joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400eaec0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140200268]
cmp rsi, 1
jbe 0x1400eaf09
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400eaf02
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140200268]
call fcn.14000d630
test al, al
je 0x1400eaf4f
mov qword [0x140200270], 0
lea rdi, [0x140200268]
lea rsi, [0x140200270]
mov rcx, rsi
xor edx, edx
call fcn.14000d6e0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14000d5b0
jmp 0x1400eaed3
mov rsi, qword [0x140200268]
jmp 0x1400eaed3

Function at 0x1400eb470
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea rbp, [rbx + 1]
cmp rbp, 2
jae 0x1400eb4e9
cmp qword [rsi], rbx
je 0x1400eb4c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400eb4f0
cmp rbp, 2
jb 0x1400eb4bc
mov qword [rsi], rbx
call fcn.1400c18d0
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1400eb506
mov rax, rsi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400c18d0
jmp 0x1400eb494
call fcn.1400c18d0
mov rcx, qword [rsi]
call fcn.1400def50
mov qword [rsi], 0
jmp 0x1400eb4ae
call fcn.1400c18d0
mov rcx, qword [rdi]
call fcn.1400def50
mov qword [rdi], 0
jmp 0x1400eb4db

Function at 0x1400eb520
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400eb567
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400eb581
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400eb55f
mov qword [rsi], rdi
call fcn.1400c18d0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x1400eb597
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1400c18d0
mov rcx, qword [rsi]
call fcn.1400def50
mov qword [rsi], 0
jmp 0x1400eb54d
int3
Function at 0x1400ed190
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1401fe500]
cmp rsi, 1
jbe 0x1400ed1d4
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400ed21a
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x1400ed21a
cmp qword [rax + rcx], 0
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401fe500]
call fcn.14000d630
test al, al
je 0x1400ed21e
mov qword [0x1401fe508], 0
lea rdi, [0x1401fe500]
lea rsi, [0x1401fe508]
mov rcx, rsi
xor edx, edx
call fcn.14000d6e0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14000d5b0
jmp 0x1400ed1a3
xor eax, eax
jmp 0x1400ed1cd
mov rsi, qword [0x1401fe500]
jmp 0x1400ed1a3
Function at 0x1400ed270
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov esi, r9d
mov r14, r8
mov r12, rdx
mov r15, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
movaps xmm6, xmmword [0x1401c8a80]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x40], xmm6
movaps xmmword [rdi + 0x30], xmm6
movaps xmmword [rdi + 0x20], xmm6
movaps xmmword [rdi + 0x10], xmm6
movaps xmmword [rdi], xmm6
lea rdx, str.Read
lea r8, str..._.._base_files_file_win.cc
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov r9d, 0x3e
call fcn.1400d4e70
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400d4e90
movabs rdi, 0xaaaaaaaaaaaaaaaa
test esi, esi
js 0x1400ed3fc
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xb0], 0
mov rcx, qword [0x1401feac8]
test rcx, rcx
jne 0x1400ed3b9
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
lea r9, [rsp + 0x3c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [r15]
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400ed3e6
mov esi, dword [rsp + 0x3c]
cmp qword [rsp + 0xb0], 0
jne 0x1400ed406
test byte [0x1401f7030], 0x19
jne 0x1400ed431
lea rcx, [rsp + 0x60]
call fcn.1400dcbb0
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x1400ed32a
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0xb0]
mov r8, r15
call fcn.140142c60
jmp 0x1400ed32a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
jmp 0x1400ed368
mov esi, 0xffffffff
jmp 0x1400ed377
mov rcx, qword [0x1401feac8]
test rcx, rcx
je 0x1400ed377
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
mov rax, qword [rcx]
call qword [rax + 0x28]
jmp 0x1400ed377
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], rdi
movaps xmmword [rbx], xmm6
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
lea r8, [0x1401f7030]
lea r9, [0x1401d1322]
mov rcx, rbx
mov dl, 0x45
call fcn.1400c3ef0
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400ed491
mov r14, qword [rsp + 0x48]
lea rdi, [rsp + 0xb0]
mov rcx, rdi
xor edx, edx
call fcn.1400ec270
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r14
mov rcx, rdi
call fcn.1400c3f10
lea rcx, [rsp + 0x40]
call fcn.1400ec280
jmp 0x1400ed384
Function at 0x1400ee8e0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov r12, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rcx], 0
mov byte [rcx + 8], 0
mov eax, dword [0x1402003b0]
mov ecx, dword [0x1401f8a8c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400eea2c
mov ecx, dword [0x1401f6f88]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400ee966
movsxd rcx, dword [0x1402003a8]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [0x1402003ac]
jne 0x1400ee966
mov rbx, qword [rax + rcx]
test rbx, rbx
jne 0x1400ee986
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f32c0
mov rax, r12
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r15, 0x6000000000000000
movabs r14, 0xffffffffffffff
mov rax, qword [rbx]
mov rsi, rax
and rsi, r14
and rax, r15
movabs rcx, 0x4000000000000000
cmp rax, rcx
je 0x1400eea80
movabs r13, 0x8000000000000001
mov qword [r12], rsi
lea rcx, [rsp + 0x20]
call qword [fcn.1400e87b0]
mov rax, qword [rsp + 0x20]
lea rcx, [rdi + r13]
cmp rcx, 2
jb 0x1400eea6f
xor ecx, ecx
mov rdx, rax
add rdx, rdi
setns cl
movabs rdx, 0x7fffffffffffffff
add rdx, rcx
add rax, rdi
cmovo rax, rdx
mov rdi, rax
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x1400eeabb
mov rax, qword [rbx]
and rax, r15
and rdi, r14
or rdi, rax
mov qword [rbx], rdi
add dword [rbx + 0x14], 1
jmp 0x1400ee966
lea rcx, [0x1402003b0]
call fcn.1400f0548
cmp dword [0x1402003b0], 0xffffffff
jne 0x1400ee934
mov qword [0x1402003a8], 0
lea rcx, [0x1402003a8]
xor edx, edx
call fcn.14000d6e0
lea rcx, [0x1402003b0]
call fcn.1400f07ac
jmp 0x1400ee934
cmp rax, rdi
je 0x1400eea07
add rax, r13
cmp rax, 1
ja 0x1400eea07
int3
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400eeaa2
mov r13, qword [rbx]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, r13
or rcx, rax
mov qword [rbx], rcx
movabs rax, 0xbfffffffffffffff
lock and qword [rbx], rax
mov byte [r12 + 8], 1
jmp 0x1400ee9b9
mov rsi, qword [rbx]
call qword [rcx + 8]
movabs rcx, 0xff00000000000000
and rcx, rsi
or rcx, rax
mov qword [rbx], rcx
jmp 0x1400eea14

Function at 0x1400ffd5c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400ffe80
Function at 0x1401285e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1401285f0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x14012864e
mov edi, dword [rsi + 0x5c]
test r15b, r15b
je 0x14012862e
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1400f1c70
cmp eax, 0xffffffff
je 0x1401286c9
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14012866c
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x1401286d3
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r15b, r15b
je 0x1401286a8
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x14012862e
mov edi, edi
test rdi, rdi
jle 0x140128778
mov rdx, qword [rsi + 0x40]
movzx ecx, byte [rsp + rdi + 0x57]
dec rdi
call fcn.1400f1c18
cmp eax, 0xffffffff
jne 0x1401286aa
mov edi, 0xffffffff
jmp 0x14012862e
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x140128761
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x1401286c9
mov rcx, qword [rsi + 0x40]
call fcn.1400f1c70
cmp eax, 0xffffffff
je 0x1401286c9
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1401286e4
cmp eax, 2
je 0x1401286c9
cmp eax, 3
je 0x140128691
jmp 0x140128699
movzx edi, byte [rsp + 0x57]
jmp 0x14012862e
Function at 0x1401288e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1401288f0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14012894e
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x14012892e
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1400f1c70
cmp eax, 0xffffffff
je 0x1401289d1
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14012896c
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1401289da
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x1401289ad
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x14012892e
mov edi, edi
test rdi, rdi
jle 0x140128a7f
mov rdx, qword [rsi + 0x40]
movsx eax, byte [rsp + rdi + 0x57]
dec rdi
movzx ecx, ax
call fcn.1400f1c18
cmp eax, 0xffffffff
jne 0x1401289af
mov di, 0xffff
jmp 0x14012892e
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x140128a68
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x1401289d1
mov rcx, qword [rsi + 0x40]
call fcn.1400f1c70
cmp eax, 0xffffffff
je 0x1401289d1
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1401289eb
cmp eax, 2
je 0x1401289d1
cmp eax, 3
je 0x140128993
jmp 0x14012899d
movzx edi, word [rsp + 0x56]
jmp 0x14012892e
Function at 0x140128bf0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1400f1484
cmp rax, rbx
jne 0x140128c8c
cmp edi, 1
je 0x140128c34
cmp edi, 2
je 0x140128c8c
mov rcx, qword [rsi + 0x40]
call fcn.1400f141c
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f32c0
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140128cb0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140128ce5
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400f1484
xor ebx, ebx
test rsi, rsi
jle 0x140128d0a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x140128d0a
inc rbx
cmp rsi, rbx
jne 0x140128cec
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140128d20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp edx, 0xffffffff
je 0x140128d8a
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x140128db0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.1400f1484
mov esi, 0xffffffff
cmp rax, 1
je 0x140128d8d
jmp 0x140128d90
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140128e60
mov ebp, eax
cmp eax, 3
je 0x140128e3f
cmp ebp, 1
ja 0x140128e60
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1400f1484
cmp rax, rsi
jne 0x140128e60
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140128dc8
jmp 0x140128d8d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1400f1484
cmp rax, 1
je 0x140128d8d
mov esi, 0xffffffff
jmp 0x140128d90

Function at 0x140128eb0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140128ee5
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400f1484
xor ebx, ebx
test rsi, rsi
jle 0x140128f0b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x140128f0b
inc rbx
cmp rsi, rbx
jne 0x140128eec
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140128f20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp dx, 0xffff
je 0x140128f8a
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x140128fb0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.1400f1484
mov si, 0xffff
cmp rax, 1
je 0x140128f8d
jmp 0x140128f90
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f32c0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140129060
mov ebp, eax
cmp eax, 3
je 0x14012903f
cmp ebp, 1
ja 0x140129060
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.1400f1484
cmp rax, rsi
jne 0x140129060
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140128fc8
jmp 0x140128f8d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.1400f1484
cmp rax, 1
je 0x140128f8d
mov si, 0xffff
jmp 0x140128f90
Function at 0x140142750
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.1400f045c
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1401427c0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1400f2030
mov qword [rbx], rax
test rax, rax
je 0x1401427a7
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140144bb0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov edi, 2
cmp rdx, 1
jne 0x140144bea
mov rsi, qword [r14 + 8]
cmp rdi, rsi
ja 0x140144ceb
jae 0x140144ce1
mov rax, qword [r14 + 0x18]
test rax, rax
js 0x140144c05
cvtsi2ss xmm0, rax
jmp 0x140144c1a
lea rax, [rdx - 1]
test rdx, rax
jne 0x140144bf8
mov rdi, rdx
jmp 0x140144bc7
mov rcx, rdx
call fcn.1400c5680
mov rdi, rax
jmp 0x140144bc7
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [r14 + 0x20]
call fcn.1401091d4
cvttss2si rcx, xmm0
movss xmm1, dword [0x1401bbf88]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rsi, 3
jb 0x140144ccd
mov rcx, rsi
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rbx, rsi
sub rbx, rdx
movabs rdx, 0x3333333333333333
mov rcx, rbx
shr rcx, 2
and rbx, rdx
and rcx, rdx
add rcx, rbx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x140144ccd
cmp rax, 2
jb 0x140144cd5
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x140144cd5
mov rcx, rax
call fcn.1400c5680
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rsi
jb 0x140144ceb
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, r14
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401271b0

Function at 0x140144e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
mov r9, qword [rcx]
mov rdx, qword [rcx + 8]
mov r8, rdx
sub r8, r9
je 0x140144e88
mov rax, r8
shr rax, 2
mov rsi, r9
not rsi
add rsi, rdx
jne 0x140144e8c
xor edx, edx
jmp 0x140144ed0
xor eax, eax
jmp 0x140144eed
mov r10, r8
and r10, 0xfffffffffffffffe
xor edx, edx
mov r11d, 0xff
lea rsi, [0x1401d5910]
mov edi, eax
and edi, r11d
movzx ebx, byte [r9 + rdx]
xor ebx, edi
shr eax, 8
xor eax, dword [rsi + rbx*4]
mov edi, eax
and edi, r11d
movzx ebx, byte [r9 + rdx + 1]
xor ebx, edi
shr eax, 8
xor eax, dword [rsi + rbx*4]
add rdx, 2
cmp r10, rdx
jne 0x140144ea2
test r8b, 1
je 0x140144eed
movzx ebx, al
movzx edx, byte [r9 + rdx]
xor edx, ebx
lea rbx, [0x1401d5910]
shr eax, 8
xor eax, dword [rbx + rdx*4]
cmp eax, dword [rcx + 0x18]
sete al
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401474b0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1401f5028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x140147547
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14014754c
test bl, bl
je 0x14014750b
cmp byte [rdi + 8], 0
je 0x1401475c5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
jne 0x1401475d2
mov rcx, qword [rdi]
call fcn.140029570
mov rcx, qword [0x1401fead0]
mov dil, 1
test rcx, rcx
jne 0x1401475e0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f32c0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
jmp 0x1401474dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x140147574
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140147579
xor edi, edi
jmp 0x140147530
mov rcx, qword [rdi]
jmp 0x140147561
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x1401475cd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1401475a3
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
jne 0x1401475ef
mov rcx, qword [rdi]
call fcn.140029570
mov rcx, qword [0x1401fead0]
test rcx, rcx
jne 0x1401475fa
mov dil, 1
jmp 0x140147530
mov rcx, qword [rdi]
jmp 0x140147500
mov rcx, qword [rdi]
jmp 0x140147590
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140147518
mov edx, eax
mov r8d, esi
call fcn.140147610
jmp 0x140147530
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1401475ac
mov edx, eax
mov r8d, esi
call fcn.140147610
jmp 0x1401475bd