joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005b20
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x4c], 0x67452301
mov byte [rcx], al
mov rbx, rcx
mov qword [rcx + 0x44], rax
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x58], 0x10325476
call fcn.14002a4d8
mov rcx, rbx
call fcn.1400152cc
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400075bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
movdqa xmm6, xmmword [0x1400596e0]
mov edx, 4
mov dword [rbp - 0x30], 0x7d6d6130
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x2c], 0x2c2b6d61
mov dword [rbp - 0x28], 0x4d283e21
mov eax, dword [rdx + rcx]
cmp dword [0x1400718dc], eax
jg 0x140007636
lea rax, [0x1400718c0]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140031310
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
lea rcx, [0x1400718dc]
call fcn.1400310f8
cmp dword [0x1400718dc], 0xffffffff
jne 0x140007618
movsd xmm0, qword [rbp - 0x30]
lea rcx, [0x1400568e8]
mov eax, dword [rbp - 0x28]
movsd qword [0x1400718d0], xmm0
movups xmmword [0x1400718c0], xmm6
mov dword [0x1400718d8], eax
call fcn.140030cec
lea rcx, [0x1400718dc]
call fcn.140031098
jmp 0x140007618

Function at 0x140007b5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
movdqa xmm0, xmmword [0x140059340]
movdqa xmm1, xmmword [0x1400594a0]
mov ecx, dword [0x140072888]
mov r8d, 4
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [str.9:___]
mov rdx, qword [rax + rcx*8]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140059360]
movdqa xmmword [rbp - 0x40], xmm0
mov eax, dword [r8 + rdx]
cmp dword [0x140071a60], eax
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0x243e3f28
mov dword [rbp - 0x1c], 0x1f112322
mov dword [rbp - 0x18], 0x626d2338
mov word [rbp - 0x14], 0x6d3b
mov byte [rbp - 0x12], 0x4d
jg 0x140007c0a
lea rax, [0x140071a10]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031310
add rsp, 0x80
pop rbp
ret
lea rcx, [0x140071a60]
call fcn.1400310f8
cmp dword [0x140071a60], 0xffffffff
jne 0x140007bee
lea rdx, [rbp - 0x60]
lea rcx, [0x140071a10]
call fcn.140005a40
lea rcx, [0x140056990]
call fcn.140030cec
lea rcx, [0x140071a60]
call fcn.140031098
jmp 0x140007bee
Function at 0x140007c4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
movdqa xmm6, xmmword [0x1400595a0]
mov edx, 4
mov dword [rbp - 0x30], 0x23606d39
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x2c], 0x736d7b6d
mov dword [rbp - 0x28], 0x2138236d
mov word [rbp - 0x24], 0x6b6d
mov eax, dword [rdx + rcx]
cmp dword [0x1400715f4], eax
jg 0x140007ccc
lea rax, [0x1400713c8]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140031310
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
lea rcx, [0x1400715f4]
call fcn.1400310f8
cmp dword [0x1400715f4], 0xffffffff
jne 0x140007cae
mov eax, dword [rbp - 0x28]
lea rcx, [0x1400569cc]
movsd xmm0, qword [rbp - 0x30]
mov dword [0x1400713e0], eax
movzx eax, word [rbp - 0x24]
mov word [0x1400713e4], ax
movups xmmword [0x1400713c8], xmm6
mov byte [0x1400713e6], 0x4d
movsd qword [0x1400713d8], xmm0
call fcn.140030cec
lea rcx, [0x1400715f4]
call fcn.140031098
jmp 0x140007cae

Function at 0x140008734
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
mov edx, 4
mov dword [rbp - 0x20], 0x3937243f
mov dword [rbp - 0x1c], 0x23222312
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x18], 0x37633f24
mov word [rbp - 0x14], 0x3d24
mov eax, dword [rdx + rcx]
cmp dword [0x140071588], eax
jg 0x1400087a2
lea rax, [0x140070940]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031310
add rsp, 0x40
pop rbp
ret
lea rcx, [0x140071588]
call fcn.1400310f8
cmp dword [0x140071588], 0xffffffff
jne 0x140008789
mov eax, dword [rbp - 0x18]
lea rcx, [0x140056b48]
movsd xmm0, qword [rbp - 0x20]
mov dword [0x140070948], eax
movzx eax, word [rbp - 0x14]
mov word [0x14007094c], ax
movsd qword [0x140070940], xmm0
mov byte [0x14007094e], 0x4d
call fcn.140030cec
lea rcx, [0x140071588]
call fcn.140031098
jmp 0x140008789

Function at 0x14000894c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
movdqa xmm6, xmmword [0x1400594b0]
mov edx, 4
mov dword [rbp - 0x30], 0x24213d3d
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x2c], 0x24392c2e
mov dword [rbp - 0x28], 0x4d3e2322
mov eax, dword [rdx + rcx]
cmp dword [0x140071804], eax
jg 0x1400089c6
lea rax, [0x1400717e8]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140031310
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
lea rcx, [0x140071804]
call fcn.1400310f8
cmp dword [0x140071804], 0xffffffff
jne 0x1400089a8
movsd xmm0, qword [rbp - 0x30]
lea rcx, [0x140056b90]
mov eax, dword [rbp - 0x28]
movsd qword [0x1400717f8], xmm0
movups xmmword [0x1400717e8], xmm6
mov dword [0x140071800], eax
call fcn.140030cec
lea rcx, [0x140071804]
call fcn.140031098
jmp 0x1400089a8
Function at 0x140008d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword gs:[0x58]
movdqa xmm0, xmmword [0x140059390]
movdqa xmm1, xmmword [0x1400596c0]
mov ecx, dword [0x140072888]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x140059320]
mov r8d, 4
mov rdx, qword [rax + rcx*8]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x140059400]
movdqa xmmword [rbp + 7], xmm0
mov eax, dword [r8 + rdx]
cmp dword [0x1400716f0], eax
movdqa xmm0, xmmword [0x140059510]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmmword [rbp + 0x27], xmm0
mov dword [rbp + 0x37], 0x3e24296d
mov dword [rbp + 0x3b], 0x342c213d
mov dword [rbp + 0x3f], 0x28202c03
mov byte [rbp + 0x43], 0x4d
jg 0x140008df7
lea rax, [0x140071690]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140031310
add rsp, 0x90
pop rbp
ret
lea rcx, [0x1400716f0]
call fcn.1400310f8
cmp dword [0x1400716f0], 0xffffffff
jne 0x140008ddb
lea rdx, [rbp - 0x19]
lea rcx, [0x140071690]
call fcn.140005ab0
lea rcx, [0x140056c04]
call fcn.140030cec
lea rcx, [0x1400716f0]
call fcn.140031098
jmp 0x140008ddb

Function at 0x140009ac8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
mov edx, 4
mov dword [rbp - 0x20], 0x1d11770e
mov dword [rbp - 0x1c], 0x3f2a223f
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x18], 0x2c09202c
mov word [rbp - 0x14], 0x2c39
mov eax, dword [rdx + rcx]
cmp dword [0x140071ba8], eax
jg 0x140009b36
lea rax, [0x140071b98]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031310
add rsp, 0x40
pop rbp
ret
lea rcx, [0x140071ba8]
call fcn.1400310f8
cmp dword [0x140071ba8], 0xffffffff
jne 0x140009b1d
mov eax, dword [rbp - 0x18]
lea rcx, [0x140056de0]
movsd xmm0, qword [rbp - 0x20]
mov dword [0x140071ba0], eax
movzx eax, word [rbp - 0x14]
mov word [0x140071ba4], ax
movsd qword [0x140071b98], xmm0
mov byte [0x140071ba6], 0x4d
call fcn.140030cec
lea rcx, [0x140071ba8]
call fcn.140031098
jmp 0x140009b1d

Function at 0x140009ce8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
mov edx, 4
mov dword [rbp - 0x20], 0x3e352c20
mov dword [rbp - 0x1c], 0x3f382e28
mov rcx, qword [rax + rcx*8]
mov word [rbp - 0x18], 0x4d28
mov eax, dword [rdx + rcx]
cmp dword [0x14007173c], eax
jg 0x140009d4f
lea rax, [0x140071730]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031310
add rsp, 0x40
pop rbp
ret
lea rcx, [0x14007173c]
call fcn.1400310f8
cmp dword [0x14007173c], 0xffffffff
jne 0x140009d36
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x140056e2c]
movzx eax, word [rbp - 0x18]
movsd qword [0x140071730], xmm0
mov word [0x140071738], ax
call fcn.140030cec
lea rcx, [0x14007173c]
call fcn.140031098
jmp 0x140009d36
Function at 0x14000a404
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
movdqa xmm0, xmmword [0x140059300]
movdqa xmm1, xmmword [0x140059520]
mov ecx, dword [0x140072888]
mov r8d, 4
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [str.:___]
mov rdx, qword [rax + rcx*8]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140059430]
movdqa xmmword [rbp - 0x40], xmm0
mov eax, dword [r8 + rdx]
cmp dword [0x140071a00], eax
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0x22243e3f
mov dword [rbp - 0x1c], 0x381f1123
mov dword [rbp - 0x18], 0x3b626d23
mov word [rbp - 0x14], 0x4d6d
jg 0x14000a4ae
lea rax, [0x1400719b0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031310
add rsp, 0x80
pop rbp
ret
lea rcx, [0x140071a00]
call fcn.1400310f8
cmp dword [0x140071a00], 0xffffffff
jne 0x14000a492
lea rdx, [rbp - 0x60]
lea rcx, [0x1400719b0]
call fcn.1400059d4
lea rcx, [0x140056f0c]
call fcn.140030cec
lea rcx, [0x140071a00]
call fcn.140031098
jmp 0x14000a492

Function at 0x14000a784
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
mov edx, 4
mov dword [rbp - 0x20], 0x2e3f2423
mov dword [rbp - 0x1c], 0x632e2920
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x18], 0x4d283528
mov eax, dword [rdx + rcx]
cmp dword [0x1400715ec], eax
jg 0x14000a7ec
lea rax, [0x1400713b0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031310
add rsp, 0x40
pop rbp
ret
lea rcx, [0x1400715ec]
call fcn.1400310f8
cmp dword [0x1400715ec], 0xffffffff
jne 0x14000a7d3
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x140056f90]
mov eax, dword [rbp - 0x18]
movsd qword [0x1400713b0], xmm0
mov dword [0x1400713b8], eax
call fcn.140030cec
lea rcx, [0x1400715ec]
call fcn.140031098
jmp 0x14000a7d3

Function at 0x14000aaac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
movdqa xmm6, xmmword [0x140059560]
mov edx, 4
mov dword [rbp - 0x30], 0x393e3f3c
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x2c], 0x353a3b38
mov word [rbp - 0x28], 0x3734
mov eax, dword [rdx + rcx]
cmp dword [0x140071794], eax
jg 0x14000ab25
lea rax, [0x140071778]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140031310
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
lea rcx, [0x140071794]
call fcn.1400310f8
cmp dword [0x140071794], 0xffffffff
jne 0x14000ab07
movsd xmm0, qword [rbp - 0x30]
lea rcx, [0x140056fdc]
movzx eax, word [rbp - 0x28]
movsd qword [0x140071788], xmm0
mov word [0x140071790], ax
movups xmmword [0x140071778], xmm6
mov byte [0x140071792], 0x4d
call fcn.140030cec
lea rcx, [0x140071794]
call fcn.140031098
jmp 0x14000ab07
Function at 0x14000ab7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
mov edx, 4
mov dword [rbp - 0x20], 0x626d293f
mov dword [rbp - 0x1c], 0x3c626d3e
mov rcx, qword [rax + rcx*8]
mov word [rbp - 0x18], 0x4d6d
mov eax, dword [rdx + rcx]
cmp dword [0x140071b7c], eax
jg 0x14000abe3
lea rax, [0x140071b70]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031310
add rsp, 0x40
pop rbp
ret
lea rcx, [0x140071b7c]
call fcn.1400310f8
cmp dword [0x140071b7c], 0xffffffff
jne 0x14000abca
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x140057000]
movzx eax, word [rbp - 0x18]
movsd qword [0x140071b70], xmm0
mov word [0x140071b78], ax
call fcn.140030cec
lea rcx, [0x140071b7c]
call fcn.140031098
jmp 0x14000abca

Function at 0x14000af38
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
movdqa xmm6, xmmword [0x140059660]
mov edx, 4
mov dword [rbp - 0x30], 0x6f6d0b60
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x2c], 0x2821242b
mov word [rbp - 0x28], 0xd70
mov eax, dword [rdx + rcx]
cmp dword [0x140071b5c], eax
jg 0x14000afb1
lea rax, [0x140071b40]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140031310
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
lea rcx, [0x140071b5c]
call fcn.1400310f8
cmp dword [0x140071b5c], 0xffffffff
jne 0x14000af93
movsd xmm0, qword [rbp - 0x30]
lea rcx, [0x140057068]
movzx eax, word [rbp - 0x28]
movsd qword [0x140071b50], xmm0
mov word [0x140071b58], ax
movups xmmword [0x140071b40], xmm6
mov byte [0x140071b5a], 0x4d
call fcn.140030cec
lea rcx, [0x140071b5c]
call fcn.140031098
jmp 0x14000af93

Function at 0x14000b4d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072888]
mov edx, 4
mov dword [rbp - 0x20], 0x3923283e
mov dword [rbp - 0x1c], 0x21282324
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x18], 0x4d282322
mov eax, dword [rdx + rcx]
cmp dword [0x14007171c], eax
jg 0x14000b540
lea rax, [0x140071710]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140031310
add rsp, 0x40
pop rbp
ret
lea rcx, [0x14007171c]
call fcn.1400310f8
cmp dword [0x14007171c], 0xffffffff
jne 0x14000b527
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x14005713c]
mov eax, dword [rbp - 0x18]
movsd qword [0x140071710], xmm0
mov dword [0x140071718], eax
call fcn.140030cec
lea rcx, [0x14007171c]
call fcn.140031098
jmp 0x14000b527
Function at 0x14000b974
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x14000b9c7
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14000b98c
jmp 0x14000b9d4
cmp dword [rcx], 0x4e0
jb 0x14000b9d4
call fcn.14000cfa0
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x14000be2c
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rcx
mov rdi, r9
xor ecx, ecx
mov rsi, r8
mov rbp, rdx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x30]
lea r9, [0x140059700]
mov qword [rsp + 0x20], rax
lea rcx, [0x140059710]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14000bf12
mov rcx, qword [rsp + 0x30]
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rsp + 0x30]
mov rdx, rbp
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [0x1400596f0]
mov rax, qword [rcx]
call qword [rax]
mov ebx, eax
test eax, eax
js 0x14000bf07
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov rdx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14000bf38
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub rsp, 0x28
and dword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x14000bf62
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetAttemptConnect]
test eax, eax
jne 0x14000bf62
mov al, 1
jmp 0x14000bf64
xor al, al
add rsp, 0x28
ret
Function at 0x14000c83c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14006f9b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000c8ab
cmp byte [rcx + 0x71], 0
je 0x14000c8ab
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000c8ff
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14000c8c5
sub eax, 1
je 0x14000c8c9
cmp eax, 2
jne 0x14000c8ff
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140031310
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000c8f6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.14003a3a0
cmp rdi, rax
jne 0x14000c8ff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000c8ad
xor al, al
jmp 0x14000c8ad

Function at 0x14000cfa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov eax, dword [r10]
mov r11d, 0xe3
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x14000cfb3
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x14000cffe
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
ret
Function at 0x14000e4f0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
lea r9d, [rdx + 2]
mov esi, edx
mov r15, rcx
mov r10d, 0x55555556
mov eax, r10d
xor ebx, ebx
imul r9d
mov eax, r10d
xor r14d, r14d
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
lea ecx, [rdx + rdx*2]
sub r9d, ecx
mov ecx, esi
sub ecx, r9d
lea ecx, [rcx*4 + 8]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
movsxd r12, edx
lea rcx, [r12 + 1]
call fcn.140037acc
mov rdi, rax
test rax, rax
je 0x14000e6b3
test esi, esi
je 0x14000e6ab
xor ecx, ecx
lea r13, [0x140058ae0]
xor r11d, r11d
lea edx, [rcx + 3]
mov al, byte [r15]
dec esi
mov byte [rbp + rcx + 0x48], al
inc ebx
mov r10b, byte [rbp + 0x4a]
inc rcx
mov r8b, byte [rbp + 0x49]
inc r15
mov r9b, byte [rbp + 0x48]
cmp rcx, rdx
jne 0x14000e5f6
mov cl, r9b
mov al, r9b
shr al, 2
and cl, dl
shl cl, 4
mov byte [rbp + 0x50], al
mov al, r8b
shr al, 4
add cl, al
mov al, r10b
mov byte [rbp + 0x51], cl
mov cl, r8b
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, r10b
and al, 0x3f
mov byte [rbp + 0x52], cl
xor ecx, ecx
mov byte [rbp + 0x53], al
add r14d, 4
movzx eax, byte [rbp + rcx + 0x50]
inc rcx
mov al, byte [rax + r13]
mov byte [r11 + rdi], al
inc r11
cmp rcx, 4
jl 0x14000e5d9
xor ebx, ebx
xor ecx, ecx
test esi, esi
jne 0x14000e579
test ebx, ebx
je 0x14000e6ab
movsxd rax, ebx
cmp rax, rdx
jge 0x14000e62d
jae 0x14000e6c8
mov byte [rbp + rax + 0x48], 0
inc rax
cmp rax, rdx
jl 0x14000e60e
mov r10b, byte [rbp + 0x4a]
mov r8b, byte [rbp + 0x49]
mov r9b, byte [rbp + 0x48]
mov al, r9b
and r9b, dl
shr al, 2
mov byte [rbp + 0x50], al
mov al, r8b
shr al, 4
and r8b, 0xf
shl r9b, 4
add r9b, al
shl r8b, 2
mov al, r10b
mov byte [rbp + 0x51], r9b
and r10b, 0x3f
shr al, 6
add r8b, al
mov byte [rbp + 0x53], r10b
lea r9d, [rbx + 1]
mov byte [rbp + 0x52], r8b
movsxd r10, r9d
test r9d, r9d
jle 0x14000e695
movsxd r8, r14d
xor ecx, ecx
add r8, rdi
add r14d, r9d
movzx eax, byte [rbp + rcx + 0x50]
inc rcx
mov al, byte [rax + r13]
mov byte [r8], al
inc r8
cmp rcx, r10
jl 0x14000e67e
cmp ebx, edx
jge 0x14000e6ab
sub edx, ebx
movsxd rcx, r14d
mov r8d, edx
add rcx, rdi
mov dl, 0x3d
call fcn.140032180
mov byte [r12 + rdi], 0
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140030e0c
int3
Function at 0x14000e6d0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
and qword [rcx + 0x10], 0
xor edi, edi
mov qword [rcx + 0x18], 0xf
mov rbx, rcx
mov byte [rcx], 0
mov rsi, rdx
cmp qword [rdx + 0x18], 0x10
lea ebp, [rdi - 6]
jb 0x14000e711
mov rsi, qword [rdx]
mov rcx, rdx
jb 0x14000e719
mov rcx, qword [rdx]
mov r12, qword [rdx + 0x10]
add r12, rcx
cmp rsi, r12
je 0x14000e835
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx eax, byte [rsi]
shl edi, 8
add edi, eax
add ebp, 8
js 0x14000e7b2
lea ecx, [rbp + 6]
movsxd r14, ebp
mov eax, 0xaaaaaaab
movsxd r13, edi
mul ecx
shr edx, 2
imul eax, edx, 0xfffffffa
mov r15d, edx
add ebp, eax
mov rcx, r14
mov rax, r13
sar rax, cl
mov rcx, qword [rbx + 0x10]
and eax, 0x3f
mov r9b, byte [rax + r8]
cmp rcx, qword [rbx + 0x18]
jae 0x14000e792
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x14000e787
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000e7a8
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140004670
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
sub r14, 6
sub r15, 1
jne 0x14000e758
inc rsi
cmp rsi, r12
jne 0x14000e730
cmp ebp, 0xfffffffa
jle 0x14000e835
shl edi, 8
lea ecx, [rbp + 8]
movsxd rdx, edi
sar rdx, cl
mov rcx, qword [rbx + 0x10]
and edx, 0x3f
mov r9b, byte [rdx + r8]
cmp rcx, qword [rbx + 0x18]
jae 0x14000e826
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x14000e7f5
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000e835
cmp rcx, qword [rbx + 0x18]
jae 0x14000e823
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x14000e81b
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x14000e835
mov r9b, 0x3d
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.140004670
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x14000e800
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret