joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006b580
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r9, qword [rcx]
mov r10, rcx
mov rdx, qword [0x14024b290]
movabs rdi, 0x22aaaa8a20000
mov r8, rdx
mov rax, rdx
shl rax, 0x11
movabs rbx, 0x71d67fffeda60000
shr r8, 0xc
movabs r11, 0x555555555
and r8, rdi
xor r8, rax
mov rax, rdx
shr rax, 0x1d
and r8, rbx
and rax, r11
xor r8, rax
xor r8, rdx
mov rcx, r8
mov rax, r8
shr rax, 0x25
and ecx, 0x7ffbf40
xor rcx, rax
mov rax, r8
and rax, 0xffffffffffffbf77
shr rcx, 6
shl rax, 0x25
xor rcx, rax
xor rcx, r9
xor rcx, r8
xor qword [r10 + 8], rcx
mov rcx, qword [0x14024b298]
mov rdx, rcx
mov rax, rcx
shl rax, 0x11
shr rdx, 0xc
and rdx, rdi
xor rdx, rax
mov rax, rcx
shr rax, 0x1d
and rdx, rbx
and rax, r11
xor rdx, rax
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rax, 0x25
and ecx, 0x7ffbf40
xor rcx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shr rcx, 6
shl rax, 0x25
xor rcx, rax
lea rax, [r9 + 0x10]
xor rcx, rax
xor rcx, rdx
xor qword [r10 + 0x10], rcx
mov rcx, qword [0x14024b2a0]
mov rdx, rcx
mov rax, rcx
shl rax, 0x11
shr rdx, 0xc
and rdx, rdi
xor rdx, rax
mov rax, rcx
shr rax, 0x1d
and rdx, rbx
and rax, r11
xor rdx, rax
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rax, 0x25
and ecx, 0x7ffbf40
xor rcx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shr rcx, 6
shl rax, 0x25
xor rcx, rax
lea rax, [r9 + 0x20]
xor rcx, rax
xor rcx, qword [r10 + 0x18]
xor rcx, rdx
mov qword [r10 + 0x18], rcx
mov rcx, qword [0x14024b2a8]
mov rdx, rcx
mov rax, rcx
shl rax, 0x11
shr rdx, 0xc
and rdx, rdi
xor rdx, rax
mov rax, rcx
shr rax, 0x1d
and rdx, rbx
and rax, r11
xor rdx, rax
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rax, 0x25
and ecx, 0x7ffbf40
xor rcx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shr rcx, 6
shl rax, 0x25
xor rcx, rax
lea rax, [r9 + 0x30]
xor rcx, rax
xor rcx, qword [r10 + 0x20]
xor rcx, rdx
mov qword [r10 + 0x20], rcx
mov rcx, qword [0x14024b2b0]
mov rdx, rcx
mov rax, rcx
shl rax, 0x11
shr rdx, 0xc
and rdx, rdi
mov rdi, qword [rsp + 0x10]
xor rdx, rax
mov rax, rcx
shr rax, 0x1d
and rdx, rbx
mov rbx, qword [rsp + 8]
and rax, r11
xor rdx, rax
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
and ecx, 0x7ffbf40
shr rax, 0x25
xor rcx, rax
mov rax, rdx
shr rcx, 6
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
lea rax, [r9 + 0x40]
xor rcx, rax
xor rcx, qword [r10 + 0x28]
xor rcx, rdx
mov qword [r10 + 0x28], rcx
ret
Function at 0x14006bf10
Capabilities:
Create service
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x14006c0a4
mov r8, qword [rbx]
xor eax, eax
xor ebx, ebx
mov qword [rsp + 0xa0], rsi
mov edx, ebx
mov dword [rbp + 0x37], 0x9c928284
mov dword [rbp + 0x3b], 0xc29b819f
mov byte [rbp + 0x3f], al
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0x37]
add rcx, rax
lea eax, [rdx - 0x17]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x14006bf70
xor eax, eax
mov byte [rbp + 0x3f], bl
mov byte [rbp + 0x48], al
mov edx, ebx
mov dword [rbp + 0x40], 0x9c928284
mov dword [rbp + 0x44], 0xc29b819f
nop
movsxd rax, edx
lea rcx, [rbp + 0x40]
add rcx, rax
lea eax, [rdx - 0x17]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x14006bfa0
mov qword [rsp + 0x60], rbx
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x58], rbx
mov r9d, 0x10030
mov qword [rsp + 0x50], rbx
mov rcx, rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
lea r8, [rbp + 0x37]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
mov byte [rbp + 0x48], bl
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14006c038
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, rsi
mov rsi, qword [rsp + 0xa0]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x14006c08f
xor eax, eax
mov dword [rbp + 0x40], 0x9c928284
mov byte [rbp + 0x48], al
mov dword [rbp + 0x44], 0xc29b819f
nop dword [rax + rax]
movsxd rax, ebx
lea rcx, [rbp + 0x40]
add rcx, rax
lea eax, [rbx - 0x17]
inc ebx
xor byte [rcx], al
cmp ebx, 8
jb 0x14006c060
mov r8d, 0x10030
mov byte [rbp + 0x48], 0
lea rdx, [rbp + 0x40]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
jmp 0x14006c01b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, 0xffffffffffffffff
jmp 0x14006c01b
mov rax, 0xffffffffffffffff
jmp 0x14006c023
Function at 0x14006d010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x7d0]
sub rsp, 0x8d0
movsxd r14, ecx
call fcn.140018200
cmp byte [rax], 0
je 0x14006d19a
call fcn.140068d10
xor ebx, ebx
cmp qword [0x14024af40], rbx
jne 0x14006d13b
mov dword [rsp + 0x20], 0x9f849e87
mov dword [rsp + 0x24], 0x9c819c86
mov dword [rsp + 0x28], 0x918b97df
xor eax, eax
mov byte [rsp + 0x2c], al
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x20]
add rcx, rax
lea eax, [rdx - 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x14006d080
mov byte [rsp + 0x2c], bl
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14006d0c0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14000b740
nop
lea rcx, [rsp + 0x30]
call fcn.140068b30
mov qword [0x14024af40], rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14006d128
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006d123
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006d252
call fcn.14006ef8c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov ecx, r14d
call fcn.140068910
mov rsi, rax
add rsi, qword [0x14024af28]
mov edx, 0xc
lea ecx, [rdx - 0xb]
call fcn.1400758d8
mov rdi, rax
test rax, rax
je 0x14006d18b
mov qword [rax], rsi
mov edx, 8
mov dword [rax + 8], edx
lea r8d, [rdx + 4]
mov rdx, rax
mov ecx, 0x83064000
call fcn.14006aee0
test al, al
je 0x14006d18b
cmp dword [rdi], 0
jne 0x14006d18b
mov rbx, qword [rdi + 4]
mov qword [0x14024af30], r14
mov rax, rbx
jmp 0x14006d235
mov edx, r14d
lea rcx, [rbp + 0x390]
call fcn.14006ce80
lea rcx, [rsp + 0x50]
mov edx, 8
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14006d1c0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov rax, qword [rsp + 0x68]
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14007eb84
int3
Function at 0x14007ef1c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14006f920
sub rsp, rax
mov rax, qword [0x1400c50a8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14008a818
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14007ef6b
mov rax, rbp
jmp 0x14007f073
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x24a440]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14009026c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x24a440]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14007f06f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007f06f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14009026c
test rax, rax
js 0x14007f06f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14007f06f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14007f061
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14007f061
cmp byte [rcx], 0xd
jne 0x14007f047
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14007f056
cmp byte [rcx + 1], 0xa
jne 0x14007f056
inc rcx
jmp 0x14007f056
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xc54a0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14007f029
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14007f073
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14006f8f0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140087c40
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140087a3c

Function at 0x14008a938
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14008a94e
mov al, 1
jmp 0x14008a9ae
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14008a95f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14008a9ac
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400966b0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008a9ac
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14008a9ac
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14008a9ac
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14008a9ae
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14008f60c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14024a440]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14008f663
cmp word [rdx], r13w
jne 0x14008f663
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14008f668
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14008f78d
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14008f7ae
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14008f6a1
mov rdx, r9
mov word [rbx], cx
jmp 0x14008f6c8
cmp r9, r8
jae 0x14008f6d8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14008f682
jmp 0x14008f78d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008f782
cmp dword [rsp + 0x80], esi
je 0x14008f782
lea r8, [0x14024a440]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14008f75a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14008f72a
mov word [rbx], r13w
jmp 0x14008f78a
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14008f737
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14008f78a
cmp word [rsp + 0x70], r13w
jne 0x14008f767
cmp rbx, r14
je 0x14008f724
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140090274
cmp word [rsp + 0x70], r13w
je 0x14008f78d
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14024a440]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14008f787
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14008f78d
Function at 0x140093084
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400930a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14007d928
or eax, 0xffffffff
jmp 0x1400930a6
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400955b4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14009563b
mov rsi, rbx
cmp word [rax], bp
je 0x1400955fa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400955e4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400955e0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14008c910
mov rdi, rax
test rax, rax
je 0x140095628
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400713e0
mov rbp, rdi
xor ecx, ecx
call fcn.14008c48c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140098c04
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14008adf8
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140098ca5
cmp ebx, dword [rsp + 0x30]
je 0x140098c9e
test esi, esi
je 0x140098c9e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140098c79
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140098c86
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140098c63
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140098c8a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140098ca7
mov eax, 1
jmp 0x140098ca7
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14009dde0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140090274
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140090274
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14009df30
cmp rax, 0xffffffffffffffff
je 0x14009df30
xor edi, edi
test rbp, rbp
jle 0x14009dedb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14008b3cc
mov rbx, rax
test rax, rax
jne 0x14009de68
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14009ded1
mov edx, 0x8000
mov ecx, r14d
call fcn.140088d30
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14008c184
cmp eax, 0xffffffff
je 0x14009deb1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14009de78
mov edx, r15d
mov ecx, r14d
call fcn.140088d30
jmp 0x14009ded1
cmp byte [rsi + 0x38], dil
je 0x14009dec8
cmp dword [rsi + 0x34], 5
jne 0x14009dec8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14009ded1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14008c48c
jmp 0x14009df44
jns 0x14009df44
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140090274
cmp rax, 0xffffffffffffffff
jne 0x14009defc
cmp byte [rsi + 0x30], dil
je 0x14009df44
mov edi, dword [rsi + 0x2c]
jmp 0x14009df44
mov ecx, r14d
call fcn.1400966b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14009df44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14009df44
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14009df3d
mov eax, dword [rsi + 0x2c]
jmp 0x14009df42
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140090274
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14140474f
Capabilities:
Encode data using base64

Disassembly:
jmp 0x141431c8a
jmp 0x141424064

Function at 0x14140701c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
cld
push 0xffffffffb381732b
rol word [rsp], 0x62
rep movsb byte [rdi], byte [rsi]
mov edi, 0x860b713e
dec dil
push qword [rsp + 8]
popfq
call fcn.14143a3a6
mov ebp, 0xd6ac2fad
mov eax, ebp
movsx edx, bpl
sub rdi, 4
mov ecx, dword [rdi + riz]
cwd
neg rax
mov esi, ebp
xor ecx, r9d
movsx r11d, sil
mul sil
ror ebp, 0x5c
inc ecx
xchg r11b, dl
sub ebp, esi
jne 0x14140f595
dec edx
mov qword [rsp + r11 - 0x3d9f41b4], rax
movsxd rbp, ebp
jne 0x141419201
add rbx, rbp
push r10
btc ecx, r10d
inc r10w
mov qword [rsp + rdx*2], rbx
ret 0x18
pop rsi
pushfq
mov esi, edi
mov rsi, rax
ror di, 0x63
mov rdi, rbp
jb 0x141405fed
mov r10d, 0x7906cf31
movsx ecx, r10b
jmp 0x14140a464
lea rdi, [rdi + r10 - 0x7906cf35]
mov r10d, dword [rcx + rdi - 0x31]
mov r11d, ecx
movzx ebp, r11b
xor r10d, r9d
lea r11, [rcx*4 - 0x63f7e9d7]
shr r11, cl
sbb r10d, 0x98a4201e
not r10d
movzx edx, cx
btc dx, 0xa2
mov esi, 0x4e1ae305
xor r10d, 0x312a6fa0
and cx, cx
lea r11, [rsi*8 - 0x34d586d8]
inc bpl
not r10d
neg r10d
sar ecx, cl
seta sil
or rsi, r11
adc r10d, 0xa53b4c05
push r9
call fcn.1414371b3

Function at 0x141408acd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
ror ax, 9
lea rdi, [rdi + r10*2 - 0x1459af41]
or sil, al
movzx ebp, byte [rdi + r10*4 - 0x28b35e80]
mov qword [rsp + r10 - 0xa2cd7a0], rdx
sbb dx, word [rsp + r10 - 0xa2cd79f]
neg r11b
xor bpl, r9b
ror rax, 0xd6
pop rsi
sbb bpl, 0x3d
shr r11, 0x9b
sar rdx, 0x6a
sar si, 0xc1
neg bpl
not esi
sar eax, 0x42
ror r10b, 0x21
xor bpl, 0xbd
add bpl, dl
push rsi
neg bpl
rol al, 0xc7
not byte [rsp + r10 - 0xa2cd74d]
inc rsi
xor bpl, 0x18
or si, r11w
not rdx
xor r9b, bpl
idiv ax
jmp 0x14140700c

Function at 0x14140d69f
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jne 0x141411db3
mov rdx, rax
jmp 0x141420c4a
call fcn.141419c99
mov esi, 0x6799709d
lea rdi, [rsi + rdi - 0x679970a1]
mov ebp, esi
mov r11d, dword [rdi + rbp - 0x6799709d]
movzx edx, sil
lea rax, [rdx + rsi - 0x59e688f4]
movzx r10d, dx
xor r11d, r9d
not r11d
neg al
dec r11d
dec bpl
sar bp, 0xa3
not r11d
cwde
movsx ecx, r10b
div ax
rol r11d, 1
push r9
xor dword [rsp + rbp - 0x67990e13], r11d
xor rax, 0x5005e59c
movzx r9d, bpl
rol sil, 0x81
pop r9
not sil
movsxd r11, r11d
add rbx, r11
dec rax
xor rbp, r10
ror r10d, cl
mov rsi, qword [rdx + r8 - 0xa308]
bswap eax
movzx r11d, dl
adc rdx, rbp
mov r11, qword [r8 + rbp - 0x67990e86]
lea r8, [r8 + rbp - 0x67990e7e]
bts edx, 0x8e
cwd
mov qword [rbp + rsi - 0x67990e8e], r11
xchg bpl, cl
btr cx, 0x85
jmp rbx
push 0x221ce70a
cmp ebx, 3
push 0xffffffffd43dd936
push 0xffffffff9cac2699
lea rsp, [rsp + 0x18]
jne 0x14141f056
mov r8d, 0x3b2252aa
mov r8, rax
jmp 0x141424e66
jmp 0x14140f6a1
Function at 0x1414168d4
Capabilities:
Encode data using base64

Disassembly:
shr edx, 0x9f
lea r10, [rsp + r10 + 8]
pop rax
btr r11d, 0x3a
movzx bp, byte [r10 + rdx*4 - 4]
inc r11
or cx, dx
movsx r10d, r11b
lea r8, [r8 + rdx*2 - 4]
mov word [r8 + r11 - 0x1a7fa947], bp
movsx ebp, r10w
adc r10d, edx
lea rcx, [rsi + r10*8 - 0x59c92afd]
jae fcn.141427624

Function at 0x141420ae0
Capabilities:
Encode data using base64

Disassembly:
mov ebp, dword [rdi + rsi*2]
pop r10
xor ebp, r9d
neg r11b
adc rdx, r11
lea r10, [r11*8 - 0x4a66cd60]
bswap ebp
not ebp
movsx eax, cx
sub eax, eax
rol ebp, 1
sar al, 3
not ebp
sbb esi, esi
lea r10, [rax + rsi*8 - 0x6f7ffa62]
xor ebp, 0x5005aa13
inc rdx
or r11d, esi
dec ebp
ror ebp, 1
inc ax
push r9
xor dword [rsp + rsi*4], ebp
pop r9
movsxd rbp, ebp
inc sil
div r10b
not r10d
add rbx, rbp
sar dx, 0x81
cmovge si, cx
jp fcn.141427624

Function at 0x141420b47
Capabilities:
Encode data using base64

Disassembly:
bts cx, 0x93
rol esi, 1
or rcx, rcx
adc ecx, edx
lea esi, [rsi + rbp + 0x6b51100f]
mov qword [rsp + rbp + 0x25973388], 0x47961009
xor esi, 0x51ac4d87
movzx eax, byte [rsp + r10*2 - 0x4b2e670b]
imul r10
not esi
mul word [rsp + rbp + 0x2597338d]
setno bpl
mov qword [rsp + rbp + 0x259733ff], r9
sub rbp, rcx
xor dword [rsp + rbp + 0x2bc78478], esi
btc dx, r11w
pop r9
call fcn.14141b358

Function at 0x141425d6c
Capabilities:
Encode data using base64

Disassembly:
push 0x552e8100
xor eax, 0x937ae1a
shl byte [rsp + 0xc], 0x27
dec rcx
lea rsp, [rsp + 0x18]
jne 0x141437f20
mov qword [rsp], 0x4a1c023e
inc dword [rsp]
xor eax, r10d
jmp 0x14142a11d
inc rbp
jmp 0x141417386

Function at 0x14142a5bf
Capabilities:
Encode data using base64

Disassembly:
mov r9, qword [rsp + rbp - 0x678ca2f2]
movsxd rax, eax
bt rsi, 0x1f
shr dword [rsp + rbp - 0x678ca2fd], 0x38
movsx edx, r10b
adc rbx, rax
bts r10, rcx
call fcn.141407bea

Function at 0x14142a791
Capabilities:
Encode data using base64

Disassembly:
and sil, r11b
lea ebp, [rbp + rax + 0x33133af1]
bswap ebp
mov qword [rsp + rcx], r9
setns cl
or cl, 0x86
xor dword [rsp + rcx*8 - 0x438], ebp
sal rax, cl
pop r9
or si, cx
mov edx, eax
sal esi, 0xf3
movsxd rbp, ebp
sar edx, 0x7f
mul esi
xor sil, cl
adc rbx, rbp
shr si, cl
jns fcn.141427624

Function at 0x14142a7e6
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbp - 0x4a70], r9
movsx r9d, bpl
mov qword [rsp + r11 - 0x168c4094], r11
call fcn.1414325fd
mov ebp, 0xd406fb23
sub rdi, 4
movsx edx, bpl
mov r10d, 0x111a93ba
mov esi, dword [rdx + rdi - 0x23]
mov eax, ebp
xchg rbp, rdx
xchg dh, dl
xor esi, r9d
bt dx, dx
rol esi, 2
inc esi
add r10, r10
ror esi, 1
sub dx, 0xe799
jg 0x1414291e2
mov qword [rsp + rcx - 0xb6dd], rbx
ret

Function at 0x14142cda8
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x28]
jbe 0x14140f0cd
mov edx, 4
lea ecx, [rbx - 4]
mov eax, 0xf3b82336
btr ax, ax
xor rax, rax
shl ecx, 3
sal edx, 3
call fcn.14140fbf2
jmp 0x14140f0ba

Function at 0x14142e12c
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x18]
je 0x14140fbdb