joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000865c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
mov edx, 4
mov dword [rbp - 0x20], 0x27203b68
mov dword [rbp - 0x1c], 0x3d2b3c3a
mov rcx, qword [rax + rcx*8]
mov word [rbp - 0x18], 0x683c
mov eax, dword [rdx + rcx]
cmp dword [0x14007191c], eax
jg 0x1400086c3
lea rax, [0x140071910]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x40
pop rbp
ret
lea rcx, [0x14007191c]
call fcn.140030350
cmp dword [0x14007191c], 0xffffffff
jne 0x1400086aa
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x140055d5c]
movzx eax, word [rbp - 0x18]
movsd qword [0x140071910], xmm0
mov word [0x140071918], ax
mov byte [0x14007191a], 0x48
call fcn.14002ff44
lea rcx, [0x14007191c]
call fcn.1400302f0
jmp 0x1400086aa

Function at 0x140008714
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
mov edx, 4
mov dword [rbp - 0x20], 0x2b3a2126
mov dword [rbp - 0x1c], 0x662b2c25
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x18], 0x482d302d
mov eax, dword [rdx + rcx]
cmp dword [0x1400715c4], eax
jg 0x14000877c
lea rax, [0x1400713b0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x40
pop rbp
ret
lea rcx, [0x1400715c4]
call fcn.140030350
cmp dword [0x1400715c4], 0xffffffff
jne 0x140008763
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x140055d74]
mov eax, dword [rbp - 0x18]
movsd qword [0x1400713b0], xmm0
mov dword [0x1400713b8], eax
call fcn.14002ff44
lea rcx, [0x1400715c4]
call fcn.1400302f0
jmp 0x140008763

Function at 0x1400089e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
movdqa xmm0, xmmword [0x140059210]
movdqa xmm1, xmmword [0x1400594b0]
mov ecx, dword [0x140072818]
mov r8d, 4
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [str.__:_]
mov rdx, qword [rax + rcx*8]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140059390]
movdqa xmmword [rbp - 0x40], xmm0
mov eax, dword [r8 + rdx]
cmp dword [0x140071a50], eax
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0x27213b3a
mov dword [rbp - 0x1c], 0x3d1a1426
mov dword [rbp - 0x18], 0x3e676826
mov word [rbp - 0x14], 0x4868
jg 0x140008a8a
lea rax, [0x140071a00]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x80
pop rbp
ret
lea rcx, [0x140071a50]
call fcn.140030350
cmp dword [0x140071a50], 0xffffffff
jne 0x140008a6e
lea rdx, [rbp - 0x60]
lea rcx, [0x140071a00]
call fcn.1400059f4
lea rcx, [0x140055dc8]
call fcn.14002ff44
lea rcx, [0x140071a50]
call fcn.1400302f0
jmp 0x140008a6e
Function at 0x140008acc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
mov edx, 4
mov dword [rbp - 0x20], 0x2a2e2d38
mov dword [rbp - 0x1c], 0x26272617
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x18], 0x32663a21
mov word [rbp - 0x14], 0x3821
mov eax, dword [rdx + rcx]
cmp dword [0x140071560], eax
jg 0x140008b3a
lea rax, [0x140070920]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x40
pop rbp
ret
lea rcx, [0x140071560]
call fcn.140030350
cmp dword [0x140071560], 0xffffffff
jne 0x140008b21
mov eax, dword [rbp - 0x18]
lea rcx, [0x140055e00]
movsd xmm0, qword [rbp - 0x20]
mov dword [0x140070928], eax
movzx eax, word [rbp - 0x14]
mov word [0x14007092c], ax
movsd qword [0x140070920], xmm0
mov byte [0x14007092e], 0x48
call fcn.14002ff44
lea rcx, [0x140071560]
call fcn.1400302f0
jmp 0x140008b21

Function at 0x14000912c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
movdqa xmm6, xmmword [0x140059420]
mov edx, 4
mov dword [rbp - 0x30], 0x3c3b3a39
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x2c], 0x303f3e3d
mov word [rbp - 0x28], 0x3231
mov eax, dword [rdx + rcx]
cmp dword [0x140071794], eax
jg 0x1400091a5
lea rax, [0x140071778]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140030560
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
lea rcx, [0x140071794]
call fcn.140030350
cmp dword [0x140071794], 0xffffffff
jne 0x140009187
movsd xmm0, qword [rbp - 0x30]
lea rcx, [0x140055ed8]
movzx eax, word [rbp - 0x28]
movsd qword [0x140071788], xmm0
mov word [0x140071790], ax
movups xmmword [0x140071778], xmm6
mov byte [0x140071792], 0x48
call fcn.14002ff44
lea rcx, [0x140071794]
call fcn.1400302f0
jmp 0x140009187

Function at 0x14000959c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
movdqa xmm6, xmmword [0x140059370]
mov edx, 4
mov dword [rbp - 0x30], 0x21243838
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x2c], 0x213c292b
mov dword [rbp - 0x28], 0x483b2627
mov eax, dword [rdx + rcx]
cmp dword [0x140071814], eax
jg 0x140009616
lea rax, [0x1400717f8]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140030560
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
lea rcx, [0x140071814]
call fcn.140030350
cmp dword [0x140071814], 0xffffffff
jne 0x1400095f8
movsd xmm0, qword [rbp - 0x30]
lea rcx, [0x140055f70]
mov eax, dword [rbp - 0x28]
movsd qword [0x140071808], xmm0
movups xmmword [0x1400717f8], xmm6
mov dword [0x140071810], eax
call fcn.14002ff44
lea rcx, [0x140071814]
call fcn.1400302f0
jmp 0x1400095f8
Function at 0x1400097bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
mov edx, 4
mov dword [rbp - 0x20], 0x1814720b
mov dword [rbp - 0x1c], 0x3a2f273a
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x18], 0x290c2529
mov word [rbp - 0x14], 0x293c
mov eax, dword [rdx + rcx]
cmp dword [0x140071b20], eax
jg 0x14000982a
lea rax, [0x140071b10]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x40
pop rbp
ret
lea rcx, [0x140071b20]
call fcn.140030350
cmp dword [0x140071b20], 0xffffffff
jne 0x140009811
mov eax, dword [rbp - 0x18]
lea rcx, [0x140055fbc]
movsd xmm0, qword [rbp - 0x20]
mov dword [0x140071b18], eax
movzx eax, word [rbp - 0x14]
mov word [0x140071b1c], ax
movsd qword [0x140071b10], xmm0
mov byte [0x140071b1e], 0x48
call fcn.14002ff44
lea rcx, [0x140071b20]
call fcn.1400302f0
jmp 0x140009811

Function at 0x14000a05c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
mov edx, 4
mov dword [rbp - 0x20], 0x2c2d3b25
mov dword [rbp - 0x1c], 0x2d662d2f
mov rcx, qword [rax + rcx*8]
mov word [rbp - 0x18], 0x2d30
mov eax, dword [rdx + rcx]
cmp dword [0x140071ac4], eax
jg 0x14000a0c3
lea rax, [0x140071ab8]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x40
pop rbp
ret
lea rcx, [0x140071ac4]
call fcn.140030350
cmp dword [0x140071ac4], 0xffffffff
jne 0x14000a0aa
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x1400560fc]
movzx eax, word [rbp - 0x18]
movsd qword [0x140071ab8], xmm0
mov word [0x140071ac0], ax
mov byte [0x140071ac2], 0x48
call fcn.14002ff44
lea rcx, [0x140071ac4]
call fcn.1400302f0
jmp 0x14000a0aa

Function at 0x14000a694
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword gs:[0x58]
movdqa xmm0, xmmword [0x1400592e0]
movdqa xmm1, xmmword [0x1400595a0]
mov ecx, dword [0x140072818]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x140059220]
mov r8d, 4
mov rdx, qword [rax + rcx*8]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [str.___:zh]
movdqa xmmword [rbp + 7], xmm0
mov eax, dword [r8 + rdx]
cmp dword [0x1400716f0], eax
movdqa xmm0, xmmword [0x1400594a0]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmmword [rbp + 0x27], xmm0
mov dword [rbp + 0x37], 0x3b212c68
mov dword [rbp + 0x3b], 0x31292438
mov dword [rbp + 0x3f], 0x2d252906
mov byte [rbp + 0x43], 0x48
jg 0x14000a74b
lea rax, [0x140071690]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140030560
add rsp, 0x90
pop rbp
ret
lea rcx, [0x1400716f0]
call fcn.140030350
cmp dword [0x1400716f0], 0xffffffff
jne 0x14000a72f
lea rdx, [rbp - 0x19]
lea rcx, [0x140071690]
call fcn.140005ad0
lea rcx, [0x1400561b8]
call fcn.14002ff44
lea rcx, [0x1400716f0]
call fcn.1400302f0
jmp 0x14000a72f
Function at 0x14000b384
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
mov edx, 4
mov dword [rbp - 0x20], 0x3b302925
mov dword [rbp - 0x1c], 0x3a3d2b2d
mov rcx, qword [rax + rcx*8]
mov word [rbp - 0x18], 0x482d
mov eax, dword [rdx + rcx]
cmp dword [0x14007173c], eax
jg 0x14000b3eb
lea rax, [0x140071730]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x40
pop rbp
ret
lea rcx, [0x14007173c]
call fcn.140030350
cmp dword [0x14007173c], 0xffffffff
jne 0x14000b3d2
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x140056330]
movzx eax, word [rbp - 0x18]
movsd qword [0x140071730], xmm0
mov word [0x140071738], ax
call fcn.14002ff44
lea rcx, [0x14007173c]
call fcn.1400302f0
jmp 0x14000b3d2

Function at 0x14000b77c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
movdqa xmm6, xmmword [0x1400595d0]
mov edx, 4
mov dword [rbp - 0x30], 0x78686435
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x2c], 0x292e6864
mov dword [rbp - 0x28], 0x482d3b24
mov eax, dword [rdx + rcx]
cmp dword [0x1400718e4], eax
jg 0x14000b7f6
lea rax, [0x1400718c8]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140030560
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
lea rcx, [0x1400718e4]
call fcn.140030350
cmp dword [0x1400718e4], 0xffffffff
jne 0x14000b7d8
movsd xmm0, qword [rbp - 0x30]
lea rcx, [0x1400563a8]
mov eax, dword [rbp - 0x28]
movsd qword [0x1400718d8], xmm0
movups xmmword [0x1400718c8], xmm6
mov dword [0x1400718e0], eax
call fcn.14002ff44
lea rcx, [0x1400718e4]
call fcn.1400302f0
jmp 0x14000b7d8

Function at 0x14000ba40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x14000ba93
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14000ba58
jmp 0x14000baa0
cmp dword [rcx], 0x4e0
jb 0x14000baa0
call fcn.14000d220
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x14000bf50
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rcx
mov rdi, r9
xor ecx, ecx
mov rsi, r8
mov rbp, rdx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x140059610]
mov qword [rsp + 0x20], rax
lea rcx, [0x140059620]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14000c036
mov rcx, qword [rsp + 0x30]
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x140059600]
mov rax, qword [rcx]
call qword [rax]
mov ebx, eax
test eax, eax
js 0x14000c02b
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov rdx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14000c05c
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x14000c086
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
jne 0x14000c086
mov al, 1
jmp 0x14000c088
xor al, al
add rsp, 0x28
ret
Function at 0x14000cabc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000cb2b
cmp byte [rcx + 0x71], 0
je 0x14000cb2b
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000cb7f
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14000cb45
sub eax, 1
je 0x14000cb49
cmp eax, 2
jne 0x14000cb7f
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140030560
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000cb76
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140039600
cmp rdi, rax
jne 0x14000cb7f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000cb2d
xor al, al
jmp 0x14000cb2d

Function at 0x14000d220
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov eax, dword [r10]
mov r11d, 0xe3
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x14000d233
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x14000d27e
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
ret
Function at 0x14000e6e8
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
lea r9d, [rdx + 2]
mov esi, edx
mov r15, rcx
mov r10d, 0x55555556
mov eax, r10d
xor ebx, ebx
imul r9d
mov eax, r10d
xor r14d, r14d
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
lea ecx, [rdx + rdx*2]
sub r9d, ecx
mov ecx, esi
sub ecx, r9d
lea ecx, [rcx*4 + 8]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
movsxd r12, edx
lea rcx, [r12 + 1]
call fcn.140036d2c
mov rdi, rax
test rax, rax
je 0x14000e8ab
test esi, esi
je 0x14000e8a3
xor ecx, ecx
lea r13, [0x140058ab0]
xor r11d, r11d
lea edx, [rcx + 3]
mov al, byte [r15]
dec esi
mov byte [rbp + rcx + 0x48], al
inc ebx
mov r10b, byte [rbp + 0x4a]
inc rcx
mov r8b, byte [rbp + 0x49]
inc r15
mov r9b, byte [rbp + 0x48]
cmp rcx, rdx
jne 0x14000e7ee
mov cl, r9b
mov al, r9b
shr al, 2
and cl, dl
shl cl, 4
mov byte [rbp + 0x50], al
mov al, r8b
shr al, 4
add cl, al
mov al, r10b
mov byte [rbp + 0x51], cl
mov cl, r8b
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, r10b
and al, 0x3f
mov byte [rbp + 0x52], cl
xor ecx, ecx
mov byte [rbp + 0x53], al
add r14d, 4
movzx eax, byte [rbp + rcx + 0x50]
inc rcx
mov al, byte [rax + r13]
mov byte [r11 + rdi], al
inc r11
cmp rcx, 4
jl 0x14000e7d1
xor ebx, ebx
xor ecx, ecx
test esi, esi
jne 0x14000e771
test ebx, ebx
je 0x14000e8a3
movsxd rax, ebx
cmp rax, rdx
jge 0x14000e825
jae 0x14000e8c0
mov byte [rbp + rax + 0x48], 0
inc rax
cmp rax, rdx
jl 0x14000e806
mov r10b, byte [rbp + 0x4a]
mov r8b, byte [rbp + 0x49]
mov r9b, byte [rbp + 0x48]
mov al, r9b
and r9b, dl
shr al, 2
mov byte [rbp + 0x50], al
mov al, r8b
shr al, 4
and r8b, 0xf
shl r9b, 4
add r9b, al
shl r8b, 2
mov al, r10b
mov byte [rbp + 0x51], r9b
and r10b, 0x3f
shr al, 6
add r8b, al
mov byte [rbp + 0x53], r10b
lea r9d, [rbx + 1]
mov byte [rbp + 0x52], r8b
movsxd r10, r9d
test r9d, r9d
jle 0x14000e88d
movsxd r8, r14d
xor ecx, ecx
add r8, rdi
add r14d, r9d
movzx eax, byte [rbp + rcx + 0x50]
inc rcx
mov al, byte [rax + r13]
mov byte [r8], al
inc r8
cmp rcx, r10
jl 0x14000e876
cmp ebx, edx
jge 0x14000e8a3
sub edx, ebx
movsxd rcx, r14d
mov r8d, edx
add rcx, rdi
mov dl, 0x3d
call fcn.1400313e0
mov byte [r12 + rdi], 0
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140030064
int3
Function at 0x14000e8c8
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
and qword [rcx + 0x10], 0
xor edi, edi
mov qword [rcx + 0x18], 0xf
mov rbx, rcx
mov byte [rcx], 0
mov rsi, rdx
cmp qword [rdx + 0x18], 0x10
lea ebp, [rdi - 6]
jb 0x14000e909
mov rsi, qword [rdx]
mov rcx, rdx
jb 0x14000e911
mov rcx, qword [rdx]
mov r12, qword [rdx + 0x10]
add r12, rcx
cmp rsi, r12
je 0x14000ea2d
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx eax, byte [rsi]
shl edi, 8
add edi, eax
add ebp, 8
js 0x14000e9aa
lea ecx, [rbp + 6]
movsxd r14, ebp
mov eax, 0xaaaaaaab
movsxd r13, edi
mul ecx
shr edx, 2
imul eax, edx, 0xfffffffa
mov r15d, edx
add ebp, eax
mov rcx, r14
mov rax, r13
sar rax, cl
mov rcx, qword [rbx + 0x10]
and eax, 0x3f
mov r9b, byte [rax + r8]
cmp rcx, qword [rbx + 0x18]
jae 0x14000e98a
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x14000e97f
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000e9a0
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140004690
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub r14, 6
sub r15, 1
jne 0x14000e950
inc rsi
cmp rsi, r12
jne 0x14000e928
cmp ebp, 0xfffffffa
jle 0x14000ea2d
shl edi, 8
lea ecx, [rbp + 8]
movsxd rdx, edi
sar rdx, cl
mov rcx, qword [rbx + 0x10]
and edx, 0x3f
mov r9b, byte [rdx + r8]
cmp rcx, qword [rbx + 0x18]
jae 0x14000ea1e
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x14000e9ed
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000ea2d
cmp rcx, qword [rbx + 0x18]
jae 0x14000ea1b
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x14000ea13
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x14000ea2d
mov r9b, 0x3d
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140004690
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x14000e9f8
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140010198
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400287a4
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, qword [rsp + 0x38]
xor esi, esi
test eax, eax
setne dil
cmp rdx, 8
jb 0x140010204
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
call fcn.1400038b4
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], si
cmp rdx, 0x10
jb 0x14001022c
mov rcx, qword [rbx]
inc rdx
call fcn.1400038b4
mov qword [rbx + 0x10], rsi
mov al, dil
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140030560
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140010af0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
xorps xmm0, xmm0
mov rdx, rcx
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.14000c9e8
lea rcx, [rbp - 0x30]
call fcn.14001e048
xor esi, esi
test al, al
je 0x140010c2e
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.1400287a4
cmp qword [rbp - 0x18], 8
lea rcx, [rbp - 0x30]
cmovae rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp - 0x18]
test eax, eax
je 0x140010ba5
cmp rdx, 8
jb 0x140010b79
mov rcx, qword [rbp - 0x30]
lea rdx, [rdx*2 + 2]
call fcn.1400038b4
mov rdx, qword [rbx + 0x18]
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], si
cmp rdx, 0x10
jb 0x140010b9e
mov rcx, qword [rbx]
inc rdx
call fcn.1400038b4
mov eax, esi
jmp 0x140010c66
cmp rdx, 8
jb 0x140010be1
mov rcx, qword [rbp - 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010bdc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010c91
call fcn.14002fcfc
mov rdx, qword [rbx + 0x18]
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], si
cmp rdx, 0x10
jb 0x140010c27
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140010c22
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010c91
mov rcx, r8
call fcn.14002fcfc
mov eax, 1
jmp 0x140010c66
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140010c64
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140010c5f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010c97
mov rcx, r8
call fcn.14002fcfc
xor eax, eax
mov byte [rbx], sil
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
call fcn.1400360bc
int3
call fcn.1400360bc
int3