joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087780
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
jne 0x1400878b6
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, rbx
jbe 0x140087808
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov rbx, r14
sub rbx, rax
mov r15, r12
sub r15, r14
je 0x1400877f1
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.140111410
mov r12, qword [rsi + 8]
add rbx, r15
mov qword [rsi + 0x10], rbx
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, rbx
jmp 0x1400878b6
mov rax, r12
sub rax, rbx
sar rax, 2
cmp r12, rbx
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14008792d
mov r15, r13
shr r15, 2
lea rcx, [r13*8]
call fcn.14010e7c0
lea rcx, [rax + r15*8]
mov r9, r12
sub r9, r14
lea rdx, [rax + r13*8]
mov r8, rcx
sub r12, r14
je 0x140087893
and r9, 0xfffffffffffffff8
mov r8, r9
add r8, rcx
add r12, 0xfffffffffffffff8
cmp r12, 0x68
jb 0x140087877
lea r9, [rax + r15*8]
sub r9, r14
cmp r9, 0x20
jae 0x1400878d2
mov r9, rcx
mov r10, r14
nop dword [rax]
mov r11, qword [r10]
mov qword [r9], r11
add r9, 8
add r10, 8
cmp r9, r8
jne 0x140087880
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
mov r12, r8
test rbx, rbx
je 0x1400878b6
mov rcx, rbx
call fcn.14010e7fc
mov r12, qword [rsi + 0x10]
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
shr r12, 3
inc r12
shl r15, 3
mov r11, r12
and r11, 0xfffffffffffffffc
lea r9, [rcx + r11*8]
lea r10, [r14 + r11*8]
add r15, rax
add r15, 0x10
xor r13d, r13d
nop word cs:[rax + rax]
movups xmm0, xmmword [r14 + r13*8]
movups xmm1, xmmword [r14 + r13*8 + 0x10]
movups xmmword [r15 + r13*8 - 0x10], xmm0
movups xmmword [r15 + r13*8], xmm1
add r13, 4
cmp r11, r13
jne 0x140087900
cmp r12, r11
jne 0x140087880
jmp 0x140087893
call fcn.140012fe0
int3
Function at 0x140087940
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x140087966
mov r14, rbx
jmp 0x140087ad3
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x1400879c1
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea r14, [r15 + r12*8]
mov rax, r15
sub rax, rbx
sub r14, rax
sub r15, rbx
je 0x1400879b0
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.140111410
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r14
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x140087ad3
mov rcx, rax
sub rcx, rbx
sar rcx, 2
cmp rax, rbx
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x140087aef
lea r12, [r13 + 3]
shr r12, 2
lea rcx, [r13*8]
call fcn.14010e7c0
lea r14, [rax + r12*8]
mov r8, r15
sub r8, rbx
lea rcx, [rax + r13*8]
mov rdx, r14
sub r15, rbx
je 0x140087ab3
and r8, 0xfffffffffffffff8
mov rdx, r8
add rdx, r14
add r15, 0xfffffffffffffff8
mov r8, r14
mov r9, rbx
cmp r15, 0x68
jb 0x140087aa0
lea r10, [rax + r12*8]
sub r10, rbx
mov r8, r14
mov r9, rbx
cmp r10, 0x20
jb 0x140087aa0
shr r15, 3
inc r15
shl r12, 3
mov r10, r15
and r10, 0xfffffffffffffffc
lea r8, [r14 + r10*8]
lea r9, [rbx + r10*8]
lea r11, [r12 + rax]
add r11, 0x10
xor r12d, r12d
nop word cs:[rax + rax]
movups xmm0, xmmword [rbx + r12*8]
movups xmm1, xmmword [rbx + r12*8 + 0x10]
movups xmmword [r11 + r12*8 - 0x10], xmm0
movups xmmword [r11 + r12*8], xmm1
add r12, 4
cmp r10, r12
jne 0x140087a70
cmp r15, r10
je 0x140087ab3
nop word cs:[rax + rax]
mov r10, qword [r9]
mov qword [r8], r10
add r8, 8
add r9, 8
cmp r8, rdx
jne 0x140087aa0
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rcx
test rbx, rbx
je 0x140087ad3
mov rcx, rbx
call fcn.14010e7fc
mov r14, qword [rsi + 8]
mov rax, qword [rdi]
mov qword [r14 - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140012fe0
int3
Function at 0x140095480
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movzx eax, byte [rcx + 0x17]
test al, al
jns 0x14009549e
mov rax, qword [rcx + 8]
mov rcx, qword [rcx]
test rax, rax
jle 0x1400955dd
mov r8, rcx
cmp rax, 8
jb 0x1400955bc
cmp rax, 0x20
jae 0x1400954c1
xor edx, edx
jmp 0x140095558
mov rdx, rax
and rdx, 0xffffffffffffffe0
xor r8d, r8d
movdqa xmm0, xmmword [0x140168910]
movdqa xmm1, xmmword [0x140168920]
movdqa xmm2, xmmword [0x140168930]
nop word cs:[rax + rax]
movdqu xmm3, xmmword [rcx + r8]
movdqu xmm4, xmmword [rcx + r8 + 0x10]
movdqa xmm5, xmm3
paddb xmm5, xmm0
movdqa xmm6, xmm4
paddb xmm6, xmm0
movdqa xmm7, xmm5
pminub xmm7, xmm1
pcmpeqb xmm7, xmm5
pand xmm7, xmm2
movdqa xmm5, xmm6
pminub xmm5, xmm1
pcmpeqb xmm5, xmm6
pand xmm5, xmm2
pxor xmm7, xmm3
pxor xmm5, xmm4
movdqu xmmword [rcx + r8], xmm7
movdqu xmmword [rcx + r8 + 0x10], xmm5
add r8, 0x20
cmp rdx, r8
jne 0x1400954f0
cmp rax, rdx
je 0x1400955dd
test al, 0x18
je 0x1400955b6
mov r9, rax
and r9, 0xfffffffffffffff8
lea r8, [rcx + r9]
movdqa xmm0, xmmword [0x140168940]
movdqa xmm1, xmmword [0x140168950]
movdqa xmm2, xmmword [0x140168960]
nop dword [rax + rax]
movq xmm3, qword [rcx + rdx]
movdqa xmm4, xmm3
paddb xmm4, xmm0
movdqa xmm5, xmm4
pmaxub xmm5, xmm1
pcmpeqb xmm5, xmm4
pandn xmm5, xmm2
pxor xmm5, xmm3
movq qword [rcx + rdx], xmm5
add rdx, 8
cmp r9, rdx
jne 0x140095580
cmp rax, r9
jne 0x1400955bc
jmp 0x1400955dd
add rdx, rcx
mov r8, rdx
add rcx, rax
nop
movzx eax, byte [r8]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
xor dl, al
mov byte [r8], dl
inc r8
cmp r8, rcx
jne 0x1400955c0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
add rsp, 0x28
ret
Function at 0x1400a7150
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], r8
mov rsi, rcx
mov r15, qword [rcx]
mov r12, qword [rcx + 8]
mov r13, qword [rcx + 0x10]
lea rax, [r15 + r13]
test r13, r13
jle 0x1400a71b1
movdqa xmm0, xmmword [0x140183650]
movdqa xmm1, xmmword [0x140183660]
mov rcx, r15
nop
movdqu xmm2, xmmword [rcx]
pxor xmm3, xmm3
pcmpgtb xmm3, xmm2
pand xmm3, xmm0
pxor xmm3, xmm1
movdqu xmmword [rcx], xmm3
add rcx, 0x10
cmp rcx, rax
jb 0x1400a7190
mov rcx, qword [r15]
mov r8, qword [r15 + 7]
mov qword [rax + 8], r8
mov qword [rax + 1], rcx
mov byte [r15 + r13], 0xff
test r13, r13
je 0x1400a7346
mov rbp, qword [rdx]
mov r14, qword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x20], rax
xor edi, edi
mov rbx, r12
jmp 0x1400a723b
tzcnt r9d, r9d
add r9, r10
and r9, rdx
mov r10, r9
sub r10, r8
mov r11, rdi
sub r11, r8
xor r11, r10
and r11, r13
cmp r11, 0xf
ja 0x1400a72b7
and al, 0x7f
mov byte [rcx + rdi], al
lea r8, [rdi - 0xf]
and r8, rdx
and edx, 0xf
add rdx, r8
mov byte [rcx + rdx], al
inc rdi
add rbx, rbp
cmp rdi, r13
je 0x1400a7346
cmp byte [r15 + rdi], 0xfe
jne 0x1400a722c
mov rcx, rsi
mov rdx, rbx
call r14
mov rcx, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov r9, rax
shr r9, 7
mov r8, rcx
shr r8, 0xc
xor r8, r9
and r8, rdx
movdqu xmm0, xmmword [rcx + r8]
pcmpeqd xmm1, xmm1
pcmpgtb xmm1, xmm0
pmovmskb r9d, xmm1
mov r10, r8
test r9d, r9d
jne 0x1400a71f0
mov r11d, 0x10
mov r10, r8
nop
add r10, r11
and r10, rdx
movdqu xmm0, xmmword [rcx + r10]
pcmpeqd xmm1, xmm1
pcmpgtb xmm1, xmm0
pmovmskb r9d, xmm1
add r11, 0x10
test r9d, r9d
je 0x1400a7290
jmp 0x1400a71f0
mov r10, r9
imul r10, rbp
add r10, r12
and al, 0x7f
lea r8, [r9 - 0xf]
and r8, rdx
and edx, 0xf
add rdx, r8
cmp byte [r15 + r9], 0x80
mov byte [rcx + r9], al
mov byte [rcx + rdx], al
mov rcx, rsi
jne 0x1400a730c
mov rdx, r10
mov r8, rbx
call qword [rsp + 0x20]
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov byte [rax + rdi], 0x80
lea rdx, [rdi - 0xf]
and rdx, rcx
and ecx, 0xf
add rcx, rdx
mov byte [rax + rcx], 0x80
jmp 0x1400a722c
mov rdx, qword [rsp + 0x28]
mov r8, r10
mov qword [rsp + 0x30], r10
call qword [rsp + 0x20]
mov rcx, rsi
mov rdx, qword [rsp + 0x30]
mov r8, rbx
call qword [rsp + 0x20]
mov rcx, rsi
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call qword [rsp + 0x20]
dec rdi
sub rbx, rbp
jmp 0x1400a722c
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, rcx
shr rdx, 3
mov r8, qword [rsi + 0x18]
shr r8, 1
add r8, rdx
sub rcx, r8
mov qword [rax - 8], rcx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400a8290
Capabilities:
Get session information

Disassembly:
push rsi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x34], 0
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
xor ecx, ecx
mov edx, eax
mov r8d, 0x19
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x1400a82ee
cmp dword [rsp + 0x34], 0
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x38]
je 0x1400a82e7
cmp dword [rcx], 1
jne 0x1400a82e7
mov esi, dword [rcx + 0x10]
call sub.WTSAPI32.dll_WTSFreeMemory
jmp 0x1400a82f3
mov esi, 0xffffffff
test esi, esi
sete al
add rsp, 0x40
pop rsi
ret
Function at 0x1400acc30
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
lea rcx, [0x140164370]
lea r9, [rbp - 0x20]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
je 0x1400acc7b
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [rsi], 0
mov byte [rsi + 0x18], 0
jmp 0x1400acd5b
mov rdi, qword [rbp - 0x20]
mov rcx, rdi
call fcn.1401328d8
mov rbx, rax
movabs rax, 0x7ffffffffffffff0
cmp rbx, rax
jae 0x1400acd6b
cmp rbx, 0xb
jae 0x1400accb1
mov byte [rbp - 1], bl
lea r14, [rbp - 0x18]
test rbx, rbx
jne 0x1400acce6
jmp 0x1400accf7
mov r15, rbx
or r15, 7
inc r15
js 0x1400acd74
lea rcx, [r15 + r15]
call fcn.14010e7c0
mov r14, rax
mov qword [rbp - 0x18], rax
movabs rax, 0x8000000000000000
or rax, r15
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
mov r8, rbx
add r8, rbx
mov rcx, r14
mov rdx, rdi
call fcn.140111410
mov word [r14 + rbx*2], 0
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 0
movzx eax, byte [rbp - 1]
test al, al
jns 0x1400acd28
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
jmp 0x1400acd2c
lea rdx, [rbp - 0x18]
lea r8, [rdx + rax*2]
lea rcx, [rbp - 0x40]
call fcn.14001acd0
mov rax, qword [rbp - 0x30]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], 1
cmp byte [rbp - 1], 0
jns 0x1400acd5b
mov rcx, qword [rbp - 0x18]
call fcn.14010e7fc
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp - 0x18]
call fcn.1400132f0
call fcn.140012fe0
int3
Function at 0x1400acdd0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
lea rcx, [0x140164390]
lea r9, [rbp - 0x20]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
je 0x1400ace1b
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [rsi], 0
mov byte [rsi + 0x18], 0
jmp 0x1400acefb
mov rdi, qword [rbp - 0x20]
mov rcx, rdi
call fcn.1401328d8
mov rbx, rax
movabs rax, 0x7ffffffffffffff0
cmp rbx, rax
jae 0x1400acf0b
cmp rbx, 0xb
jae 0x1400ace51
mov byte [rbp - 1], bl
lea r14, [rbp - 0x18]
test rbx, rbx
jne 0x1400ace86
jmp 0x1400ace97
mov r15, rbx
or r15, 7
inc r15
js 0x1400acf14
lea rcx, [r15 + r15]
call fcn.14010e7c0
mov r14, rax
mov qword [rbp - 0x18], rax
movabs rax, 0x8000000000000000
or rax, r15
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
mov r8, rbx
add r8, rbx
mov rcx, r14
mov rdx, rdi
call fcn.140111410
mov word [r14 + rbx*2], 0
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 0
movzx eax, byte [rbp - 1]
test al, al
jns 0x1400acec8
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
jmp 0x1400acecc
lea rdx, [rbp - 0x18]
lea r8, [rdx + rax*2]
lea rcx, [rbp - 0x40]
call fcn.14001acd0
mov rax, qword [rbp - 0x30]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], 1
cmp byte [rbp - 1], 0
jns 0x1400acefb
mov rcx, qword [rbp - 0x18]
call fcn.14010e7fc
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp - 0x18]
call fcn.1400132f0
call fcn.140012fe0
int3
Function at 0x1400acf70
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
lea rcx, [0x140164380]
lea r9, [rbp - 0x20]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
je 0x1400acfbb
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [rsi], 0
mov byte [rsi + 0x18], 0
jmp 0x1400ad09b
mov rdi, qword [rbp - 0x20]
mov rcx, rdi
call fcn.1401328d8
mov rbx, rax
movabs rax, 0x7ffffffffffffff0
cmp rbx, rax
jae 0x1400ad0ab
cmp rbx, 0xb
jae 0x1400acff1
mov byte [rbp - 1], bl
lea r14, [rbp - 0x18]
test rbx, rbx
jne 0x1400ad026
jmp 0x1400ad037
mov r15, rbx
or r15, 7
inc r15
js 0x1400ad0b4
lea rcx, [r15 + r15]
call fcn.14010e7c0
mov r14, rax
mov qword [rbp - 0x18], rax
movabs rax, 0x8000000000000000
or rax, r15
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], rbx
mov r8, rbx
add r8, rbx
mov rcx, r14
mov rdx, rdi
call fcn.140111410
mov word [r14 + rbx*2], 0
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 0
movzx eax, byte [rbp - 1]
test al, al
jns 0x1400ad068
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
jmp 0x1400ad06c
lea rdx, [rbp - 0x18]
lea r8, [rdx + rax*2]
lea rcx, [rbp - 0x40]
call fcn.14001acd0
mov rax, qword [rbp - 0x30]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], 1
cmp byte [rbp - 1], 0
jns 0x1400ad09b
mov rcx, qword [rbp - 0x18]
call fcn.14010e7fc
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp - 0x18]
call fcn.1400132f0
call fcn.140012fe0
int3
Function at 0x1400af970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movdqa xmmword [rsp + 0x60], xmm8
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm6
mov rdi, r8
mov rsi, rdx
mov r14, qword [rcx]
mov rax, r9
shr rax, 7
mov r15, r14
shr r15, 0xc
and r9b, 0x7f
movzx edx, r9b
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movzx ebx, byte [r8 + 0x17]
test bl, bl
jns 0x1400af9cd
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi]
mov r12, qword [rcx + 0x10]
mov r9, qword [rcx + 8]
xor r15, rax
pshufd xmm6, xmm0, 0
xor r10d, r10d
movdqa xmm7, xmmword [0x140154200]
and r15, r12
movdqu xmm8, xmmword [r14 + r15]
movdqa xmm0, xmm6
pcmpeqb xmm0, xmm8
pmovmskb eax, xmm0
test eax, eax
je 0x1400afac0
movzx r11d, ax
tzcnt ebp, r11d
add rbp, r15
and rbp, r12
lea rdx, [rbp*4]
add rdx, rbp
movzx ecx, byte [r9 + rdx*8 + 0x17]
movzx eax, cl
mov r8, rax
test cl, cl
jns 0x1400afa35
mov r8, qword [r9 + rdx*8 + 8]
cmp r8, rbx
jne 0x1400afaa1
lea r13, [r9 + rdx*8]
test cl, cl
js 0x1400afa70
je 0x1400afade
xor ecx, ecx
nop word [rax + rax]
movzx edx, byte [r13 + rcx]
cmp dl, byte [rdi + rcx]
jne 0x1400afaa1
inc rcx
cmp rax, rcx
jne 0x1400afa50
jmp 0x1400afade
mov rcx, qword [r13]
mov rdx, rdi
mov r8, rbx
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], r11
call fcn.140111310
mov r11, qword [rsp + 0x28]
mov r10, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
test eax, eax
je 0x1400afade
lea eax, [r11 - 1]
and eax, r11d
mov r11d, eax
jne 0x1400afa0a
nop word cs:[rax + rax]
pcmpeqb xmm8, xmm7
pmovmskb eax, xmm8
test eax, eax
jne 0x1400afaea
add r15, r10
add r15, 0x10
add r10, 0x10
jmp 0x1400af9e8
add r14, rbp
mov qword [rsi], r14
mov qword [rsi + 8], r13
jmp 0x1400afaf1
mov qword [rsi], 0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400b1d70
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.140038470
cmp dword [rsi + 0x28], eax
jge 0x1400b1d91
call fcn.140038690
test al, al
je 0x1400b1d91
add rsp, 0x20
pop rsi
ret
mov rcx, qword [rsi + 0x40]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
scasd eax, dword [rdi]
invalid
out dx, eax
sub dword [rcx - 0x77], ebp
imul ebx, dword [rdi + riz*4 + 0xc], 0x66cf1c7
sub eax, 0xff5404c9
out 0x8b, al
invalid
invalid
jle 0x14036677f
cmc
cld
invalid
ret
adc eax, 0x587343e0
jns fcn.1403667a3
lidt [rdi]
int1
invalid

Function at 0x1400b2bc0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
rdtsc
mov r11, qword [0x1401fbb00]
mov rcx, qword [0x1401fbb10]
mov r9, qword [0x1401fbb18]
mov r8, qword [0x1401fbb20]
mov r10, qword [0x1401fbb28]
mov rsi, qword [0x1401fbb00]
test r11b, 1
jne 0x1400b2c17
cmp r11, rsi
jne 0x1400b2c17
shl rdx, 0x20
or rdx, rax
sub rdx, r9
cmp rdx, r10
jae 0x1400b2c17
imul rdx, r8
shr rdx, 0x1e
add rdx, rcx
mov rax, rdx
pop rsi
ret
pop rsi
jmp fcn.140148519
Function at 0x1400b3230
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp r8, 0x400
jb 0x1400b3210
movabs r14, 0x71b1a19b907d6e33
nop word cs:[rax + rax]
mov edx, 0x400
mov rcx, rdi
call fcn.1400b3300
add rax, rbx
mul r14
mov rbx, rdx
xor rbx, rax
add rsi, 0xfffffffffffffc00
add rdi, 0x400
cmp rsi, 0x3ff
ja 0x1400b31e0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400b3230
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp r8, 0x11
jb 0x1400b3258
cmp r8, 0x401
jae 0x1400b32ee
mov rcx, rdx
mov rdx, r8
call fcn.1400b3300
jmp 0x1400b32cf
cmp r8, 9
jb 0x1400b327f
mov rcx, qword [rdx]
rol rcx, 0xb
movabs rax, 0x71b1a19b907d6e33
add rsi, rax
add rcx, rsi
xor rsi, qword [rdx + r8 - 8]
mov rax, rsi
jmp 0x1400b32dc
cmp r8, 4
jb 0x1400b329d
mov r9d, dword [rdx]
mov eax, dword [rdx + r8 - 4]
shl r8d, 3
add r8b, 0xe0
mov ecx, r8d
shl rax, cl
jmp 0x1400b32cc
test r8, r8
je 0x1400b32e5
mov rcx, r8
shr rcx, 1
movzx r9d, byte [rdx + rcx]
movzx eax, byte [rdx + r8 - 1]
dec r8
shl ecx, 3
shl r9, cl
shl r8d, 3
mov ecx, r8d
shl rax, cl
movzx ecx, byte [rdx]
or rax, rcx
or rax, r9
add rax, rsi
movabs rcx, 0x71b1a19b907d6e33
mul rcx
mov rsi, rdx
xor rsi, rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400b31b0
Function at 0x1400bb940
Capabilities:
Get file version info

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov ecx, 0x110
call fcn.14010e7c0
mov r15, rax
mov r8d, 0x105
mov rcx, rax
xor edx, edx
call fcn.140111ac0
xor ecx, ecx
mov rdx, r15
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400bbb0b
mov rcx, r15
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
je 0x1400bbb0b
mov edi, eax
mov ebx, eax
cmp eax, 0x17
jae 0x1400bb9cb
mov byte [rbp + 0x47], dil
lea r14, [rbp + 0x30]
jmp 0x1400bba01
mov qword [rbp + 0x48], r15
mov r15, rbx
or r15, 0xf
inc r15
mov rcx, r15
call fcn.14010e7c0
mov r14, rax
mov qword [rbp + 0x30], rax
movabs rax, 0x8000000000000000
or r15, rax
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x38], rbx
mov r15, qword [rbp + 0x48]
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.140111ac0
mov byte [r14 + rbx], 0
cmp byte [rbp + 0x47], 0
jns 0x1400bba1f
mov r9, qword [rbp + 0x30]
jmp 0x1400bba23
lea r9, [rbp + 0x30]
mov rcx, r15
xor edx, edx
mov r8d, edi
call sub.VERSION.dll_GetFileVersionInfoA
movzx ecx, byte [rbp + 0x47]
test eax, eax
je 0x1400bbafe
test cl, cl
jns 0x1400bba46
mov rcx, qword [rbp + 0x30]
jmp 0x1400bba4a
lea rcx, [rbp + 0x30]
lea rdx, [0x140180ef0]
lea r8, [rbp + 0x20]
lea r9, [rbp + 0x2c]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1400bbafa
cmp dword [rbp + 0x2c], 0
je 0x1400bbafa
mov qword [rbp + 0x48], r15
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 8]
mov eax, dword [rax + 0xc]
movzx edx, ax
shr rax, 0x10
movzx r8d, cx
shr rcx, 0x10
mov qword [rbp - 0x40], rcx
lea rcx, [0x1400b63c0]
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
lea rax, [rbp - 0x40]
mov qword [rbp], rax
mov qword [rbp + 8], 4
lea rax, str._d._d._d._d
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], VariantTimeToDosDateTime
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0x10]
mov r8, rbp
call fcn.1400b6c80
mov rax, qword [rbp - 0x48]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsi], xmm0
mov r15, qword [rbp + 0x48]
movzx ecx, byte [rbp + 0x47]
test cl, cl
jns 0x1400bbb0b
mov rcx, qword [rbp + 0x30]
call fcn.14010e7fc
mov rcx, r15
call fcn.14010e7fc
mov rax, rsi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1400c1a70
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x40
mov rcx, rdx
lea rsi, [rsp + 0x28]
mov rdx, rsi
call fcn.1400db6d0
cmp byte [rsp + 0x3f], 0
jns 0x1400c1a91
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [rsp + 0x3f], 0
jns 0x1400c1aab
mov rcx, qword [rsp + 0x28]
call fcn.14010e7fc
nop
add rsp, 0x40
pop rsi
ret
Function at 0x1400ce260
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x150
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc8], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [0x140202880]
test rax, rax
jne 0x1400ce2b3
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
nop word cs:[rax + rax]
mov ecx, 1
call rdi
mov rax, qword [0x140202880]
test rax, rax
je 0x1400ce2a0
cmp eax, 2
jne 0x1400ce2fa
mov dword [rsp + 0x20], 2
lea rdx, str.LONG___cdecl_crashpad::_anonymous_namespace_::UnhandledExceptionHandler_EXCEPTION_POINTERS__
lea r8, str.third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rbp - 0x58]
mov rcx, rsi
mov r9d, 0x8b
call fcn.1400f33f0
lea rdx, str.crash_server_failed_to_launch__self_terminating
mov r8d, 0x2f
mov rcx, rsi
call fcn.140013430
jmp 0x1400ce382
mov eax, 1
lock xadd qword [0x1402028b8], rax
test rax, rax
jle 0x1400ce31a
mov ecx, 0xffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x140202828], eax
mov qword [0x140202820], rsi
mov rcx, qword [0x1401fc3d0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 2
lea rdx, str.LONG___cdecl_crashpad::_anonymous_namespace_::UnhandledExceptionHandler_EXCEPTION_POINTERS__
lea r8, str.third_party_crashpad_crashpad_client_crashpad_client_win.cc
lea rsi, [rbp - 0x58]
mov rcx, rsi
mov r9d, 0xb7
call fcn.1400f33f0
lea rdx, str.crash_server_did_not_respond__self_terminating
mov r8d, 0x2e
mov rcx, rsi
call fcn.140013430
lea rcx, [rbp - 0x58]
call fcn.1400f3c40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret