joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024080
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov r12, r8
mov r15, rdx
mov r14, rcx
cmp qword [rcx + 0x28], 0
je 0x140024263
lea rdx, str.starting
call fcn.140024070
xor edx, edx
mov r8d, 0x801
lea rcx, [rbp - 0x60]
call fcn.140030fb0
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rbp - 0x6a]
movzx ecx, word [rbp - 0x6c]
movzx edx, word [rbp - 0x6e]
movzx r8d, word [rbp - 0x70]
movzx r10d, word [rbp - 0x72]
movzx r11d, word [rbp - 0x76]
movzx r9d, word [rbp - 0x78]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
lea r8, str.__4d__02d__02d__02d:_02d:_02d._03d_
mov edx, 0x800
lea rcx, [rbp - 0x60]
call fcn.140010490
movsxd rsi, eax
mov edi, 0x7fe
sub rdi, rsi
lea rbx, [rbp - 0x60]
add rbx, rsi
call fcn.140010480
mov qword [rsp + 0x30], r12
xor r12d, r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
mov r15, 0xffffffffffffffff
mov r9, r15
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rax]
call fcn.14003a79c
test eax, eax
cmovs eax, r15d
add esi, eax
movsxd rax, esi
mov word [rbp + rax - 0x60], 0xa0d
add rax, 2
cmp rax, 0x801
jae 0x1400242ac
mov byte [rbp + rax - 0x60], r12b
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140024214
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.140010790
cmp qword [rax + 0x18], 8
jb 0x1400241c9
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140024214
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002420f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400242a6
call fcn.140028ef4
lea rdx, [0x1400a0440]
lea rcx, [rbp - 0x80]
call fcn.1400200c0
nop
mov dword [rsp + 0x78], r12d
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x78]
lea r8d, [rsi + 2]
lea rdx, [rbp - 0x60]
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140024286
lea rdx, str.Unable_to_write_file
mov rcx, r14
call fcn.140024070
nop
lea rcx, [rbp - 0x80]
call fcn.1400200f0
xor al, al
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.140028f90
add rsp, 0x8c0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [rsp + 0x78], 0x800
je 0x140024299
lea rdx, str.Bytes_written_not_equal_to_buffer_size
jmp 0x140024251
lea rcx, [rbp - 0x80]
call fcn.1400200f0
mov al, 1
jmp 0x140024265
call fcn.140033494
int3
call fcn.140029484
int3
Function at 0x1400242c0
Capabilities:
Get common file path

Disassembly:
push rdi
push r13
push r15
sub rsp, 0x60
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x18], 0
mov rdi, rdx
mov r15, rcx
je 0x140024513
xor r13d, r13d
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], r13
xor edx, edx
lea rcx, [0x140058020]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140024513
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x40], r14
xor al, al
jmp 0x1400244fc

Function at 0x140024d73
Capabilities:
Get system information on windows

Disassembly:
lea rsp, [rbp + 0x90]
pop rbp
ret
add qword [rbp + 0x60], 0x28
jmp 0x1400063dd
add dword [rbp + 0x78], 1
mov eax, dword [rbp + 0x78]
mov edx, dword [rbp + 0x70]
cmp eax, edx
jae 0x14000801d
jmp 0x14000ecc6
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
and eax, dword [rbp + 0x74]
mov dword [rbp + 0x74], eax
mov rax, qword [rbp + 0x60]
mov eax, dword [rax + 0xc]
mov eax, eax
add rax, qword [rbp + 0x58]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x60]
mov eax, dword [rax + 8]
mov eax, eax
add rax, qword [rbp + 0x38]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x40]
cmp rax, rdx
jae 0x140006225
jmp 0x14002f09f
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x78], 0
mov eax, dword [rbp + 0x78]
mov edx, dword [rbp + 0x70]
cmp eax, edx
jb 0x14000ecc6
jmp 0x1400079c6
add qword [rbp + 0x60], 0x28
jmp 0x1400063dd
jmp 0x14000801d
mov dword [0x140006eca], 0
lea rsp, [rbp + 0x90]
pop rbp
ret
mov rax, qword [rbp + 0x60]
mov eax, dword [rax + 0x24]
test eax, 0x10000000
je 0x1400101b5
jmp 0x140007964
lea rax, [fcn.140024d73]
mov qword [rbp + 0x50], rax
mov rax, qword [fcn.140024d73]
neg rax
add rax, qword [rbp + 0x50]
mov qword [rbp + 0x58], rax
mov rax, qword [0x140004cb8]
add rax, qword [rbp + 0x58]
mov qword [rbp + 0x58], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rbp]
mov rcx, rdx
call rax
jmp 0x14002573f
mov rax, qword [rbp + 0x60]
mov eax, dword [rax + 0xc]
mov eax, eax
add rax, qword [rbp + 0x58]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x60]
mov edx, dword [rdx + 8]
mov rcx, rax
call fcn.140022cd5
jmp 0x140006caf
mov dword [rbp + 0x7c], eax
mov eax, dword [rbp + 0x7c]
mov dword [rbp + 0x74], eax
mov rax, qword [rbp + 0x58]
lea rdx, [rbp + 0x70]
mov rcx, rax
call fcn.14002ee75
jmp 0x1400078bf
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x20]
mov byte [rbp + 0x80], 0
mov eax, dword [0x140006eca]
test eax, eax
jne 0x14000ef75
jmp 0x140001763
mov rax, qword [rbp + 0x58]
mov edx, dword [rbp + 4]
add edx, 0xffffffff
mov rcx, rax
call fcn.140022cd5
jmp 0x140024cd8
mov rax, qword [rbp + 0x38]
movzx eax, byte [rax]
mov byte [rbp + 0x80], al
movzx eax, byte [rbp + 0x80]
mov rdx, qword [rbp + 0x38]
mov byte [rdx], al
mov eax, dword [rbp + 4]
mov eax, eax
add rax, qword [rbp + 0x38]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x40]
cmp rax, rdx
jb 0x14002f09f
jmp 0x140006225
Function at 0x140025a40
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r14
push r15
xor r11d, r11d
mov r15, r9
mov dword [r9], r11d
mov r14, r8
mov ebp, edx
mov r10, rcx
test rcx, rcx
je 0x140025ba6
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r11b
jne 0x140025a67
test rax, rax
je 0x140025ba6
cmp byte [rcx + rax - 1], 0x3d
jne 0x140025a8a
dec rax
cmp byte [rcx + rax - 1], 0x3d
je 0x140025a80
lea rcx, [rax + rax*2]
add rcx, rcx
shr rcx, 3
test ecx, ecx
je 0x140025ba6
cmp ebp, ecx
jb 0x140025ba6
mov qword [rsp + 0x20], rbx
mov r9d, r11d
mov qword [rsp + 0x28], rsi
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x30], rdi
nop
inc r8
cmp byte [r10 + r8], r9b
jne 0x140025ac0
movsxd rsi, r8d
mov ebx, r11d
mov edi, r11d
test r8d, r8d
jle 0x140025b88
mov qword [rsp + 0x38], r12
mov rdx, r10
mov r12d, 0x3f
nop dword [rax]
cmp ebx, ebp
jl 0x140025afd
cmp byte [rdx], 0x3d
jne 0x140025b83
movzx ecx, byte [rdx]
cmp cl, 0x3d
je 0x140025b6f
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x140025b14
movsx eax, cl
sub eax, 0x41
jmp 0x140025b4a
lea eax, [rcx - 0x61]
cmp al, 0x19
ja 0x140025b23
movsx eax, cl
sub eax, 0x47
jmp 0x140025b4a
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140025b32
movsx eax, cl
add eax, 4
jmp 0x140025b4a
cmp cl, 0x2b
jne 0x140025b3e
mov eax, 0x3e
jmp 0x140025b4a
cmp cl, 0x2f
mov eax, 0xffffffff
cmove eax, r12d
shl r11d, 6
add r9d, 6
or r11d, eax
cmp r9d, 8
jb 0x140025b6f
add r9d, 0xfffffff8
mov eax, r11d
mov ecx, r9d
inc ebx
shr eax, cl
mov byte [r14], al
inc r14
inc rdx
inc edi
mov rax, rdx
sub rax, r10
cmp rax, rsi
jl 0x140025af0
mov r12, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
cmp edi, r8d
mov rdi, qword [rsp + 0x30]
mov dword [r15], ebx
sete al
mov rbx, qword [rsp + 0x20]
pop r15
pop r14
pop rbp
ret
xor al, al
pop r15
pop r14
pop rbp
ret
Function at 0x140026d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r10, qword [r9]
mov rbx, r8
mov rsi, qword [r9 + 8]
mov rdi, rdx
lea r9d, [r8 - 0x10]
mov r14, rcx
movabs rbp, 0x9ddfea08eb382d69
movabs r11, 0xb492b66fbe98f273
test r9d, r9d
jg 0x140026e12
imul r10, r11
mov rdx, rbx
mov rcx, rdi
mov rax, r10
shr r10, 0x2f
xor r10, rax
imul r10, r11
call fcn.140026f60
mov r8, rax
mov rax, rsi
imul rax, r11
add r8, rax
cmp rbx, 8
jb 0x140026dfd
mov rax, qword [rdi]
add rax, r10
mov rbx, rax
shr rbx, 0x2f
xor rbx, rax
jmp 0x140026ecc
mov rax, r8
add rax, r10
mov rbx, rax
shr rbx, 0x2f
xor rbx, rax
jmp 0x140026ecc
mov rax, qword [rdx + r8 - 8]
movabs rcx, 0x4b6d499041670d8d
sub rax, rcx
xor rax, r10
imul rax, rbp
mov rcx, rax
shr rcx, 0x2f
xor rcx, rax
lea rax, [rbx + rsi]
xor rcx, r10
imul rcx, rbp
mov r8, rcx
shr r8, 0x2f
xor r8, rcx
mov rcx, qword [rdx + rbx - 0x10]
imul r8, rbp
add rcx, r8
xor rax, rcx
imul rax, rbp
mov rdx, rax
shr rdx, 0x2f
xor rdx, rcx
xor rdx, rax
imul rdx, rbp
mov rbx, rdx
shr rbx, 0x2f
xor rbx, rdx
imul rbx, rbp
add r10, rbx
nop
mov rax, qword [rdi]
lea rdi, [rdi + 0x10]
imul rax, r11
sub r9d, 0x10
mov rcx, rax
shr rcx, 0x2f
xor rcx, rax
mov rax, qword [rdi - 8]
imul rcx, r11
imul rax, r11
xor r10, rcx
imul r10, r11
mov rcx, rax
shr rcx, 0x2f
xor rsi, r10
xor rcx, rax
imul rcx, r11
xor r8, rcx
imul r8, r11
xor rbx, r8
test r9d, r9d
jg 0x140026e80
mov rax, r8
xor rbx, rsi
xor rax, r10
imul rax, rbp
imul rbx, rbp
mov rcx, rax
shr rcx, 0x2f
xor rcx, rax
xor rcx, r8
imul rcx, rbp
mov rax, rbx
shr rax, 0x2f
mov r9, rcx
xor rax, rbx
shr r9, 0x2f
xor rax, rsi
xor r9, rcx
imul rax, rbp
imul r9, rbp
mov r8, rax
shr r8, 0x2f
xor r8, rax
imul r8, rbp
xor r8, r9
mov rax, r8
mov qword [r14], r8
imul rax, rbp
mov rdx, rax
shr rdx, 0x2f
xor rdx, rax
mov rax, r14
xor rdx, r9
imul rdx, rbp
mov rcx, rdx
shr rcx, 0x2f
xor rcx, rdx
imul rcx, rbp
mov qword [r14 + 8], rcx
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002e4ce
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x70], rcx
xor eax, eax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 8], rax
mov dword [rbp + 0x54], 0
mov edx, dword [0x1401c4ea9]
mov edx, edx
neg rdx
lea rcx, [fcn.14002e4ce]
lea rdx, [rcx + rdx]
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x78]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
cmp rax, 0x18
jne 0x1401a95ec
jmp fcn.1401c4db4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rax, rdx
je 0x1401c40ba
jmp 0x14017a749
mov rax, qword [rbp + 0x10]
add rax, 0x58
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.140176f32
jmp 0x1401f0c0a
add dword [rbp + 0x54], 1
jmp 0x1401c40ba
mov rax, qword [rbp + 0x28]
add rax, qword [0x1401c8c62]
mov rdx, qword [0x1401f4ffa]
mov qword [rbp + rax*8 + 0x70], rdx
lea rax, [0x1401c4596]
lea rdx, [0x14001e8c9]
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x40], rcx
mov rcx, rax
mov r8d, 6
mov rax, qword [rbp + 0x40]
mov r9, rax
call fcn.1401c44af
jmp 0x1401761e6
mov rax, qword [rbp + 0x28]
add rax, qword [0x140179cfb]
mov rdx, qword [0x1401c5aa6]
mov qword [rbp + rax*8 + 0x70], rdx
lea rax, [rbp + 0x48]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
movzx eax, byte [rax]
movsx rax, al
test eax, eax
je fcn.1401aa329
jmp loc.140022655
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rax, rdx
jne 0x14017a749
jmp 0x1401c40ba
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
movzx eax, al
test eax, eax
je 0x1401c7164
jmp 0x14017b558

Function at 0x14002e96e
Capabilities:
Check for peb beingdebugged flag
Encode data using xor

Disassembly:
mov eax, dword [0x14000b94d]
cmp eax, 0xff
ja fcn.14017a264
jmp loc.1401f40a6
mov eax, dword [0x14000b94d]
test eax, eax
je fcn.14017a264
jmp 0x140007bef
push rbp
sub rsp, 0x1c0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x170], rbx
mov qword [rbp + 0x1a0], rcx
xor eax, eax
mov qword [rbp + 0x148], rax
xor edx, edx
mov dword [rbp + 0x180], edx
mov dword [rbp + 0x184], edx
mov qword [rbp + 0x150], rax
mov edx, dword [0x1401d35fe]
mov edx, edx
neg rdx
lea rcx, [fcn.14002e96e]
lea rdx, [rcx + rdx]
mov qword [rbp + 0x158], rdx
mov qword [rbp + 0x160], rax
lea rax, [rbp + 0x1a8]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
cmp rax, 0x18
jne 0x1401821c4
jmp fcn.140175f0a
mov dword [rbp + 0x178], 7
mov dword [rbp + 0x144], 0xff
jmp fcn.140181cb9
mov rax, qword [0x14017e358]
mov rdx, qword [rbp + 0x160]
add rdx, qword [0x14000ec78]
mov qword [rbp + rdx*8 + 0x1a0], rax
mov eax, dword [0x14000b94d]
test eax, eax
jne 0x14000ee12
jmp 0x14017e5a8

Function at 0x1400417d4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140041538
Function at 0x1400461fc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140045eb8
call fcn.1400390e8
mov dword [rax], 0x16
call fcn.140033474
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140045ea0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140045ea0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140045eea
lock or dword [rax + 0x14], 0x10
jmp 0x140045ea0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140045f07
mov rcx, qword [rbp + 0x10]
call fcn.1400465f0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140044914
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400488cc
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140045f5e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140045ea0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140045fca
mov rcx, qword [rbp + 0x10]
call fcn.140044914
cmp eax, 0xffffffff
je 0x140045fb1
mov rcx, qword [rbp + 0x10]
call fcn.140044914
cmp eax, 0xfffffffe
je 0x140045fb1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140044914
movsxd rdi, eax
lea rsi, [0x1400a15a0]
mov rcx, rbx
sar rdi, 6
call fcn.140044914
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140045fb8
lea rax, [0x14008d9f0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140045fca
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140046000
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140045ffc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140045ffc
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140045ea3
jmp 0x140045e70
Function at 0x140046204
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14004606a
call fcn.1400390e8
mov dword [rax], 0x16
call fcn.140033474
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14004604c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14004604c
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x14004609c
lock or dword [rax + 0x14], 0x10
jmp 0x14004604c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400460b9
mov rcx, qword [rbp + 0x20]
call fcn.1400465f0
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1400460ce
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1400460d4
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140044914
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400488cc
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x140046127
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x14004604c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140046193
mov rcx, qword [rbp + 0x20]
call fcn.140044914
cmp eax, 0xffffffff
je 0x14004617a
mov rcx, qword [rbp + 0x20]
call fcn.140044914
cmp eax, 0xfffffffe
je 0x14004617a
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140044914
movsxd rdi, eax
lea r15, [0x1400a15a0]
mov rcx, rbx
sar rdi, 6
call fcn.140044914
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x140046181
lea rax, [0x14008d9f0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140046193
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1400461c9
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400461c5
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400461c5
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1400461e7
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1400461f2
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x140046051
jmp 0x140046018
Function at 0x140174e2f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [0x140001399]
mov dword [0x14000f9a9], eax
mov rax, qword [rbp + 0x28]
add rax, qword [0x1401d3e67]
mov rdx, qword [0x140179449]
mov qword [rbp + rax*8 + 0x70], rdx
lea rsp, [rbp + 0x60]
pop rbp
ret
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x70], rcx
xor eax, eax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 8], rax
mov dword [rbp + 0x54], 0
mov edx, dword [0x1401c6aba]
mov edx, edx
neg rdx
lea rcx, [fcn.140174e2f]
lea rdx, [rcx + rdx]
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x78]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
cmp rax, 0x18
jne 0x140175d54
jmp 0x1401a8f2b
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rax, rdx
jne 0x1401f8884
jmp 0x1401808b0
mov rax, qword [rbp + 0x28]
add rax, qword [0x14017e714]
mov rdx, qword [0x14018eb35]
mov qword [rbp + rax*8 + 0x70], rdx
lea rax, [0x1400100af]
lea rdx, [0x14000b09a]
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x40], rcx
mov rcx, rax
mov r8d, 6
mov rax, qword [rbp + 0x40]
mov r9, rax
call fcn.1401d46b8
jmp 0x1401d3787
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
test eax, eax
je 0x1400015a8
jmp 0x1401ca1f5
mov rax, qword [rbp + 0x38]
mov byte [rax], 0
add qword [rbp + 0x38], 1
mov rax, qword [rbp + 0x38]
movzx eax, byte [rax]
movsx rax, al
test eax, eax
jne 0x14017b448
jmp 0x1401c7fb5
mov rax, qword [rbp + 0x28]
add rax, qword [0x140006361]
mov rdx, qword [0x14000ba48]
mov qword [rbp + rax*8 + 0x70], rdx
lea rax, [rbp + 0x48]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
movzx eax, byte [rax]
movsx rax, al
test eax, eax
je 0x1401c7fb5
jmp 0x14017b448
mov qword [rbp + 0x28], 1
jmp 0x140175d54
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
movzx eax, al
test eax, eax
je 0x140175b1b
jmp 0x1401f1b0a
mov eax, dword [rbp + 0x54]
test eax, eax
je 0x1401f3a1b
jmp 0x14002cdd1
lea rsp, [rbp + 0x60]
pop rbp
ret
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 8]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
cmp rax, rdx
je 0x1401808b0
jmp 0x1401f8884
add dword [rbp + 0x54], 1
jmp 0x1401808b0
mov rax, qword [rbp + 0x20]
lea rdx, [rbp + 0x70]
mov rcx, rax
call fcn.1401821f4
jmp 0x14017afed
mov rax, qword [rbp + 0x10]
add rax, 0x58
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.14002fb12
jmp 0x1401a9b7d
Function at 0x1401753de
Capabilities:
Check for peb beingdebugged flag
Encode data using xor

Disassembly:
mov dword [rbp + 0x170], 7
mov dword [rbp + 0x13c], 0xff
jmp fcn.1401f93ac
mov rax, qword [0x1401ca71a]
mov rdx, qword [rbp + 0x158]
add rdx, qword [0x1401c8dfc]
mov qword [rbp + rdx*8 + 0x190], rax
mov eax, dword [0x140052d45]
test eax, eax
jne 0x1401c8b42
jmp 0x14002dcb5
push rbp
sub rsp, 0x1b0
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x168], rbx
mov qword [rbp + 0x190], rcx
xor eax, eax
mov qword [rbp + 0x140], rax
xor edx, edx
mov dword [rbp + 0x178], edx
mov dword [rbp + 0x17c], edx
mov qword [rbp + 0x148], rax
mov edx, dword [0x140189d4a]
mov edx, edx
neg rdx
lea rcx, [fcn.1401753de]
lea rdx, [rcx + rdx]
mov qword [rbp + 0x150], rdx
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x198]
mov qword [rbp + 0x160], rax
mov rax, qword [rbp + 0x160]
mov rax, qword [rax]
cmp rax, 0x18
jne 0x14002ec12
jmp 0x1401a9c8b
mov eax, dword [0x140024987]
mov dword [0x14018ead8], eax
mov rax, qword [0x140189e6a]
mov rdx, qword [rbp + 0x158]
add rdx, qword [0x14017a5fe]
mov qword [rbp + rdx*8 + 0x190], rax
mov rbx, qword [rbp + 0x168]
lea rsp, [rbp + 0x180]
pop rbp
ret
mov qword [rbp + 0x158], 1
jmp 0x14002ec12
mov rbx, qword [rbp + 0x168]
lea rsp, [rbp + 0x180]
pop rbp
ret
mov eax, dword [0x140052d45]
test eax, eax
je 0x1401f88ae
jmp 0x1401d3d65
mov eax, dword [0x140052d45]
cmp eax, 0xff
ja 0x1401f88ae
jmp loc.14002e2b8
mov dword [rbp + 0x174], eax
mov eax, dword [rbp + 0x174]
test eax, eax
je 0x140180f8b
jmp 0x1401c8572
mov rax, qword [0x14018ef6d]
mov rdx, qword [rbp + 0x158]
add rdx, qword [0x1400a65f8]
mov qword [rbp + rdx*8 + 0x190], rax
mov rax, qword [rbp + 0x150]
lea rdx, [rbp + 0x190]
mov rcx, rax
call fcn.14002d45d
jmp 0x1401f33d8

Function at 0x140175e70
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0x28], 0
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov rax, qword [rax]
cmp rax, 0x18
jne fcn.140177ef2
jmp loc.14001fa13

Function at 0x14017f8dd
Capabilities:
Write file on windows

Disassembly:
call fcn.1401c8a23
jmp fcn.140002cb5
Function at 0x14018efbe
Capabilities:
Read file on windows

Disassembly:
jmp fcn.140048b31
call fcn.1401f4e33
jmp 0x140189d67

Function at 0x1401cb131
Capabilities:
Get common file path

Disassembly:
add rdi, 0xfffffffffffffff8
jmp 0x1401d4216
lea rsp, [rsp - 8]
jmp loc.14000779a
mov rsp, rax
mov qword [rsp], rdi
jmp 0x14018efd2
mov rax, rsp
add rax, 0xfffffffffffffff8
jmp 0x14017e344
lea rsp, [rsp - 8]
mov qword [rsp], r13
mov rdi, rsp
jmp 0x14017787a
mov qword [rsp], r15
jmp 0x1401f38d1
mov rax, qword [0x14008d598]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x18], 0
jmp 0x140179f98
mov rsp, rdi
jmp 0x1401c6066
sub rsp, 0x60
jmp 0x1401cb131

Function at 0x1401d4ae8
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x20]
mov dword [rbp + 0x10], 0x40
mov dword [rbp + 0x14], 0x9e3779b9
lea rax, [0x14017a1fa]
mov qword [rbp], rax
lea rax, [0x140008522]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov eax, dword [rax]
mov dword [rbp + 0x18], eax
mov rax, qword [rbp + 8]
mov eax, dword [rax + 4]
mov dword [rbp + 0x1c], eax
xor eax, eax
mov dword [rbp + 0x20], eax
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov edx, dword [rbp + 0x10]
cmp eax, edx
jae fcn.140176646
jmp loc.14002db17