joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140179440
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov r8d, edx
lea r9, [rsp + 0x52]
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
nop
add r9, 0x22d8b480
sub r9, 0x22d8b482
mov eax, 0x6683ba14
sub eax, 0x444fb6d8
add eax, 0x34c529c0
sub eax, 0x110743e1
add eax, 0x15124939
sub eax, 0x32674a6a
xor eax, 0x699f1179
add eax, 0x321eaa7c
add eax, 0x59aa2bbe
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dx
shl ax, 1
shl ax, 1
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
sub r8w, 0xffd0
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140179466
xorps xmm0, xmm0
lea rax, [rsp + 0x52]
movups xmmword [rbx], xmm0
xchg r10, r15
mov qword [rbx + 0x10], r15
xchg r10, r15
xchg r11, r10
mov qword [rbx + 0x18], r11
xchg r11, r10
cmp r9, rax
jne 0x14017955a
mov qword [rbx + 0x10], r10
mov rax, rbx
mov qword [rbx + 0x18], 0x7dcc787e
sub qword [rbx + 0x18], 0x7a4c134a
add qword [rbx + 0x18], 0x5f5d3784
sub qword [rbx + 0x18], 0x407cd923
add qword [rbx + 0x18], 0x5d673c98
sub qword [rbx + 0x18], 0x43638f51
xor qword [rbx + 0x18], 0x3367ec6c
sub qword [rbx + 0x18], 0xf039ca9
mov word [rbx], r10w
add rsp, 0x60
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
lea r8, [rsp + 0x52]
xchg r9, rdx
mov r9, rdx
xchg rdx, r9
sub r8, r9
xchg rcx, r8
mov r8, rbx
xchg rcx, r8
sar r8, 1
call fcn.14007eef0
xchg r14, rbx
mov rax, r14
xchg r14, rbx
add rsp, 0x60
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x1401986a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r9, r8
mov qword [rsp + 0x20], r8
xchg r9, r8
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
nop
sub rsp, 8
mov qword [rsp], rbx
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x58
xchg r9, rbx
mov r9, rbx
xchg rbx, r9
mov rsi, rdx
xchg rcx, r10
mov r9, r10
xchg r10, rcx
xor ebp, ebp
test rdx, rdx
jne 0x14019870b
mov eax, ebp
jmp 0x140198756
mov eax, 0x138c6285
add eax, 0x2eeafb78
add eax, 0xc81029e
sub eax, 0x133df564
add eax, 0x2ee4c8b6
xor eax, 0xd16038e
xor eax, 0x67896a2e
cmp word [rdx], ax
je 0x140198745
xchg rbp, rdi
mov rax, rdi
xchg rdi, rbp
jmp 0x140198756
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x11f971ab
add ecx, 0x3c73d33d
sub ecx, 0x4f64491
xor ecx, 0x54e9da0a
add ecx, 0x3766638d
sub ecx, 0x55053bdf
cmp word [rax + 0x18], cx
jne 0x1401988b2
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1401988b2
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x140198870
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x140198864
xchg rdx, r9
mov qword [rsp + 0xa8], r9
xchg rdx, r9
mov qword [rsp + 0x30], rcx
xchg r12, r8
mov qword [rsp + 0x38], r12
xchg r12, r8
xchg r12, r9
mov qword [rsp + 0x40], r12
xchg r12, r9
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14019892f
xchg r13, rax
mov r13, qword [rcx]
xchg r13, rax
lea rdx, [rsp + 0xa8]
xchg rdx, r11
mov qword [rsp + 0x20], r11
xchg rdx, r11
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x140198870
mov r8, qword [rsp + 0xb0]
xchg rsi, r9
mov rsi, qword [rsp + 0xa0]
xchg r9, rsi
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1401987c1
xchg r10, rcx
mov r10, qword [rbx + 0x38]
xchg r10, rcx
test rcx, rcx
je 0x14019889d
cmp rcx, rbx
xchg r14, rax
mov r14, qword [rcx]
xchg r14, rax
setne dl
call qword [rax + 0x20]
xchg rdx, rbp
mov qword [rbx + 0x38], rdx
xchg rbp, rdx
mov al, 0x24
xor al, 0x79
add al, 0x1b
xor al, 0x3f
sub al, 0x29
add al, 0x44
sub al, 0x62
xor al, 1
jmp 0x1401988d5
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1401988d3
xchg r13, rax
mov r13, qword [rcx]
xchg r13, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
xor al, al
add rsp, 0x58
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
push rcx
push rcx
push rcx
push rcx
push rcx
push rdx
push rdx
push rcx
xchg qword [rsp + 0x40], r12
add rsp, 0x48
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rsi
add rsp, 8
nop
xchg qword [rsp], rbp
add rsp, 8
push rcx
xchg qword [rsp + 8], rbx
pop rcx
add rsp, 8
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
int3
Function at 0x1401aaed0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg rcx, r11
mov rcx, rdx
xchg rcx, r11
xchg rcx, rbx
mov r10, rbx
xchg rbx, rcx
test rdx, rdx
je 0x1401aaf54
xchg rbx, rcx
mov qword [rsp], rcx
xchg rbx, rcx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aaf41
movzx eax, byte [r10]
test bl, bl
je 0x1401aaf23
lea rcx, [r9 - 1]
mov rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aaf12
jmp 0x1401aaf41
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aaf32
inc r10
sub r11, 1
jne 0x1401aaefa
xchg r9, rbx
mov r9, qword [rsp]
xchg rbx, r9
add rsp, 8
ret
Function at 0x1401afee0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rsi, rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
nop
push 0x1d367498
mov qword [rsp], rdi
mov eax, 0x706b77d7
xor eax, 0x19ec1ddc
sub eax, 0x5a77ca4
sub eax, 0x56de528f
add eax, 0x12bfd944
add eax, 0x4837af08
add eax, 0x11f2f97a
xor eax, 0x11afbe46
sub eax, 0x68438f28
call fcn.1401fd050
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x3f498d80
add r9d, 0x2b849cc7
xor r9d, 0x53ecd172
sub r9d, 0x19ef9b66
sub r9d, 0x171b7929
add r9d, 0x22e27958
sub r9d, 0x20471e32
sub r9d, 0xab341cb
mov dword [rsp + 0x13a4], 0x6ba76d1d
sub dword [rsp + 0x13a4], 0x27841efe
sub dword [rsp + 0x13a4], 0xf322bae
xor dword [rsp + 0x13a4], 0x612f7de3
xor dword [rsp + 0x13a4], 0x1b568c13
add dword [rsp + 0x13a4], 0x137df62c
sub dword [rsp + 0x13a4], 0x3e47961
add dword [rsp + 0x13a4], 0xa1ddafb3
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0xf
shr r8d, 6
shr r8d, 9
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401affd5
mov ebp, 0x6ef07150
sub ebp, 0x5fe03b4f
xor ebp, 0x648ceaee
xor ebp, 0x49f6a793
sub ebp, 0x8883ba4
xor ebp, 0x3b9467a5
add ebp, 0x5d89a783
mov dword [rsp + 0x20], 0x779370f6
xor dword [rsp + 0x20], 0x3248c53c
xor dword [rsp + 0x20], 0x139047ae
xor dword [rsp + 0x20], 0x261926bd
sub dword [rsp + 0x20], 0xb562a52
sub dword [rsp + 0x20], 0x6312124
sub dword [rsp + 0x20], 0x202c56e7
sub dword [rsp + 0x20], 0x3e9f300c
cmp edi, ebp
lea rax, [rsp + 0x20]
xchg rdi, rax
mov qword [rsp + 0x13d0], rdi
xchg rdi, rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401b00bb
call fcn.1401b0380
mov ecx, eax
jmp 0x1401b011c
inc edi
mov ebx, edi
call fcn.1401b0380
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401b010b
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401b010b
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b0380
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401b00f0
shr rcx, 0x1a
shr rcx, 3
shr rcx, 1
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
xchg rcx, rbp
mov rcx, qword [r11 + 0x18]
xchg rcx, rbp
lea ecx, [rdx - 0x80000000]
xchg rdx, rsi
mov rdx, qword [r11 + 0x28]
xchg rsi, rdx
cmovae eax, ecx
mov rsp, r11
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0380
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg r8, r10
mov r8, qword [rcx]
xchg r8, r10
mov r9d, 0x13be0548
xor r9d, 0x670fbcb8
sub r9d, 0x19a3d065
sub r9d, 0x4e23d974
xor r9d, 0x55c8a2b9
sub r9d, 0x2d10ee0a
sub r9d, 0x25d44ca0
add r9d, 0x33b7f3ec
sub r9d, 0x39f56980
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b0427
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b03e2
mov ecx, dword [r10]
jmp 0x1401b0566
cmp ecx, 0x4e0
jb 0x1401b0566
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x64ee01ba
sub ebx, 0x647576f7
xor ebx, 0x4fe32c2d
xor ebx, 0x4f8a2816
xor ebx, 0x12c00ea1
add ebx, 0x300327ea
xor ebx, 0x11782438
xor ebx, 0x66244492
sub ebx, 0x3588c806
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0476
lea r11, [r10 + 0xd50]
mov ebx, 0x4b3aef22
add ebx, 0x1e89b5e8
sub ebx, 0x41b8668d
xor ebx, 0x4bb4eb40
xor ebx, 0x700eb843
xor ebx, 0x13b66cf2
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b04e8
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 6
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 4
shl eax, 1
shl eax, 9
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 1
shr eax, 0xa
shr eax, 6
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ba210
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b982b
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9810
xchg r15, r8
mov r15, qword [rcx - 8]
xchg r8, r15
sub rdx, 0xffffffffffffffd9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b984b
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
call fcn.1401fccd8
xor eax, eax
xchg rdi, rax
mov qword [rbx + 0x18], rdi
xchg rdi, rax
mov qword [rbx + 0x20], rax
xchg rsi, rax
mov qword [rbx + 0x28], rsi
xchg rsi, rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rax
push rax
push rcx
push rcx
push rdx
xchg qword [rsp + 0x28], rbx
pop rdx
pop rcx
pop rcx
pop rax
pop rax
add rsp, 8
jmp 0x1401ba210
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
mov rbx, qword [rcx]
xchg rbp, rsi
mov rbp, rcx
xchg rbp, rsi
mov rax, qword [rbx + 8]
mov qword [rax], 0x1c07878
add qword [rax], 0x4cf08d10
sub qword [rax], 0x49d497e2
add qword [rax], 0x6cdc125e
xor qword [rax], 0x6b237ed6
xor qword [rax], 0x7a0ccb9d
sub qword [rax], 0x6097354f
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba2e0
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
xchg rdi, r8
mov r8, qword [rbx]
xchg r8, rdi
lea rdx, [rbx + 0x10]
xchg r9, rcx
mov r9, rsi
xchg r9, rcx
call fcn.1401b3370
mov edx, 0x6c71662b
sub edx, 0x46ef60e1
xor edx, 0x395444d7
xor edx, 0x20964121
xor edx, 0x40c1d160
sub edx, 0x7a7540fe
sub edx, 0x20c908e
mov rcx, rbx
call fcn.1401fccd8
xchg rbx, rbp
mov rbp, rdi
xchg rbp, rbx
test rdi, rdi
jne 0x1401ba27d
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi]
mov edx, 0x4f42dbd3
xor edx, 0x778d9de8
xor edx, 0x6fdb0149
sub edx, 0x38d098eb
xor edx, 0x32050cf3
sub edx, 0x18ace41d
add edx, 0x10d5140c
sub edx, 0x246ed213
xchg r13, rbx
mov r13, qword [rsp + 0x38]
xchg rbx, r13
add rsp, 0x20
push rbx
push rbx
push rbx
push rcx
xchg qword [rsp + 0x20], rsi
add rsp, 0x28
jmp fcn.1401fccd8
Function at 0x1401ba340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
xchg rbx, rbp
mov rbp, rcx
xchg rbx, rbp
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b98c9
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b98b2
xchg r13, r8
mov r13, qword [rcx - 8]
xchg r13, r8
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b98e7
mov rcx, r8
call fcn.1401fccd8
xor eax, eax
xchg rdi, rax
mov qword [rbx + 0x18], rdi
xchg rdi, rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rdx
push rcx
push rcx
push rax
xchg qword [rsp + 0x20], rbx
pop rax
pop rcx
pop rcx
pop rdx
add rsp, 8
jmp 0x1401ba340
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg r14, rbx
mov qword [rsp + 0x10], r14
xchg rbx, r14
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
xchg r9, rbx
mov r9, qword [rcx]
xchg r9, rbx
mov rsi, rcx
xchg rdx, rax
mov rdx, qword [rbx + 8]
xchg rdx, rax
mov qword [rax], 0x11db4085
sub qword [rax], 0x73193a5
xor qword [rax], 0x6bdae677
sub qword [rax], 0x22ae69f5
add qword [rax], 0x1d4a8b7f
sub qword [rax], 0x229a960a
sub qword [rax], 0x3974d617
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba423
xchg rdi, r11
mov qword [rsp + 0x30], r11
xchg r11, rdi
nop dword [rax + rax]
xchg rdi, r14
mov r14, qword [rbx]
xchg rdi, r14
lea rcx, [rbx + 0x10]
call fcn.1401ba470
mov edx, 0x1e17a2f2
sub edx, 0x4865db4
xor edx, 0x626eeb4c
xor edx, 0x24be158f
xor edx, 0x11327a8b
sub edx, 0x2b5f172b
sub edx, 0x908dde7
xor edx, 0x1a0bcc24
xchg r10, rcx
mov r10, rbx
xchg rcx, r10
call fcn.1401fccd8
xchg rbx, rdx
mov rdx, rdi
xchg rbx, rdx
test rdi, rdi
jne 0x1401ba3bd
mov rdi, qword [rsp + 0x30]
xchg rdx, rcx
mov rdx, qword [rsi]
xchg rcx, rdx
mov edx, 0xe51e148
add edx, 0x1b674280
xor edx, 0x6437d398
xor edx, 0x20816ba5
sub edx, 0x2eb37c9c
add edx, 0x1699a935
sub edx, 0x54f5c84e
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
jmp fcn.1401fccd8
Function at 0x1401fd6ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401fd6f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fd6f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fd6f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fd6f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fd6f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fd6f8
xor al, al
add rsp, 0x28
ret

Function at 0x1401fde80
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa
Function at 0x140a64859
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x1406eba79

Function at 0x140ac0b1b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140d67978
syscall
ret
Function at 0x140044c1c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov ebx, 0x104
mov qword [r8], r15
mov r9d, ebx
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x140044c8f
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140044c8f
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x140044c6d
lea rax, [rdx - 2]
test r9, r9
lea r8, [0x140307718]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov word [rax], r15w
call fcn.140043484
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x140044cfa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x140044dcd
mov edx, 0xc8
mov rcx, qword [rbp + 0x168]
lea r8, [0x1403076a0]
call fcn.140044a28
mov esi, eax
jmp 0x140044dd0
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.140044ad0
mov esi, eax
test eax, eax
jns 0x140044d37
mov rcx, qword [rbp + 0x168]
lea r8, [0x1403076a0]
mov r9d, eax
mov edx, 0xce
call fcn.1400449f8
jmp 0x140044dd0
lea r8, [0x140307720]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140043484
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x140044d6f
mov edx, 0xd4
jmp 0x140044ce0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140044ad0
mov esi, eax
test eax, eax
jns 0x140044dac
mov rcx, qword [rbp + 0x168]
lea r8, [0x1403076a0]
mov r9d, eax
mov edx, 0xd6
call fcn.1400449f8
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140044e10
jmp 0x140044dd0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140044e29
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x140044de2
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140044e42
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp + 0x168]
lea r8, str.internal_sdkincwilResource.h
mov edx, 0x879
call fcn.140044a40
int3
mov rcx, qword [rbp + 0x168]
lea r8, str.internal_sdkincwilResource.h
mov edx, 0x879
call fcn.140044a40
int3
mov rcx, qword [rbp + 0x168]
lea r8, str.internal_sdkincwilResource.h
mov edx, 0x879
call fcn.140044a40
int3
Function at 0x140049700
Capabilities:
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 0x21], 0
lea rax, str.Sense
and qword [rbp - 0x19], 0
lea rcx, [rbp - 0x31]
mov qword [rbp - 0x31], rax
lea rax, [0x140049240]
mov qword [rbp - 0x29], rax
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_StartServiceCtrlDispatcherW]
mov rcx, qword [rbp + 0x5f]
lea rdx, str.Failed_to_start_service_control_dispatcher
mov qword [rsp + 0x20], rdx
lea r8, str.amcorewcd_source_service_src_service.cpp
mov edx, 0x2b3
mov r9d, eax
call fcn.14004a6bc
cmp qword [0x14044f4c8], 0
jne 0x140049786
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x140049830
jmp 0x14004981b
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
je 0x14004981b
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x140049807
and dword [rbp + 0x23], 0
lea rax, [rbp - 0x39]
and dword [rbp + 0x33], 0
mov edx, 4
and dword [rbp + 0x43], 0
mov qword [rbp + 0x17], rax
lea rax, str.Service_stopped_with_unexpected_service_status._Terminating_process
mov qword [rbp + 0x27], rax
lea rax, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rbp + 0x37], rax
mov dword [rbp - 0x39], 0x507
mov dword [rbp + 0x1f], edx
mov dword [rbp + 0x2f], 0x88
mov dword [rbp + 0x3f], edx
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140392f76]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001158
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 2
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0xc0
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140045e78
mov rcx, qword [rbp + 0x5f]
lea r8, str.amcorewcd_source_service_src_service.cpp
mov r9d, eax
mov edx, 0x2b8
lea rax, str.Service_control_dispatcher_failed_without_saying_so...
mov qword [rsp + 0x20], rax
call fcn.14004a5c0
int3