc40
and qword [rsp + 0x20], 0
lea r8, [rbx + 0x4c]
lea r9, [rsp + 0x34]
mov edx, 0x20000013
mov rcx, rsi
call qword [0x140165218]
test eax, eax
jne 0x14008cbe3
lea rcx, str.HttpGet:_HttpQueryInfoW_failed_n
jmp 0x14008cc40
mov edi, 0x400
jmp 0x14008cc1a
cmp dword [rsp + 0x30], 0
je 0x14008cc65
lock add dword [0x140167c58], ebp
mov r8d, dword [rsp + 0x30]
lea rcx, [rbx + 8]
lea rdx, [rsp + 0x40]
call fcn.14007d6e8
lock dec dword [0x140167c58]
test al, al
je 0x14008ccb8
and dword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
mov r8d, edi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [0x140165260]
test eax, eax
jne 0x14008cbea
lea rcx, str.HttpGet:_InternetReadFile_failed_n
call fcn.14007fe80
xor ecx, ecx
call fcn.140082f5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x48], eax
test eax, eax
jne 0x14008cc60
mov dword [rbx + 0x48], 0x1f
test rsi, rsi
je 0x14008cc6e
mov rcx, rsi
call qword [0x140165238]
test r14, r14
je 0x14008cc7c
mov rcx, r14
call qword [0x140165238]
cmp dword [rbx + 0x48], 0
jne 0x14008cc8b
cmp dword [rbx + 0x4c], 0xc8
je 0x14008cc8e
xor bpl, bpl
mov al, bpl
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x490]
add rsp, 0x450
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.HttpGet:_data.Append_failed_n
call fcn.14007fe80
jmp 0x14008cc4c
Function at 0x14008ccc8
Capabilities:
Check http status code
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rdi, rdx
mov r8, rdx
mov rdx, rcx
mov r15, rcx
lea rcx, str.HttpGetToFile:_url:__s__file:__s_n
call fcn.14007fe80
xor ebx, ebx
mov dword [rsp + 0x48], 4
and dword [rsp + 0x40], ebx
xor r14b, r14b
and dword [rsp + 0x44], ebx
xor esi, esi
or r12, 0xffffffffffffffff
test r15, r15
je 0x14008cd48
call fcn.1400804a4
mov r8, rax
mov rdx, r12
mov rcx, r15
call fcn.140088f60
mov r15, rax
test rdi, rdi
jne 0x14008cd51
xor eax, eax
jmp 0x14008cd64
call fcn.1400804a4
mov r8, rax
mov rdx, r12
mov rcx, rdi
call fcn.140088f60
and qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x14008cdb2
mov rdx, rdi
lea rcx, str.HttpGetToFile:_CreateFileW__s__failed_n
call fcn.14007fe80
xor ecx, ecx
call fcn.140082f5c
jmp 0x14008ce82
and dword [rsp + 0x20], ebx
lea rcx, str.SumatraPdfHTTP
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [0x140165220]
mov rsi, rax
test rax, rax
je 0x14008ce82
and qword [rsp + 0x28], rbx
xor r9d, r9d
and dword [rsp + 0x20], ebx
xor r8d, r8d
mov rdx, r15
mov rcx, rax
call qword [0x140165228]
mov rbx, rax
test rax, rax
je 0x14008ce82
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x44]
mov edx, 0x20000013
mov rcx, rax
call qword [0x140165218]
test eax, eax
je 0x14008ce82
cmp dword [rsp + 0x44], 0xc8
jne 0x14008ce82
mov r15d, 0x400
jmp 0x14008ce63
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x14008ce7f
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14008ce82
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x4c], eax
jne 0x14008ce82
lea r9, [rsp + 0x40]
mov r8d, r15d
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [0x140165260]
test eax, eax
jne 0x14008ce32
jmp 0x14008ce82
mov r14b, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14008ce99
mov rcx, rbx
call qword [0x140165238]
test rsi, rsi
je 0x14008cea7
mov rcx, rsi
call qword [0x140165238]
test r14b, r14b
jne 0x14008ceb4
mov rcx, rdi
call fcn.140081964
mov al, r14b
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400eb9c0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14008d1ec
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
and dword [rcx + 0x38], 0
lea rax, [rcx + 0x18]
and qword [rcx], 0
mov rdi, rcx
and dword [rcx + 0x10], 0
mov rbx, rdx
mov qword [rcx + 8], rax
xor edx, edx
mov dword [rcx + 0x14], 1
mov byte [rax], 0
and qword [rcx + 0x40], 0
and qword [rcx + 0x58], 0
lea r8d, [rdx + 0x40]
and qword [rdi + 0x48], 0
add rcx, 0x68
mov qword [rdi + 0x50], 0xf
mov qword [rdi + 0x60], rcx
call fcn.1400eced0
and qword [rdi + 0xb0], 0
lea r15, [rdi + 0xac]
and dword [r15], 0
mov rdx, r15
mov rcx, rbx
mov dword [rdi + 0xa8], 1
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov r14, rax
cmp dword [r15], esi
jle 0x14008d2c3
mov rbx, rax
mov rbp, qword [rbx]
test rbp, rbp
jne 0x14008d294
xor eax, eax
jmp 0x14008d2ad
call fcn.1400804a4
mov r9, rax
or r8, 0xffffffffffffffff
mov rdx, rbp
mov ecx, 0xfde9
call fcn.14008902c
mov rdx, rax
mov rcx, rdi
call fcn.14007eaec
inc esi
add rbx, 8
cmp esi, dword [r15]
jl 0x14008d288
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14008ed50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r13, r8
mov r12b, dl
mov r15, rcx
test rcx, rcx
jne 0x14008ed8b
xor eax, eax
jmp 0x14008ed9f
call fcn.1400804a4
mov r8, rax
or rdx, 0xffffffffffffffff
mov rcx, r15
call fcn.140088f60
lea rdx, [0x14014613c]
mov rcx, rax
call fcn.140080cf4
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14008eeda
mov bpl, 1
mov esi, dword [rsp + 0x30]
test sil, 0x40
je 0x14008edde
xor bl, bl
jmp 0x14008edfa
test sil, 0x10
jne 0x14008edda
bt esi, 0xc
jb 0x14008edda
bt esi, 8
jb 0x14008edda
mov ebx, esi
shr ebx, 0xa
not bl
and bl, 1
shr esi, 4
and sil, 1
call fcn.1400804a4
mov r9, rax
lea rdx, [rsp + 0x5c]
or r8, 0xffffffffffffffff
mov ecx, 0xfde9
call fcn.14008902c
xor r8d, r8d
mov rdx, rax
mov rcx, r15
mov rdi, rax
call fcn.1400809f4
test bl, bl
je 0x14008ee5f
mov rcx, qword [r13 + 0x38]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
test rcx, rcx
je 0x14008ef07
mov rax, qword [rcx]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [rax + 0x10]
jmp 0x14008eeaf
test r12b, r12b
je 0x14008eeb2
test sil, sil
je 0x14008eeb2
lea rcx, [0x140132ff8]
cmp rdi, rcx
je 0x14008eeb2
test rdi, rdi
je 0x14008eea1
mov dl, 0x2e
cmp byte [rdi], dl
jne 0x14008ee86
cmp byte [rdi + 1], 0
je 0x14008eeb2
lea rcx, [0x140146138]
cmp rdi, rcx
je 0x14008eeb2
cmp byte [rdi], dl
jne 0x14008eea1
cmp byte [rdi + 1], dl
jne 0x14008eea1
cmp byte [rdi + 2], 0
je 0x14008eeb2
mov r8, r13
mov dl, r12b
mov rcx, rax
call fcn.14008ed50
mov bpl, al
test bpl, bpl
je 0x14008eecd
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14008edd0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x14008eedc
xor al, al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x2e8]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400ec864
int3
Function at 0x14008ef7c
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dil, r8b
mov rsi, rdx
mov rbx, rcx
call fcn.140080c10
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x250
mov rbp, rax
call fcn.1400eced0
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov rcx, rbx
call fcn.140088f60
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14008efed
xor al, al
jmp 0x14008f0b5
call fcn.1400804a4
mov r9, rax
lea rdx, [rsp + 0x4c]
or r8, 0xffffffffffffffff
mov ecx, 0xfde9
call fcn.14008902c
mov ecx, dword [rsp + 0x20]
test cl, 0x40
jne 0x14008f02f
test cl, 0x10
jne 0x14008f02f
bt ecx, 0xc
jb 0x14008f02f
bt ecx, 8
jb 0x14008f02f
bt ecx, 0xa
jb 0x14008f02f
test dil, dil
jne 0x14008f08e
jmp 0x14008f075
shr ecx, 4
test cl, 1
je 0x14008f08e
test dil, dil
je 0x14008f08e
lea rcx, [0x140132ff8]
cmp rax, rcx
je 0x14008f08e
test rax, rax
je 0x14008f075
cmp byte [rax], 0x2e
jne 0x14008f058
cmp byte [rax + 1], 0
je 0x14008f08e
lea rcx, [0x140146138]
cmp rax, rcx
je 0x14008f08e
cmp byte [rax], 0x2e
jne 0x14008f075
cmp byte [rax + 1], 0x2e
jne 0x14008f075
cmp byte [rax + 2], 0
je 0x14008f08e
xor r8d, r8d
mov rdx, rax
mov rcx, rbp
call fcn.1400809f4
mov rdx, rax
mov rcx, rsi
call fcn.14007eaec
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14008efed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp qword [rsi + 0x48], 0
seta al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140093794
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x40
call fcn.1400ebc6c
mov rdi, rax
and qword [rax + 0x38], 0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400937cc
mov rdx, qword [rcx]
mov r8, qword [rdx]
mov rdx, rax
call r8
mov qword [rdi + 0x38], rax
and qword [rsp + 0x28], 0
lea r8, [0x140093740]
and dword [rsp + 0x20], 0
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400937fe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b3e9c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, rdi
call fcn.14009335c
lea rcx, str.fileZip
mov ebx, 0x120
cmp rax, rcx
jne 0x1400b3ed7
xor edx, edx
mov rcx, rdi
call fcn.1400956fc
jmp 0x1400b3f2e
lea rcx, str.fileRar
cmp rax, rcx
jne 0x1400b3efa
mov rcx, rbx
call fcn.1400ebc6c
mov rdx, qword [0x1401657d8]
mov r8d, 1
jmp 0x1400b3f1b
lea rcx, str.file7Z
cmp rax, rcx
jne 0x1400b3f36
mov rcx, rbx
call fcn.1400ebc6c
mov rdx, qword [0x140165810]
mov r8d, 2
mov rcx, rax
call fcn.140095138
mov rdx, rdi
mov rcx, rax
call fcn.14009563c
mov rsi, rax
test rax, rax
jne 0x1400b3f8e
mov rcx, rdi
call fcn.1400934fc
lea rdx, str.fileCbt
cmp rax, rdx
je 0x1400b3f5a
lea rdx, str.fileTar
cmp rax, rdx
jne 0x1400b4028
mov rcx, rbx
call fcn.1400ebc6c
mov rdx, qword [0x140165838]
mov r8d, 3
mov rcx, rax
call fcn.140095138
mov rdx, rdi
mov rcx, rax
call fcn.14009563c
mov rsi, rax
test rax, rax
je 0x1400b4028
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rsp + 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rbx, qword [rsp + 0x50]
lea rcx, str.EngineCbx::CreateFromFile__:_opening_archive_took__.2f_n
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x58]
cvtsi2sd xmm1, rbx
divsd xmm1, xmm0
mulsd xmm1, qword [0x140149f78]
movq rdx, xmm1
call fcn.14007fe80
mov ecx, 0x358
call fcn.1400ebc6c
mov rdx, rsi
mov rcx, rax
call fcn.1400b3168
mov rbx, rax
test rdi, rdi
je 0x1400b4016
mov rdx, rdi
mov rcx, rax
call fcn.14009eba4
mov rcx, rbx
call fcn.1400b3510
test al, al
je 0x1400b4016
mov rax, rbx
jmp 0x1400b402a
test rbx, rbx
je 0x1400b4028
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
xor eax, eax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b5df8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov edi, r9d
mov rbp, r8
xor r9d, r9d
xor r8d, r8d
mov ebx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], eax
cmp eax, ebx
je 0x1400b5e2f
xor al, al
jmp 0x1400b5e58
xor ebx, ebx
lea r9, [rsp + 0x48]
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400b5e56
cmp dword [rsp + 0x48], edi
jne 0x1400b5e56
mov bl, 1
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b9328
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rdx + 8]
mov rbx, rcx
mov rdi, qword [rdx]
mov edx, 1
lea rcx, [rax + rax*2]
shr rcx, 2
lea rsi, [rdi + rax]
call fcn.140100dac
xor r9b, r9b
mov r10, rax
xor r11d, r11d
mov r8, rax
cmp rdi, rsi
jae 0x1400b944c
mov cl, byte [rdi]
cmp cl, 0x3d
je 0x1400b944c
lea edx, [rcx - 0x41]
cmp dl, 0x19
jbe 0x1400b9395
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x1400b938b
lea edx, [rcx - 0x47]
jmp 0x1400b9395
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400b93b0
lea edx, [rcx + 4]
cmp dl, 0xff
jne 0x1400b93c0
cmp cl, 0x20
je 0x1400b93ab
sub cl, 9
cmp cl, 4
ja 0x1400b9439
inc rdi
jmp 0x1400b9363
cmp cl, 0x2b
jne 0x1400b93b9
mov dl, 0x3e
jmp 0x1400b93c0
cmp cl, 0x2f
jne 0x1400b939a
mov dl, 0x3f
mov ecx, r11d
and ecx, 0x80000003
jge 0x1400b93d2
dec ecx
or ecx, 0xfffffffc
inc ecx
inc r11d
test ecx, ecx
je 0x1400b9431
sub ecx, 1
je 0x1400b9413
sub ecx, 1
je 0x1400b93f8
cmp ecx, 1
jne 0x1400b93ab
mov al, r9b
shl al, 6
or al, dl
mov byte [r8], al
inc r8
jmp 0x1400b93ab
shl r9b, 4
mov al, dl
sar al, 2
or al, r9b
mov r9b, dl
mov byte [r8], al
inc r8
and r9b, 3
jmp 0x1400b93ab
shl r9b, 2
mov al, dl
sar al, 4
or al, r9b
mov r9b, dl
mov byte [r8], al
inc r8
and r9b, 0xf
jmp 0x1400b93ab
mov r9b, dl
jmp 0x1400b93ab
mov rcx, r10
call fcn.1400feb88
and qword [rbx], 0
and qword [rbx + 8], 0
jmp 0x1400b9456
sub r8, r10
mov qword [rbx], r10
mov qword [rbx + 8], r8
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c5ce0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.140120c90
sub rsp, rax
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rax, qword [0x1401683e0]
xor ebx, ebx
mov bpl, r8b
mov rsi, rdx
mov rdi, rcx
test rax, rax
jne 0x1400c5db1
cmp byte [0x1401683d8], bl
jne 0x1400c5db1
mov edx, 0x800
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1400c5d4b
mov qword [0x1401683d0], rbx
jmp 0x1400c5da3
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.1400c91f8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1401683d0], rax
test rax, rax
je 0x1400c5da3
lea rdx, str.CryptProtectMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401683d0]
lea rdx, str.CryptUnprotectMemory
mov qword [0x1401683e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401683e8], rax
mov rax, qword [0x1401683e0]
mov byte [0x1401683d8], 1
mov rdx, rsi
and rdx, 0xfffffffffffffff0
test bpl, bpl
je 0x1400c5dd0
test rax, rax
je 0x1400c5dea
xor r8d, r8d
mov rcx, rdi
call rax
test eax, eax
je 0x1400c5e28
jmp 0x1400c5e05
mov rax, qword [0x1401683e8]
test rax, rax
je 0x1400c5dea
xor r8d, r8d
mov rcx, rdi
call rax
test eax, eax
je 0x1400c5e62
jmp 0x1400c5e05
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test rsi, rsi
je 0x1400c5e05
lea ecx, [rax + 0x4b]
add cl, bl
xor byte [rdi + rbx], cl
inc rbx
cmp rbx, rsi
jb 0x1400c5df5
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.CryptProtectMemory_failed
lea rcx, [0x140162f60]
call fcn.1400ced74
mov edx, 2
lea rcx, [0x140162f60]
call fcn.1400cee1c
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x20]
lea rdx, [0x140155f50]
call fcn.1400eecd0
int3
lea rdx, str.CryptUnprotectMemory_failed
lea rcx, [0x140162f60]
call fcn.1400ced74
mov edx, 2
lea rcx, [0x140162f60]
call fcn.1400cee1c
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x20]
lea rdx, [0x140155f50]
call fcn.1400eecd0
int3