joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140042d80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x18
mov eax, dword [r15 + rsi]
mov r12d, 0x13c0
test al, 1
jne 0x140042e1d
or eax, 1
mov dword [r15 + rsi], eax
mov r14d, r12d
add r14, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [r14 + 0x1384], 0xffffffff
mov dword [r14 + 4], eax
lea edx, [rbp + 1]
lea r8, [r14 + 8]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x140042df0
mov dword [r14], 0x270
mov eax, dword [r15 + rsi]
mov r14d, 0x2748
test al, 2
jne 0x140042e3b
or eax, 2
mov dword [r15 + rsi], eax
mov qword [r14 + rsi], rbp
mov qword [r14 + rsi + 8], 0x3d
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
cmp rdi, 0xf
jbe 0x140042e6a
mov rdx, rdi
mov rcx, rbx
call fcn.14004dfa0
mov qword [rbx + 0x10], rbp
test rdi, rdi
je 0x140042ece
mov ebp, r12d
add rbp, rsi
mov eax, r14d
add rsi, rax
lea r14, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
dec rdi
mov rdx, rbp
mov rcx, rsi
call fcn.14004d800
movzx r9d, byte [rax + r14]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140042ec1
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140042eb6
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140042ec9
mov rcx, rbx
call fcn.1400421b0
test rdi, rdi
jne 0x140042e82
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140042ef0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x14
mov eax, dword [r15 + rsi]
mov r12d, 0x20
test al, 1
jne 0x140042f8d
or eax, 1
mov dword [r15 + rsi], eax
mov r14d, r12d
add r14, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [r14 + 0x1384], 0xffffffff
mov dword [r14 + 4], eax
lea edx, [rbp + 1]
lea r8, [r14 + 8]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x140042f60
mov dword [r14], 0x270
mov eax, dword [r15 + rsi]
mov r14d, 0x13a8
test al, 2
jne 0x140042fab
or eax, 2
mov dword [r15 + rsi], eax
mov qword [r14 + rsi], rbp
mov qword [r14 + rsi + 8], 0x3d
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
cmp rdi, 0xf
jbe 0x140042fda
mov rdx, rdi
mov rcx, rbx
call fcn.14004dfa0
mov qword [rbx + 0x10], rbp
test rdi, rdi
je 0x14004303e
mov ebp, r12d
add rbp, rsi
mov eax, r14d
add rsi, rax
lea r14, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
dec rdi
mov rdx, rbp
mov rcx, rsi
call fcn.14004d800
movzx r9d, byte [rax + r14]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140043031
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140043026
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140043039
mov rcx, rbx
call fcn.1400421b0
test rdi, rdi
jne 0x140042ff2
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140046340
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x50]
sub rsp, 0x150
lea rax, [rbp - 0x30]
mov qword [rbp + 0x88], rax
movdqa xmm0, xmmword [0x140060260]
movdqu xmmword [rsp + 0x4c], xmm0
movdqa xmm1, xmmword [0x14005fd90]
movdqu xmmword [rsp + 0x5c], xmm1
movdqa xmm0, xmmword [0x140060250]
movdqu xmmword [rsp + 0x6c], xmm0
movdqa xmm1, xmmword [0x14005fd80]
movdqu xmmword [rsp + 0x7c], xmm1
movdqa xmm0, xmmword [0x1400602c0]
movdqu xmmword [rbp - 0x74], xmm0
movdqa xmm1, xmmword [0x1400602b0]
movdqu xmmword [rbp - 0x64], xmm1
movdqa xmm0, xmmword [0x1400602a0]
movdqu xmmword [rbp - 0x54], xmm0
mov dword [rbp - 0x44], 0x9fcbd4e8
mov dword [rbp - 0x40], 0xeeddddef
mov word [rbp - 0x3c], 0xf6
mov byte [rbp - 0x3a], 1
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x4c]
call fcn.14004cda0
mov rdi, rax
movdqa xmm0, xmmword [0x14005fda0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x2c116722
mov dword [rsp + 0x44], 0x26c222e
mov dword [rsp + 0x48], 0x1006f0d
lea rcx, [rsp + 0x30]
call fcn.140046540
mov rbx, rax
mov dword [rbp + 0x80], 0x59585716
mov word [rbp + 0x84], 0x1a
mov byte [rbp + 0x86], 1
lea rcx, [rbp + 0x80]
call fcn.140046510
mov rdx, rax
lea r8, [0x14018caa0]
lea rcx, [rbp + 0x30]
call fcn.14004dc40
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14004dd90
nop
lea r8, [0x14005f250]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14004dd90
nop
mov rdx, rdi
mov rcx, rax
call fcn.140042a00
nop
lea rcx, [rbp + 0x10]
call fcn.140041c80
nop
lea rcx, [rbp + 0x30]
call fcn.140041c80
lea rcx, [0x14005ee00]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14005f258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, [0x14005ee00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x70]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140046510
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x140046533
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x36]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x140046520
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x140046540
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x140046563
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x36]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x140046550
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret
Function at 0x140046570
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400466c8
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400465c4
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
mov rsi, qword [rdi + 0x10]
jb 0x1400465de
mov rcx, qword [rdi]
cmp rbx, rsi
lea rdx, [rsp + 0x4c]
mov r8, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004664c
cmp rsi, rbx
jb 0x14004664c
ja 0x14004664c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov ebx, dword [rsp + 0x28]
cmp rdx, 0x10
jb 0x140046644
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14004663f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004672c
mov rcx, r8
call fcn.14004ef00
mov rax, rbx
jmp 0x140046700
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400466bf
nop
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140046670
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
mov rsi, qword [rdi + 0x10]
jb 0x14004668a
mov rcx, qword [rdi]
cmp rbx, rsi
lea rdx, [rsp + 0x4c]
mov r8, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400466ad
cmp rsi, rbx
jb 0x1400466ad
jbe 0x1400465fd
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140046660
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1400466fe
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1400466f9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004672c
mov rcx, r8
call fcn.14004ef00
xor eax, eax
lea r11, [rsp + 0x150]
mov byte [rdi], 0
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], 0
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140046fb0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
movdqa xmm0, xmmword [0x14005fd70]
xor ebx, ebx
movdqu xmmword [rbp - 0x36], xmm0
mov ecx, ebx
mov dword [rbp - 0x26], 0x3b273032
mov dword [rbp - 0x22], 0x230d6b21
mov dword [rbp - 0x1e], 0x2b29232f
mov dword [rbp - 0x1a], 0x1002137
nop word [rax + rax]
lea eax, [rcx + 0x36]
xor byte [rbp + rcx - 0x36], al
inc rcx
cmp rcx, 0x1e
jb 0x140046ff0
lea rdx, [rbp - 0x36]
mov byte [rbp - 0x17], bl
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140047024
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140046340
movdqa xmm0, xmmword [0x14005fdb0]
mov rcx, rbx
movdqa xmm1, xmmword [0x14005fdd0]
movdqu xmmword [rbp - 0x36], xmm0
mov dword [rbp - 0x16], 0x3c3f3023
movdqu xmmword [rbp - 0x26], xmm1
mov word [rbp - 0x12], 0x28
mov byte [rbp - 0x10], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x36]
xor byte [rbp + rcx - 0x36], al
inc rcx
cmp rcx, 0x25
jb 0x140047060
lea rdx, [rbp - 0x36]
mov byte [rbp - 0x10], bl
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140047094
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140046340
mov dword [rbp + 0x10], 0x5d0c014e
mov rcx, rbx
mov dword [rbp + 0x14], 0x1005c58
nop word [rax + rax]
lea eax, [rcx + 0x36]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 6
jb 0x1400470b0
lea rdx, [rbp + 0x10]
mov byte [rbp + 0x17], bl
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400470e4
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140046340
mov dword [rbp - 0x40], 0x4c7c447d
mov dword [rbp - 0x3c], 0x4f594b57
mov word [rbp - 0x38], 0x100
nop dword [rax + rax]
lea eax, [rbx + 0x36]
xor byte [rbp + rbx - 0x40], al
inc rbx
cmp rbx, 8
jb 0x140047100
lea rdx, [rbp - 0x40]
mov byte [rbp - 0x37], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140047135
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140046340
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x140047190
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x60]
sub rsp, 0x160
lea rax, [rbp - 0x28]
mov qword [rbp - 0x38], rax
movdqa xmm0, xmmword [0x140060260]
movdqu xmmword [rsp + 0x4c], xmm0
movdqa xmm1, xmmword [0x14005fd90]
movdqu xmmword [rsp + 0x5c], xmm1
movdqa xmm0, xmmword [0x140060250]
movdqu xmmword [rsp + 0x6c], xmm0
movdqa xmm1, xmmword [0x14005fd80]
movdqu xmmword [rsp + 0x7c], xmm1
movdqa xmm0, xmmword [0x1400602c0]
movdqu xmmword [rbp - 0x74], xmm0
movdqa xmm1, xmmword [0x1400602b0]
movdqu xmmword [rbp - 0x64], xmm1
movdqa xmm0, xmmword [0x1400602a0]
movdqu xmmword [rbp - 0x54], xmm0
mov dword [rbp - 0x44], 0x9fcbd4e8
mov dword [rbp - 0x40], 0xeeddddef
mov word [rbp - 0x3c], 0xf6
mov byte [rbp - 0x3a], 1
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x4c]
call fcn.14004cda0
mov rdi, rax
movdqa xmm0, xmmword [0x14005fda0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x2c116722
mov dword [rsp + 0x44], 0x26c222e
mov dword [rsp + 0x48], 0x1006f0d
lea rcx, [rsp + 0x30]
call fcn.140046540
mov rbx, rax
mov dword [rbp + 0x98], 0x59585716
mov word [rbp + 0x9c], 0x1a
mov byte [rbp + 0x9e], 1
lea rcx, [rbp + 0x98]
call fcn.140046510
mov rdx, rax
lea r8, [0x14018caa0]
lea rcx, [rbp + 0x38]
call fcn.14004dc40
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.14004dd90
nop
lea r8, [0x14005f250]
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14004dd90
nop
mov rdx, rdi
mov rcx, rax
call fcn.140042a00
nop
lea rcx, [rbp + 0x18]
call fcn.140041c80
nop
lea rcx, [rbp + 0x38]
call fcn.140041c80
lea rcx, [0x14005ee00]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x14005f258]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, [0x14005ee00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x88]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov ecx, 0x539
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14004cda0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x7a], dl
je 0x14004cdd4
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x36]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x79
jb 0x14004cdc0
mov byte [rcx + 0x7a], dl
lea rax, [rcx + 0x79]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dl
cmp rcx, rax
je 0x14004cdff
mov rdx, rcx
mov r8d, 0x79
mov rcx, rbx
call fcn.14004d5c0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14004daa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rsi, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rax, [0x14005efd8]
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x48]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea r12, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], r12
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x60], rbx
mov dword [rbp - 0x58], 4
mov r8, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0x10
jb 0x14004db65
mov r14, qword [r14]
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.14004e8c0
cmp byte [rdi + 2], 0
je 0x14004db7f
xor byte [rdi], 0x36
mov byte [rdi + 2], 0
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14004e6f0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x14004db9a
mov rsi, qword [rsi]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14004e8c0
mov rdx, qword [rbp + 0x60]
cmp byte [rdx + 5], 0
je 0x14004dbc4
lea eax, [rbx + 0x36]
xor byte [rbx + rdx], al
inc rbx
cmp rbx, 4
jb 0x14004dbb1
mov byte [rdx + 5], 0
lea rcx, [rsp + 0x30]
call fcn.14004e6f0
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.14004d510
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x30], r12
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call fcn.14004d330
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rax, r15
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14004ec60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14004ecc1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14004ec80
mov ecx, dword [r10]
jmp 0x14004edaa
cmp ecx, 0x4e0
jb 0x14004edaa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004ece0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14004ed30
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140009770
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r10, rcx
lea r9, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r9]
xor edx, dword [r9 + 4]
lea r9, [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x630]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
sub r11, 1
jne 0x140009780
lea r9, [r10 + 0xd50]
mov r11d, 0x18c
nop word [rax + rax]
mov edx, dword [r9]
xor edx, dword [r9 + 4]
lea r9, [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 - 0xd50]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
sub r11, 1
jne 0x1400097d0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov dword [r10], r11d
ret

Function at 0x140027dc0
Capabilities:
Parse pe header

Disassembly:
mov rax, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x140027dd0
xor eax, eax
ret
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
jne 0x140027ded
mov edx, 0x20b
cmp word [rcx + 0x18], dx
sete al
jmp qword [sym.imp.KERNEL32.dll_RtlUnwindEx]
Function at 0x140053540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14005356d
xor al, al
jmp 0x1400536cf
mov rax, qword [0x1400736c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400736c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400736d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400736d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400736e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400736e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400736f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400736f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140073700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400536c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140053619
mov r11d, 2
jmp 0x14005363d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140053633
mov r11d, 1
jmp 0x14005363d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400536e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140053682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14005369a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400536aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400536b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140053600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400536ca
Function at 0x14000c85c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000c688
Function at 0x140011258
Capabilities:
Terminate process

Disassembly:
jmp 0x140013bd0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112f8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014f20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014f40
xor al, al
jmp 0x140014fc1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014f53
xor al, al
jmp 0x140014fc1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014f7d
xor al, al
jmp 0x140014fc1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014f91
xor al, al
jmp 0x140014fc1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014fa3
xor al, al
jmp 0x140014fc1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014fbf
xor al, al
jmp 0x140014fc1
mov al, 1
add rsp, 0x38
ret