joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4a70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rbx + 8]
call fcn.1400c0290
test rbx, rbx
je 0x1400b4aa7
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x140041db8.0]
cmp qword [0x1403ebb08], 0
je 0x1400b4b0a
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1403ebb08]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
sub rdi, rbx
cmp rdi, qword [rax + 0x40]
jbe 0x1400b4b05
xor ecx, ecx
call fcn.1400cd940
mov rcx, qword [0x1403ebb08]
lea rdx, str.FAutoDeleteAsyncTask::DoWork
mov r8d, eax
mov r9, rbx
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400cac50
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret

Function at 0x1400b8bb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea r9d, [rcx + 3]
mov ebx, edx
and r9d, 0xfffffffc
lea rsi, [0x14036f430]
sub r9d, ecx
mov r11, rcx
not r8d
cmp edx, r9d
jle 0x1400b8cc6
sub ebx, r9d
mov qword [rsp + 0x10], rdi
test r9d, r9d
je 0x1400b8c0c
nop word [rax + rax]
movzx eax, byte [r11]
inc r11
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [rsi + rcx*4]
sub r9d, 1
jne 0x1400b8bf0
mov eax, ebx
cdq
and edx, 7
add eax, edx
mov edi, eax
and eax, 7
sub eax, edx
sar edi, 3
mov ebx, eax
test edi, edi
je 0x1400b8cc1
nop dword [rax + rax]
xor r8d, dword [r11]
mov r10d, dword [r11 + 4]
add r11, 8
mov r9d, r8d
mov eax, r8d
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
add edi, 0xffffffff
jne 0x1400b8c30
mov rdi, qword [rsp + 0x10]
test ebx, ebx
je 0x1400b8cec
nop word [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [rsi + rcx*4]
sub ebx, 1
jne 0x1400b8cd0
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret
Function at 0x1400b9440
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
xor r8d, r8d
mov rbx, rcx
mov rdi, rdx
mov edx, dword [rcx + 8]
test edx, edx
lea eax, [rdx - 1]
mov ecx, eax
cmove ecx, r8d
cmp ecx, 0x20
jne 0x1400b947d
mov r8, rdi
xor edx, edx
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.1400b95f0
test edx, edx
je 0x1400b959d
cmp eax, 0x24
jne 0x1400b94a2
mov r8, rdi
lea edx, [rax - 0x23]
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.1400b95f0
cmp eax, 0x26
jne 0x1400b9563
lea edx, [rax - 0x24]
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r8
call fcn.140019a30
mov edx, dword [rsp + 0x38]
lea eax, [rdx + 2]
mov dword [rsp + 0x38], eax
cmp eax, dword [rsp + 0x3c]
jle 0x1400b94e2
lea rcx, [rsp + 0x30]
call fcn.1400197d0
mov rcx, qword [rsp + 0x30]
lea r8, [0x14029a634]
mov r9d, 2
mov eax, 0x3f
mov edx, r9d
mov word [rsp + 0x20], ax
call fcn.14001b180
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140027f30
mov rcx, qword [rsp + 0x30]
movzx esi, al
test rcx, rcx
je 0x1400b952b
call fcn.1400556b0
test sil, sil
mov r8, rdi
mov rsi, qword [rsp + 0x50]
mov rcx, rbx
je 0x1400b954f
mov edx, 2
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.1400b95f0
mov edx, 3
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.1400b95f0
cmp eax, 0x44
jne 0x1400b9580
mov r8, rdi
lea edx, [rax - 0x40]
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.1400b95f0
cmp eax, 0x23
jne 0x1400b959d
mov r8, rdi
lea edx, [rax - 0x1e]
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.1400b95f0
cmp ecx, 0x16
jne 0x1400b95ba
lea edx, [rcx - 0x10]
mov r8, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.1400b95f0
cmp ecx, 0x19
jne 0x1400b95d7
lea edx, [rcx - 0x12]
mov r8, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.1400b95f0
mov rbx, qword [rsp + 0x58]
xor al, al
add rsp, 0x40
pop rdi
ret
Function at 0x1400c0150
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp byte [rdi + 0x1048], 0
je 0x1400c01bf
call fcn.140047280
mov rcx, rax
lea r8, [rdi + 8]
mov rdx, qword [rax]
mov rax, qword [rdx + 0xd0]
lea rdx, [rsp + 0x60]
call qword [case.0x140041db8.0]
xor r9d, r9d
lea rdx, [rdi + 8]
xor r8d, r8d
mov rcx, qword [rax]
mov qword [rdi + 0x818], rcx
lea rcx, [rdi + 0x808]
call fcn.1400b8980
test al, al
sete al
mov byte [rdi + 0x830], al
jmp 0x1400c021a
cmp dword [rdi + 0x1040], 1
jle 0x1400c021a
mov rax, qword [rdi + 0x1038]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 0x1040]
mov qword [rsp + 0x70], rsi
xor esi, esi
test eax, eax
lea ecx, [rax - 1]
cmove ecx, esi
mov dword [rsp + 0x38], ecx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.140047280
mov r9, rax
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x40]
call fcn.1400bbdd0
mov rsi, qword [rsp + 0x70]
lock dec dword [rdi + 0x1050]
cmp qword [0x1403ebb08], 0
je 0x1400c027a
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1403ebb08]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
sub rdi, rbx
cmp rdi, qword [rax + 0x40]
jbe 0x1400c027a
xor ecx, ecx
call fcn.1400cd940
mov rcx, qword [0x1403ebb08]
lea rdx, str.FAsyncTask::DoWork
mov r8d, eax
mov r9, rbx
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400cac50
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400c0290
Capabilities:
Hash data using sha1

Disassembly:
mov r11, rsp
push rbp
push rdi
lea rbp, [r11 - 0x58]
sub rsp, 0x148
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov eax, dword [rcx + 0x30]
mov rdi, rcx
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], r14
mov qword [r11 - 0x18], r15
xor r15d, r15d
test eax, eax
je 0x1400c03f8
dec eax
test eax, eax
jle 0x1400c03f8
mov qword [r11 + 0x18], rsi
lea r14, [rcx + 0x10]
mov rsi, qword [rcx + 0x28]
mov edx, r15d
mov qword [rsp + 0x20], r15
mov ecx, r15d
mov dword [rsp + 0x2c], ecx
mov dword [rsp + 0x28], edx
test rsi, rsi
je 0x1400c0350
cmp word [rsi], cx
je 0x1400c0350
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], cx
jne 0x1400c0305
inc ebx
test ebx, ebx
jle 0x1400c0328
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140019a30
mov ecx, dword [rsp + 0x2c]
mov edx, dword [rsp + 0x28]
lea eax, [rbx + rdx]
mov dword [rsp + 0x28], eax
cmp eax, ecx
jle 0x1400c033d
lea rcx, [rsp + 0x20]
call fcn.1400197d0
mov rcx, qword [rsp + 0x20]
mov rdx, rsi
movsxd r8, ebx
add r8, r8
call fcn.140038f30
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.1400c2e70
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.140028220
mov r8, rax
lea rdx, [rsp + 0x30]
lea rcx, [0x14037a170]
call fcn.140054280
movsxd rax, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x170]
cmp eax, 0xffffffff
je 0x1400c03a2
mov rcx, rax
shl rcx, 5
add rcx, qword [0x14037a170]
jmp 0x1400c03a5
mov rcx, r15
test rcx, rcx
lea rbx, [rcx + 0x10]
mov rcx, qword [rsp + 0x38]
cmove rbx, r15
test rcx, rcx
je 0x1400c03bf
call fcn.1400556b0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400c03ce
call fcn.1400556b0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400c03dd
call fcn.1400556b0
test rbx, rbx
je 0x1400c0448
test r14, r14
je 0x1400c03f8
mov rax, qword [rbx]
movups xmm0, xmmword [rax]
movups xmmword [r14], xmm0
mov eax, dword [rax + 0x10]
mov dword [r14 + 0x10], eax
mov r8, qword [rdi + 8]
lea rax, [rbp - 0x20]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x60]
mov qword [rbp + 0x20], rax
mov dword [rsp + 0x60], 0x67452301
mov dword [rsp + 0x64], 0xefcdab89
mov dword [rsp + 0x68], 0x98badcfe
mov dword [rsp + 0x6c], 0x10325476
mov dword [rsp + 0x70], 0xc3d2e1f0
mov qword [rsp + 0x74], r15
call fcn.1400c9510
lea rcx, [rsp + 0x60]
call fcn.1400c1790
cmp byte [rdi + 0x39], 0
mov r15, qword [rsp + 0x140]
mov r14, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x168]
je 0x1400c046e
mov rcx, qword [rdi]
call fcn.1400556b0
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0x148
pop rdi
pop rbp
ret
Function at 0x1400c1790
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov edx, dword [rcx + 0x18]
mov rbx, rcx
mov ecx, dword [rcx + 0x14]
mov eax, edx
shr eax, 0x18
mov r9d, ecx
mov byte [rsp + 0x20], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x21], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x22], al
mov eax, ecx
shr eax, 0x18
mov byte [rsp + 0x24], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x23], dl
shl rdx, 0x20
shr r9, 3
or rdx, rcx
mov byte [rsp + 0x25], al
add rdx, 8
mov eax, ecx
mov dword [rbx + 0x14], edx
shr eax, 8
and r9d, 0x3f
shr rdx, 0x20
mov qword [rsp + 0x48], rbp
lea rbp, [0x14029b7b0]
mov byte [rsp + 0x26], al
lea rax, [r9 + 1]
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x27], cl
mov dword [rbx + 0x18], edx
cmp rax, 0x3f
jbe 0x1400c188a
mov esi, 0x40
mov qword [rsp + 0x58], rdi
sub rsi, r9
lea rcx, [rbx + 0x20]
mov r8, rsi
add rcx, r9
mov rdx, rbp
call fcn.140260aa0
lea r8, [rbx + 0x20]
mov rdx, rbx
mov rcx, rbx
call fcn.1400c8160
lea rdi, [rsi + 0x3f]
cmp rdi, 1
jae 0x1400c1880
nop
lea r8, [rbp - 0x3f]
mov rdx, rbx
add r8, rdi
mov rcx, rbx
call fcn.1400c8160
add rsi, 0x40
add rdi, 0x40
cmp rdi, 1
jb 0x1400c1860
mov rdi, qword [rsp + 0x58]
xor r9d, r9d
jmp 0x1400c188c
xor esi, esi
mov r8d, 1
lea rcx, [rbx + 0x20]
sub r8, rsi
lea rdx, [rsi + rbp]
add rcx, r9
call fcn.140260aa0
mov eax, dword [rbx + 0x14]
mov rsi, qword [rsp + 0x50]
and eax, 0x1f8
mov rbp, qword [rsp + 0x48]
cmp eax, 0x1c0
je 0x1400c18e4
nop
mov r8d, 1
lea rdx, [0x14029b7b4]
mov rcx, rbx
call fcn.1400c9510
mov eax, dword [rbx + 0x14]
and eax, 0x1f8
cmp eax, 0x1c0
jne 0x1400c18c0
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400c9510
mov ecx, dword [rbx]
mov eax, ecx
shr eax, 0x18
mov byte [rbx + 0x60], al
shr ecx, 0x10
mov byte [rbx + 0x61], cl
mov eax, dword [rbx]
shr eax, 8
mov byte [rbx + 0x62], al
movzx eax, byte [rbx]
mov byte [rbx + 0x63], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0x64], al
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
mov eax, dword [rbx + 4]
shr eax, 8
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 0x69], al
mov eax, dword [rbx + 8]
shr eax, 8
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx + 8]
mov byte [rbx + 0x6b], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0x6c], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0x6d], al
mov eax, dword [rbx + 0xc]
shr eax, 8
mov byte [rbx + 0x6e], al
movzx eax, byte [rbx + 0xc]
mov byte [rbx + 0x6f], al
movzx eax, byte [rbx + 0x13]
mov byte [rbx + 0x70], al
movzx eax, byte [rbx + 0x12]
mov byte [rbx + 0x71], al
mov eax, dword [rbx + 0x10]
shr eax, 8
mov byte [rbx + 0x72], al
movzx eax, byte [rbx + 0x10]
mov byte [rbx + 0x73], al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0x30
pop rbx
ret
Function at 0x1400d2d30
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0x848
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400d2ea7
cmp word [rdx], 0
je 0x1400d2ea7
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x18], rbp
call fcn.1400d6f50
mov rbx, rax
lea rcx, [rsp + 0x30]
movzx r8d, word [rax + 4]
lea rdx, [rax + 6]
mov ebp, r8d
shr ebp, 1
test r8b, 1
je 0x1400d2e00
and r8, 0xfffffffffffffffe
call fcn.140260aa0
movzx ebx, word [rbx + 4]
call fcn.1400d72b0
shr ebx, 1
mov dword [rsp + 0x20], eax
je 0x1400d2de2
lea r8, [rsp + 0x30]
mov r9d, ebx
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
mov rax, rdx
lea r8, [r8 + 1]
and eax, 3
inc rdx
movzx ecx, byte [rsp + rax + 0x20]
xor cl, byte [r8 - 1]
xor cl, bl
mov byte [r8 - 1], cl
sub r9, 1
jne 0x1400d2dc0
mov ebx, dword [rsi + 8]
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rdi
call fcn.140041f80
test eax, eax
je 0x1400d2e65
xor eax, eax
jmp 0x1400d2e95
shr r8, 1
call fcn.140260aa0
movzx ebx, word [rbx + 4]
call fcn.1400d72b0
shr ebx, 1
mov dword [rsp + 0x20], eax
je 0x1400d2e4e
lea r8, [rsp + 0x30]
mov r9d, ebx
xor edx, edx
nop dword [rax]
nop word [rax + rax]
mov rcx, rdx
lea r8, [r8 + 1]
and ecx, 3
movzx eax, bl
inc rdx
xor al, byte [rsp + rcx + 0x20]
xor byte [r8 - 1], al
sub r9, 1
jne 0x1400d2e30
mov ebx, dword [rsi + 8]
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rdi
call fcn.140041f00
test eax, eax
jne 0x1400d2e93
movzx eax, word [rdi + rbp*2]
test ebx, ebx
jne 0x1400d2e75
test ax, ax
sete al
jmp 0x1400d2e95
cmp ax, 0x5f
jne 0x1400d2e93
lea rdx, [rdi + 2]
lea rdx, [rdx + rbp*2]
lea ecx, [rbx - 1]
call fcn.1400d3140
test al, al
je 0x1400d2e93
mov al, 1
jmp 0x1400d2e95
xor al, al
mov rbp, qword [rsp + 0x840]
mov rbx, qword [rsp + 0x870]
jmp 0x1400d2eb8
cmp dword [rcx], 0
jne 0x1400d2eb6
cmp dword [rcx + 8], 0
jne 0x1400d2eb6
mov al, 1
jmp 0x1400d2eb8
xor al, al
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0x848
pop rdi
pop rsi
ret

Function at 0x1400d68b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
movzx r8d, word [rcx + 4]
mov rbx, rdx
lea rdx, [rcx + 6]
shr r8, 1
mov rdi, rcx
mov rcx, rbx
call fcn.140260aa0
movzx edi, word [rdi + 4]
call fcn.1400d72b0
shr edi, 1
mov dword [rsp + 0x30], eax
je 0x1400d6911
xor edx, edx
mov r8d, edi
nop word [rax + rax]
mov rax, rdx
lea rbx, [rbx + 1]
and eax, 3
inc rdx
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbx - 1]
xor cl, dil
mov byte [rbx - 1], cl
sub r8, 1
jne 0x1400d68f0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d6920
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
movzx r8d, word [rcx + 4]
mov rbx, rdx
lea rdx, [rcx + 6]
mov rdi, rcx
and r8, 0xfffffffffffffffe
mov rcx, rbx
call fcn.140260aa0
movzx edi, word [rdi + 4]
call fcn.1400d72b0
shr edi, 1
mov dword [rsp + 0x30], eax
je 0x1400d6981
xor edx, edx
mov r8d, edi
nop dword [rax + rax]
mov rax, rdx
lea rbx, [rbx + 1]
and eax, 3
inc rdx
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbx - 1]
xor cl, dil
mov byte [rbx - 1], cl
sub r8, 1
jne 0x1400d6960
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d70e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x850
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rsp + 0x840], rax
movzx r8d, word [rcx + 4]
mov rbx, rdx
mov edi, r8d
lea rdx, [rcx + 6]
shr edi, 1
mov rbp, rcx
lea rcx, [rsp + 0x40]
test r8b, 1
je 0x1400d71d6
and r8, 0xfffffffffffffffe
call fcn.140260aa0
call fcn.1400d72b0
xor esi, esi
mov dword [rsp + 0x30], eax
test edi, edi
je 0x1400d7171
lea rdx, [rsp + 0x40]
mov r9d, edi
mov r8d, esi
nop word [rax + rax]
mov rax, r8
lea rdx, [rdx + 1]
and eax, 3
inc r8
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rdx - 1]
xor cl, dil
mov byte [rdx - 1], cl
sub r9, 1
jne 0x1400d7150
movzx edi, word [rbp + 4]
shr edi, 1
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
je 0x1400d727f
cmp word [rsp + 0x40], si
je 0x1400d727f
lea edx, [rdi + 1]
mov rcx, rbx
call fcn.140019a30
mov edx, dword [rbx + 8]
lea eax, [rdx + 1]
add eax, edi
mov dword [rbx + 8], eax
cmp eax, dword [rbx + 0xc]
jle 0x1400d71b2
mov rcx, rbx
call fcn.1400197d0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
mov r8d, edi
add r8, r8
call fcn.140038f30
movsxd rdx, dword [rbx + 8]
mov rcx, qword [rbx]
mov word [rcx + rdx*2 - 2], si
jmp 0x1400d727f
shr r8, 1
call fcn.140260aa0
call fcn.1400d72b0
xor esi, esi
mov dword [rsp + 0x30], eax
test edi, edi
je 0x1400d721e
lea rdx, [rsp + 0x40]
mov r9d, edi
mov r8d, esi
nop dword [rax + rax]
mov rcx, r8
lea rdx, [rdx + 1]
and ecx, 3
movzx eax, dil
inc r8
xor al, byte [rsp + rcx + 0x30]
xor byte [rdx - 1], al
sub r9, 1
jne 0x1400d7200
movzx edi, word [rbp + 4]
shr edi, 1
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
je 0x1400d727f
cmp byte [rsp + 0x40], sil
je 0x1400d727f
lea edx, [rdi + 1]
mov rcx, rbx
call fcn.140019a30
mov edx, dword [rbx + 8]
lea eax, [rdx + 1]
add eax, edi
mov dword [rbx + 8], eax
cmp eax, dword [rbx + 0xc]
jle 0x1400d7257
mov rcx, rbx
call fcn.1400197d0
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
mov eax, 0x3f
mov r9d, edi
mov edx, edi
mov word [rsp + 0x20], ax
call fcn.14001b180
movsxd rcx, dword [rbx + 8]
mov rax, qword [rbx]
mov word [rax + rcx*2 - 2], si
mov rax, rbx
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14025eac0
mov rbx, qword [rsp + 0x880]
add rsp, 0x850
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d9fe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rbx, [rcx + 6]
mov esi, r8d
mov edi, r8d
mov rcx, rbx
mov r8d, r8d
call fcn.140260aa0
call fcn.1400d72b0
mov dword [rsp + 0x40], eax
test esi, esi
je 0x1400da034
xor edx, edx
mov rax, rdx
lea rbx, [rbx + 1]
and eax, 3
inc rdx
movzx ecx, byte [rsp + rax + 0x40]
xor cl, byte [rbx - 1]
xor cl, sil
mov byte [rbx - 1], cl
sub rdi, 1
jne 0x1400da013
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400da050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
lea rbx, [rcx + 6]
mov edi, r8d
mov rcx, rbx
lea r8, [rsi + rsi]
call fcn.140260aa0
call fcn.1400d72b0
mov dword [rsp + 0x40], eax
test esi, esi
je 0x1400da0b1
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
mov rax, rdx
lea rbx, [rbx + 1]
and eax, 3
inc rdx
movzx ecx, byte [rsp + rax + 0x40]
xor cl, byte [rbx - 1]
xor cl, sil
mov byte [rbx - 1], cl
sub rdi, 1
jne 0x1400da090
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400da7d0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
xor edi, edi
mov qword [rsp + 0x58], rbx
mov qword [rcx + 8], rdi
mov rsi, rcx
mov dword [rcx], edi
mov dword [rcx + 0x10], edi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x40], rdi
mov dword [rcx + 0x58], edi
mov dword [rcx + 0x11870], edi
mov qword [rcx + 0x28], rdi
mov dword [rcx + 0x30], edi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x48], rdi
mov qword [rcx + 0x50], rdi
add rcx, 0x138b0
mov qword [rsp + 0x60], rbp
call fcn.14002b540
xor r9d, r9d
mov qword [rsi + 0x13920], rdi
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
mov qword [rsi + 0x18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rcx, [0x1400ea0d0]
mov qword [rsi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov r9, rsi
mov qword [rsp + 0x28], rsi
lea r8, [0x1400dd3a0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400da893
lea edx, [rdi - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp qword [rsi + 0x40], rdi
je 0x1400da8a2
mov eax, dword [rsi + 0x58]
mov dword [0x14038cb44], eax
call fcn.1400a5ee0
xor r8d, r8d
xor ecx, ecx
mov rbp, rax
lea edx, [r8 + 0x30]
call fcn.14005fe10
mov rbx, rax
test rax, rax
je 0x1400da8ec
lea rax, [0x140281300]
mov qword [rbx], rax
call fcn.140028aa0
mov qword [rbx + 0x10], rax
lea rax, [0x140282cd0]
mov qword [rbx], rax
lea rax, [0x1400e71a0]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x18], rsi
test rbx, rbx
je 0x1400da94f
mov dl, 1
mov qword [rsp + 0x30], r14
mov rcx, rbp
call fcn.14001dd10
mov rax, qword [rbx]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x140041db8.0]
movsxd r14, dword [rbp + 8]
lea eax, [r14 + 1]
mov dword [rbp + 8], eax
cmp eax, dword [rbp + 0xc]
jle 0x1400da930
mov edx, r14d
mov rcx, rbp
call fcn.1400196c0
mov rax, r14
mov ecx, 3
mov r14, qword [rsp + 0x30]
shl rax, 4
add rax, qword [rbp]
mov qword [rax], rbx
mov dword [rax + 8], ecx
mov ecx, edi
jmp 0x1400da957
mov ecx, 3
mov rdi, rbx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
test ecx, ecx
je 0x1400da98b
test rdi, rdi
je 0x1400da998
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x140041db8.0]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.14005fe10
mov rdi, rax
test rdi, rdi
je 0x1400da998
mov rcx, rdi
call fcn.1400556b0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400da9b0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
lea rax, [0x14029e7d8]
mov qword [rcx + 8], rdx
mov qword [rcx], rax
mov r10, rdx
xor eax, eax
mov dword [rcx + 0x40], r8d
mov qword [rcx + 0x30], rax
mov rbx, rcx
mov qword [rcx + 0x38], rax
mov eax, dword [rsp + 0x50]
mov dword [rcx + 0x48], eax
lea rax, [rdx - 1]
mov dword [rcx + 0x44], r9d
cmp rax, 0xfffffffffffffffd
ja 0x1400daa04
lea rdx, [rsp + 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rax, qword [rsp + 0x30]
mov qword [rbx + 0x38], rax
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
add rsp, 0x20
pop rbx
ret

Function at 0x1400dafe0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rdi
mov r14, rdx
mov rsi, rcx
call fcn.140031d50
mov r8, qword [rsi]
xor r15d, r15d
mov rdi, 0xffffffffffffffff
mov r10, rax
mov rdx, rdi
mov r9, qword [r8]
mov word [r9], r15w
mov r8, qword [rsi]
mov rcx, qword [r8]
nop
inc rdx
cmp word [rcx + rdx*2], r15w
jne 0x1400db020
mov r8d, dword [rsi + 8]
movsxd rax, edx
mov qword [rsp + 0x40], rbx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400db066
movsxd rbx, eax
mov rdx, r10
mov rcx, rbp
lea r8, [rbx - 1]
call qword [0x140272a20]
mov word [rbp + rbx*2 - 2], r15w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rcx + rdx*2], r15w
jne 0x1400db070
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400db0b1
movsxd rbx, eax
lea rdx, str.Binaries_
mov rcx, rbp
lea r8, [rbx - 1]
call qword [0x140272a20]
mov word [rbp + rbx*2 - 2], r15w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov rdx, rdi
inc rdx
cmp word [rcx + rdx*2], r15w
jne 0x1400db0b4
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400db0f5
movsxd rbx, eax
lea rdx, str.Win64
mov rcx, rbp
lea r8, [rbx - 1]
call qword [0x140272a20]
mov word [rbp + rbx*2 - 2], r15w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
mov rdx, rdi
nop dword [rax + rax]
inc rdx
cmp word [rcx + rdx*2], r15w
jne 0x1400db100
movsxd rax, edx
lea rbp, [rcx + rax*2]
mov eax, r8d
sub eax, edx
test eax, eax
jle 0x1400db141
movsxd rbx, eax
lea rdx, [0x14028d690]
mov rcx, rbp
lea r8, [rbx - 1]
call qword [0x140272a20]
mov word [rbp + rbx*2 - 2], r15w
mov rax, qword [rsi]
mov r8d, dword [rsi + 8]
mov rcx, qword [rax]
inc rdi
cmp word [rcx + rdi*2], r15w
jne 0x1400db141
movsxd rax, edi
sub r8d, edi
mov rdi, qword [rsp + 0x48]
lea rbp, [rcx + rax*2]
test r8d, r8d
jle 0x1400db17e
movsxd rbx, r8d
mov rdx, r14
mov rcx, rbp
lea r8, [rbx - 1]
call qword [0x140272a20]
mov word [rbp + rbx*2 - 2], r15w
mov rax, qword [rsi]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rbx, qword [rsp + 0x40]
cmp eax, 0xffffffff
mov rbp, qword [rsp + 0x50]
setne al
add rsp, 0x20
pop r15
pop r14
pop rsi
ret