joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400085c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
movdqa xmm0, xmmword [0x140011cf0]
mov ebx, 0xae
movdqa xmm1, xmmword [str._b_b____b79_ft]
mov ecx, ebx
movdqa xmmword [rbp - 0x69], xmm0
movdqa xmm0, xmmword [0x140011860]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm0, xmmword [0x140011cd0]
movdqa xmmword [rbp - 0x59], xmm1
movdqa xmm1, xmmword [0x140011b80]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm0, xmmword [str.2lda2agd_vt]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm1, xmmword [0x140011c50]
movdqa xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x140011ab0]
movdqa xmmword [rbp - 0x19], xmm1
movdqa xmm1, xmmword [str.591x]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [str.:t2_95_n7_T]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x140011b40]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x47], 0x8cc67154
call fcn.1400026b0
lea r8, [rbp - 0x69]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x54
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x14000867e
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret

Function at 0x1400086a4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ecx, 0x40
mov dword [rbp - 0x50], 0x7054701b
mov dword [rbp - 0x4c], 0x704d705c
mov ebx, 0x7039
mov dword [rbp - 0x48], 0x70567051
mov dword [rbp - 0x44], 0x707c705d
mov dword [rbp - 0x40], 0x704b704b
mov dword [rbp - 0x3c], 0x704b7056
mov dword [rbp - 0x38], 0x7003701b
mov dword [rbp - 0x34], 0x707a701b
mov dword [rbp - 0x30], 0x705c704b
mov dword [rbp - 0x2c], 0x704d7058
mov dword [rbp - 0x28], 0x7069705c
mov dword [rbp - 0x24], 0x7056704b
mov dword [rbp - 0x20], 0x705c705a
mov dword [rbp - 0x1c], 0x704a704a
mov dword [rbp - 0x18], 0x701b706e
mov dword [rbp - 0x14], 0x70397015
mov dword [rbp - 0x10], 0x8cc67039
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x20
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140008747
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x14000876c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x24
mov dword [rbp - 0x30], 0x71427105
mov dword [rbp - 0x2c], 0x714e715f
mov ebx, 0x7127
mov dword [rbp - 0x28], 0x71647153
mov dword [rbp - 0x24], 0x71437148
mov dword [rbp - 0x20], 0x71057142
mov dword [rbp - 0x1c], 0x7105711d
mov dword [rbp - 0x18], 0x71177102
mov dword [rbp - 0x14], 0x717f711f
mov dword [rbp - 0x10], 0x71277105
mov dword [rbp - 0xc], 0x8cc67127
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayUnaccessData
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400087de
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140008800
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, 0x1c
mov dword [rbp - 0x20], 0x71217160
mov dword [rbp - 0x1c], 0x712f712d
mov ebx, 0x7142
mov dword [rbp - 0x18], 0x7123712f
mov dword [rbp - 0x14], 0x7126712c
mov dword [rbp - 0x10], 0x71607131
mov dword [rbp - 0xc], 0x71627178
mov dword [rbp - 8], 0x71427119
mov dword [rbp - 4], 0x8cc67142
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xe
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140008864
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140008884
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x7060702f
mov dword [rbp - 0x3c], 0x70797068
mov ebx, 0x700d
mov dword [rbp - 0x38], 0x70627065
mov dword [rbp - 0x34], 0x70487069
mov dword [rbp - 0x30], 0x707f707f
mov dword [rbp - 0x2c], 0x707f7062
mov dword [rbp - 0x28], 0x7037702f
mov dword [rbp - 0x24], 0x704e702f
mov dword [rbp - 0x20], 0x7068707f
mov dword [rbp - 0x1c], 0x7079706c
mov dword [rbp - 0x18], 0x705d7068
mov dword [rbp - 0x14], 0x707d7064
mov dword [rbp - 0x10], 0x702f7068
mov dword [rbp - 0xc], 0x700d7021
mov dword [rbp - 8], 0x8cc6700d
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1c
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140008919
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140008938
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x140011d20]
mov ebx, 0x58
movdqa xmm1, xmmword [0x140011770]
mov ecx, ebx
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140011a00]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140011ae0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140011cb0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x713f2a26
mov dword [rbp - 0xc], 0x4b3d3828
mov dword [rbp - 8], 0x8cc6714b
call fcn.1400026b0
lea r8, [rbp - 0x60]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x4b
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1400089b4
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x1400089d8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xb0
movdqa xmm0, xmmword [0x140011c90]
mov ebx, 0x80
movdqa xmm1, xmmword [0x1400118f0]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [str.8p_a9_cb]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [0x140011ad0]
movdqa xmmword [rax - 0x78], xmm0
movdqa xmm0, xmmword [0x140011830]
movdqa xmmword [rax - 0x68], xmm1
movdqa xmm1, xmmword [0x140011a80]
movdqa xmmword [rax - 0x58], xmm0
movdqa xmm0, xmmword [0x140011750]
movdqa xmmword [rax - 0x48], xmm1
movdqa xmm1, xmmword [0x140011c00]
movdqa xmmword [rax - 0x38], xmm0
movdqa xmmword [rax - 0x28], xmm1
mov dword [rax - 0x18], 0x8cc67150
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x50
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008a6b
add rsp, 0xb0
pop rbx
ret

Function at 0x140008a88
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xa0
movdqa xmm0, xmmword [0x140011c80]
mov ebx, 0x6d
movdqa xmm1, xmmword [0x140011980]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x140011d40]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x140011a20]
movdqa xmmword [rax - 0x78], xmm1
movdqa xmm1, xmmword [0x140011bd0]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [str.s5___2i0__S]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x140011a90]
movdqa xmmword [rax - 0x28], xmm0
movdqa xmmword [rax - 0x38], xmm1
mov dword [rax - 0x18], 0x8cc67153
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x53
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008b0d
add rsp, 0xa0
pop rbx
ret

Function at 0x140008b28
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x28
mov dword [rbp - 0x30], 0x707e7030
mov dword [rbp - 0x2c], 0x70617073
mov ebx, 0x7012
mov dword [rbp - 0x28], 0x70577066
mov dword [rbp - 0x24], 0x70607060
mov dword [rbp - 0x20], 0x7060707d
mov dword [rbp - 0x1c], 0x70287030
mov dword [rbp - 0x18], 0x70377030
mov dword [rbp - 0x14], 0x702a7022
mov dword [rbp - 0x10], 0x7030704a
mov dword [rbp - 0xc], 0x7012703e
mov dword [rbp - 8], 0x8cc67012
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140008ba1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x140008bc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
movdqa xmm0, xmmword [0x140011d50]
mov ebx, 0x5e
movdqa xmm1, xmmword [0x140011b10]
mov ecx, ebx
movdqa xmmword [rax - 0x78], xmm0
movdqa xmm0, xmmword [0x1400118a0]
movdqa xmmword [rax - 0x68], xmm1
movdqa xmm1, xmmword [0x1400119f0]
movdqa xmmword [rax - 0x58], xmm0
movdqa xmm0, xmmword [0x1400119e0]
movdqa xmmword [rax - 0x48], xmm1
movdqa xmm1, xmmword [str.na____:t_8N]
movdqa xmmword [rax - 0x38], xmm0
movdqa xmmword [rax - 0x28], xmm1
mov dword [rax - 0x18], 0x8cc6714e
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x4e
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008c37
add rsp, 0x90
pop rbx
ret

Function at 0x140008c54
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x711b
mov dword [rbp - 0x20], 0x71687139
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x717f716f
mov dword [rbp - 0x18], 0x7169717e
mov dword [rbp - 0x14], 0x71397169
mov dword [rbp - 0x10], 0x71397121
mov dword [rbp - 8], 0x8cc6711b
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140008cad
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140008ccc
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x7074703b
mov dword [rbp - 0x3c], 0x706d707c
mov ebx, 0x7019
mov dword [rbp - 0x38], 0x70767071
mov dword [rbp - 0x34], 0x705c707d
mov dword [rbp - 0x30], 0x706b706b
mov dword [rbp - 0x2c], 0x706b7076
mov dword [rbp - 0x28], 0x7023703b
mov dword [rbp - 0x24], 0x705a703b
mov dword [rbp - 0x20], 0x707c706b
mov dword [rbp - 0x1c], 0x706d7078
mov dword [rbp - 0x18], 0x7049707c
mov dword [rbp - 0x14], 0x70697070
mov dword [rbp - 0x10], 0x703b707c
mov dword [rbp - 0xc], 0x70197035
mov dword [rbp - 8], 0x8cc67019
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1c
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140008d61
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x140008d80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
movdqa xmm0, xmmword [0x140011d80]
mov ebx, 0x5d
movdqa xmm1, xmmword [0x140011b00]
mov ecx, ebx
movdqa xmmword [rax - 0x78], xmm0
movdqa xmm0, xmmword [0x1400117b0]
movdqa xmmword [rax - 0x68], xmm1
movdqa xmm1, xmmword [0x140011c40]
movdqa xmmword [rax - 0x58], xmm0
movdqa xmm0, xmmword [0x1400119c0]
movdqa xmmword [rax - 0x48], xmm1
movdqa xmm1, xmmword [str.mb____9w.__M]
movdqa xmmword [rax - 0x38], xmm0
movdqa xmmword [rax - 0x28], xmm1
mov dword [rax - 0x18], 0x8cc6714d
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x4d
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008df7
add rsp, 0x90
pop rbx
ret
Function at 0x140008e14
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
movdqa xmm0, xmmword [0x140011c70]
mov ebx, 0x120
movdqa xmm1, xmmword [0x140011950]
mov ecx, ebx
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x140011b60]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [0x140011940]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [str.__]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x140011b20]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x140011990]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x140011960]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x140011bc0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x140011760]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140011a10]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140011a70]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140011970]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [0x140011aa0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [0x140011b50]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm1, xmmword [0x140011850]
movdqa xmmword [rbp], xmm0
movdqa xmm0, xmmword [0x140011be0]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm1, xmmword [0x140011c20]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x30], xmm1
mov dword [rbp + 0x40], 0x8cc67152
call fcn.1400026b0
lea r8, [rsp + 0x20]
mov rdx, rax
sub r8, rax
mov cl, byte [r8 + rdx]
xor cl, 0x52
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x140008f34
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rbp
ret

Function at 0x140008f58
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x38
mov dword [rbp - 0x40], 0x706c7023
mov dword [rbp - 0x3c], 0x70757064
mov ebx, 0x7001
mov dword [rbp - 0x38], 0x706e7069
mov dword [rbp - 0x34], 0x70447065
mov dword [rbp - 0x30], 0x70737073
mov dword [rbp - 0x2c], 0x7073706e
mov dword [rbp - 0x28], 0x703b7023
mov dword [rbp - 0x24], 0x70427023
mov dword [rbp - 0x20], 0x70647073
mov dword [rbp - 0x1c], 0x70757060
mov dword [rbp - 0x18], 0x70517064
mov dword [rbp - 0x14], 0x70717068
mov dword [rbp - 0x10], 0x70237064
mov dword [rbp - 0xc], 0x7001702d
mov dword [rbp - 8], 0x8cc67001
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1c
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140008fed
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140009478
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov eax, dword [str.exit_r_n]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
xor r9d, r9d
movzx eax, word [0x140011664]
mov rbx, rcx
mov rcx, qword [rcx + 0x50]
mov word [rsp + 0x34], ax
mov al, byte [0x140011666]
lea r8d, [r9 + 7]
mov byte [rsp + 0x36], al
call fcn.14000971c
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rcx, [rsp + 0x38]
call fcn.140009a98
mov edi, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400094e6
lea rdx, [rbx + 8]
call fcn.14000968c
test eax, eax
je 0x140009540
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400094fc
lea rdx, [rbx + 0x30]
call fcn.14000968c
test eax, eax
je 0x140009540
mov rcx, qword [rbx + 0x58]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000954d
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [rbx + 0x64], 0
je 0x1400094d1
lea rcx, [rsp + 0x38]
call fcn.140009a98
sub eax, edi
cmp eax, dword [rbx + 0x64]
jbe 0x1400094d1
mov rcx, qword [rbx + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp eax, 0xffffffff
je 0x140009540
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009567
lea rdx, [rbx + 8]
call fcn.14000968c
test eax, eax
je 0x140009540
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14000957d
lea rdx, [rbx + 0x30]
call fcn.14000968c
test eax, eax
je 0x140009540
mov rcx, qword [rbx + 0x58]
lea rdx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140009540
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140009542

Function at 0x14000968c
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
and qword [rax - 0x10], 0
mov rbx, rdx
and dword [rax + 0x18], 0
lea rax, [rax + 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x14000970f
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x1400096d1
mov eax, 1
jmp 0x140009711
mov rdx, rax
mov rcx, rbx
call fcn.14000e6d8
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov rdx, rax
and qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000970f
mov edx, dword [rsp + 0x58]
mov rcx, rbx
call fcn.14000e728
jmp 0x1400096ca
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400097a4
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
and dword [rsp + 0x30], 0
mov rbx, r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400097d5
test rbx, rbx
je 0x1400097d3
mov eax, dword [rsp + 0x30]
mov qword [rbx], rax
mov al, 1
add rsp, 0x40
pop rbx
ret
Function at 0x1400097dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14, rdx
mov rsi, r8
lea rdx, [0x1400113f4]
mov rdi, rcx
xor r13d, r13d
call fcn.140001990
lea ecx, [r13 + 0x10]
mov dword [rbp - 0x20], 0x719771d6
mov dword [rbp - 0x1c], 0x71907199
mov ebx, 0x71f4
mov dword [rbp - 0x18], 0x71ce71d6
mov dword [rbp - 0x14], 0x71f471d6
mov dword [rbp - 0x10], 0x8cc671f4
call fcn.1400026b0
lea r8, [rbp - 0x20]
mov rdx, rax
sub r8, rax
lea r9d, [r13 + 8]
lea r15d, [r13 + 2]
lea r10d, [r13 + 1]
mov ecx, ebx
xor cx, word [r8 + rdx]
mov word [rdx], cx
add rdx, r15
sub r9, r10
jne 0x14000985a
mov rdx, rax
mov rcx, rdi
call fcn.140001990
mov rcx, rsi
call fcn.1400079f0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400019e4
mov rcx, rbx
call fcn.1400025b4
lea rdx, [0x1400113f8]
mov rcx, rdi
call fcn.140001990
mov rdx, rsi
mov rcx, r14
call fcn.140009224
test al, al
movzx r12d, r13b
mov eax, 1
lea rbx, [r14 + 8]
mov rdx, r15
mov rcx, rbx
cmovne r12d, eax
call fcn.14000e6d8
mov rcx, rax
mov r8, r15
xor edx, edx
call fcn.140002554
lea r15, [r14 + 0x30]
mov esi, 2
mov edx, esi
mov rcx, r15
call fcn.14000e6d8
mov rcx, rax
mov r8d, esi
xor edx, edx
call fcn.140002554
mov esi, r13d
cmp qword [r14 + 0x18], r13
je 0x14000990f
cmp qword [r14 + 0x18], 2
jb 0x14000992b
mov rax, qword [rbx]
jmp 0x140009923
cmp qword [r14 + 0x40], r13
je 0x1400099d7
cmp qword [r14 + 0x40], 2
jb 0x14000992b
mov rax, qword [r15]
cmp byte [rax + 1], r13b
sete sil
lea rcx, [rbp + 0x38]
call fcn.140007ed4
mov rdx, rax
mov rcx, rdi
call fcn.140001990
test esi, esi
je 0x140009950
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.1400019e4
jmp 0x14000996e
mov rcx, qword [rbx]
call fcn.1400079f0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400019e4
mov rcx, rbx
call fcn.1400025b4
lea rdx, [0x1400113f8]
mov rcx, rdi
call fcn.140001990
lea rcx, [rbp + 0x38]
call fcn.140008c54
mov rdx, rax
mov rcx, rdi
call fcn.140001990
test esi, esi
je 0x1400099a2
mov rdx, qword [r15]
mov rcx, rdi
call fcn.1400019e4
jmp 0x1400099c0
mov rcx, qword [r15]
call fcn.1400079f0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400019e4
mov rcx, rbx
call fcn.1400025b4
lea rdx, [0x1400113f8]
mov rcx, rdi
call fcn.140001990
mov qword [r14 + 0x18], r13
mov qword [r14 + 0x40], r13
lea rcx, [rbp + 0x38]
call fcn.14000876c
mov r8d, dword [r14 + 0x60]
mov rdx, rax
mov rcx, rdi
call fcn.140001a70
lea rdx, [0x140011404]
mov rcx, rdi
call fcn.140001990
lea r11, [rsp + 0x40]
mov al, r12b
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000a774
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, rdx
lea rdi, [rbp - 0x40]
mov r13, rcx
mov al, 0x41
mov byte [rdi], al
inc rdi
inc al
cmp al, 0x5a
jle 0x14000a79c
mov al, 0x61
lea rcx, [rbp - 0x26]
mov byte [rcx], al
inc rcx
inc al
cmp al, 0x7a
jle 0x14000a7ad
mov al, 0x30
lea rcx, [rbp - 0xc]
mov byte [rcx], al
inc rcx
inc al
cmp al, 0x39
jle 0x14000a7be
lea rcx, [rdx*4]
mov word [rbp - 2], 0x2f2b
xor ebx, ebx
xor r14d, r14d
call fcn.1400025dc
xor r11d, r11d
mov r15, rax
test r12, r12
je 0x14000a93a
mov eax, r11d
lea esi, [rbx + 3]
mov r10d, r11d
mov cl, byte [r13]
dec r12
mov byte [rbp + rax + 0x48], cl
inc ebx
mov r9b, byte [rbp + 0x4a]
inc rax
mov dl, byte [rbp + 0x49]
inc r13
mov dil, byte [rbp + 0x48]
cmp rax, rsi
jne 0x14000a87c
mov al, dil
mov cl, dil
shr al, 2
and cl, sil
mov byte [rbp + 0x58], al
mov r8, r11
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, r9b
mov byte [rbp + 0x59], cl
mov cl, dl
shr al, 6
and cl, 0xf
shl cl, 2
add cl, al
mov al, r9b
and al, 0x3f
mov byte [rbp + 0x5a], cl
mov byte [rbp + 0x5b], al
add r14d, 4
movzx eax, byte [rbp + r8 + 0x58]
inc r8
movzx ecx, byte [rbp + rax - 0x40]
mov word [r15 + r10*2], cx
inc r10
cmp r8, 4
jl 0x14000a85a
mov ebx, r11d
mov rax, r11
test r12, r12
jne 0x14000a7f9
test ebx, ebx
jle 0x14000a93a
cmp ebx, esi
jge 0x14000a8b7
mov eax, esi
movsxd rcx, ebx
sub eax, ebx
xor edx, edx
movsxd r8, eax
lea rax, [rbp + 0x48]
add rcx, rax
call fcn.140002554
mov r9b, byte [rbp + 0x4a]
xor r11d, r11d
mov dl, byte [rbp + 0x49]
mov dil, byte [rbp + 0x48]
mov al, dil
lea ecx, [rbx + 1]
shr al, 2
and dil, sil
mov byte [rbp + 0x58], al
mov al, dl
shr al, 4
and dl, 0xf
shl dil, 4
add dil, al
shl dl, 2
mov al, r9b
mov byte [rbp + 0x59], dil
shr al, 6
and r9b, 0x3f
add dl, al
mov byte [rbp + 0x5b], r9b
mov byte [rbp + 0x5a], dl
movsxd r8, ecx
test ecx, ecx
jle 0x14000a91c
movsxd rax, r14d
mov rdx, r11
add r14d, ecx
lea rdi, [r15 + rax*2]
movzx eax, byte [rbp + rdx + 0x58]
inc rdx
movzx ecx, byte [rbp + rax - 0x40]
mov word [rdi], cx
lea rdi, [rdi + 2]
cmp rdx, r8
jl 0x14000a903
cmp ebx, esi
jge 0x14000a93a
movsxd rax, r14d
sub esi, ebx
movsxd rcx, esi
add r14d, esi
lea rdi, [r15 + rax*2]
mov eax, 0x3d
movzx eax, ax
rep stosw word [rdi], ax
mov rcx, qword [rbp + 0x50]
movsxd rax, r14d
mov word [r15 + rax*2], r11w
test rcx, rcx
je 0x14000a94e
mov qword [rcx], rax
mov rbx, qword [rsp + 0xa0]
mov rax, r15
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret