joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400029a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
mov r8, rcx
je 0x140002b11
xor eax, eax
cmp dword [0x14001e098], 5
jl 0x140002adf
movdqa xmm2, xmmword [0x140017590]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x1400175b0]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x1400175e0]
sub r9, rcx
movdqa xmm5, xmmword [0x1400175d0]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x1400029f3
cmp rax, 0x12
jae 0x140002b0c
movabs r9, 0x9d3fe36fdf390927
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x12
jb 0x140002af0
mov byte [r8 + 0x12], 0
ret
Function at 0x140007180
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
xor edi, edi
mov qword [rsp + 0x40], rdi
mov esi, 0x6e
mov r10, qword [rsp + 0x38]
nop dword [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, rax
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], edx
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, r8
mov qword [rsp + 0x20], rax
cmp r10, rdi
je 0x140007206
mov qword [r10], rax
add r10, 8
mov qword [rsp + 0x38], r10
jmp 0x140007222
lea r8, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140009f80
mov rdi, qword [rsp + 0x40]
mov r10, qword [rsp + 0x38]
sub rsi, 1
jne 0x1400071c0
mov r8, r10
mov rbx, qword [rsp + 0x30]
sub r8, rbx
sar r8, 3
xor r9d, r9d
mov rdx, r10
mov rcx, rbx
call fcn.14000a1e0
xorps xmm1, xmm1
xorps xmm2, xmm2
mov eax, 5
movdqu xmm0, xmmword [rbx + rax*8]
paddq xmm1, xmm0
movdqu xmm0, xmmword [rbx + rax*8 + 0x10]
paddq xmm0, xmm2
movdqa xmm2, xmm0
add rax, 4
cmp rax, 0x69
jl 0x140007250
paddq xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq rsi, xmm1
test rbx, rbx
je 0x1400072c6
sub rdi, rbx
and rdi, 0xfffffffffffffff8
mov rax, rbx
cmp rdi, 0x1000
jb 0x1400072bb
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400072bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, rbx
call fcn.140012f4c
cmp rsi, 0x18704
jae 0x140007323
call fcn.140006690
test al, al
jne 0x140007323
call fcn.1400068a0
test al, al
jne 0x140007323
call fcn.1400050e0
test al, al
jne 0x140007323
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ebx, 0x320
jl 0x140007323
cmp eax, 0x258
jl 0x140007323
call fcn.140005b30
test al, al
jne 0x140007323
call fcn.140006b00
test al, al
setne al
jmp 0x140007325
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140012e20
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14000c290
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000c2b8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000c2de
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000c2e0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000c339
test ecx, ecx
jle 0x14000c319
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000c339
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000c339
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14000c360
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000c382
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14000c398
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000c3b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000c3b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000c3f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000c48e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000c42d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000c46e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000c48e
cmp rbx, rax
ja 0x14000c440
test rbx, rbx
je 0x14000c48e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14000c8f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000c91d
xor eax, eax
jmp 0x14000ca89
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000c957
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000c957
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000ca89
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000ca7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000c99a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000c9c5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000ca81
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000ca34
sub eax, 1
je 0x14000ca34
cmp eax, 2
jne 0x14000ca7c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000ca81
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000ca62
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000ca7c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000ca81
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140012e20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000cef0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000cfc3
cmp byte [rcx + 0x71], 0
je 0x14000cfc3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000cfbf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000cf84
sub eax, 1
je 0x14000cf88
cmp eax, 2
jne 0x14000cfbf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140012e20
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000cfb6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000cfbf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000cf6c
xor al, al
jmp 0x14000cf6c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140012e20
add rsp, 0x60
pop rbx
ret
Function at 0x140012438
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140012472
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140012477
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400124c0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400167b0]
cmp byte [rcx + rax], 0
je 0x1400124c0
dec r8
sub rdx, 1
jne 0x1400124a6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140012b64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400124d8
mov ebx, eax
test eax, eax
jne 0x140012b94
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140012bf7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140012bee
test al, 0x10
je 0x140012bee
bt eax, 0xa
jae 0x140012be7
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140012c08
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140012be3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140012be3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140012bee
and dword [rsp + 0x3c], 0
jmp 0x140012bf3
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140013d14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140013d5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140013d5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140013d5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140013d5e
cmp dword [rcx + 0x84], 0xe
jbe 0x140013d5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013d60
xor al, al
add rsp, 0x28
ret
Function at 0x1400030c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14000ae00], rbx
je 0x14000310c
cmp rax, rbx
jne 0x1400030ff
mov ebx, 1
mov esi, ebx
jmp 0x140003111
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400030e4
mov ebx, 1
mov eax, dword [0x14000ae08]
cmp eax, ebx
jne 0x140003127
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000318c
mov eax, dword [0x14000ae08]
test eax, eax
jne 0x140003186
mov dword [0x14000ae08], ebx
lea r15, [0x140004830]
lea rdi, [0x140004818]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140003178
test eax, eax
jne 0x14000317c
cmp qword [rdi], 0
je 0x14000316d
mov rax, qword [rdi]
mov rcx, qword [0x1400047f8]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000314e
test eax, eax
je 0x14000318c
mov eax, 0xff
jmp 0x140003268
mov dword [0x14000a704], ebx
mov eax, dword [0x14000ae08]
cmp eax, ebx
jne 0x1400031b3
lea rdx, [0x140004810]
lea rcx, [0x140004800]
call sub.msvcrt.dll__initterm
mov dword [0x14000ae08], 2
test esi, esi
jne 0x1400031c0
xor eax, eax
xchg qword [0x14000ae00], rax
cmp qword [0x14000ae10], 0
je 0x1400031f4
lea rcx, [0x14000ae10]
call fcn.140003490
test eax, eax
je 0x1400031f4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000ae10]
mov r9, qword [0x1400047f8]
call r9
mov r8, qword [0x14000a718]
mov rdx, qword [0x14000a710]
mov ecx, dword [0x14000a708]
call fcn.1400013bc
mov dword [0x14000a700], eax
cmp dword [0x14000a720], 0
jne 0x140003224
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000a704], 0
jne 0x140003239
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000a700]
jmp 0x140003268
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14009a000
add rsp, 0x28
jmp 0x1400030c0

Function at 0x14000337c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400033c8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400033c0
cmp dword [rcx + 0x3c], edx
jl 0x1400033c0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400033c0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400033c8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14000c150
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x14003b010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
lea r12, [rsp + 0xc8]
movabs r13, 0xff00ff00ff00ff00
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r12
mov rbx, qword [r12]
mov rsi, rbx
xor rsi, r13
mov qword [rsp + 0x68], rsi
mov qword [r12], r15
mov rcx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14000c1cb
mov rcx, qword [rdx]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, dword [rdx + 0x10]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x14000c207
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov qword [r12], rbx
jmp 0x14000c322
mov ebp, dword [rsp + 0x48]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
test rbp, rbp
je 0x14000c27b
cmp rbp, 0x1000
jb 0x14000c253
lea rcx, [rbp + 0x27]
cmp rcx, rbp
jbe 0x14000c350
call fcn.14002ddd8
mov rcx, rax
test rax, rax
je 0x14000c2f3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000c25b
mov rcx, rbp
call fcn.14002ddd8
mov qword [rsp + 0x50], rax
lea rbx, [rax + rbp]
mov qword [rsp + 0x60], rbx
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x58], rbx
mov edx, dword [r14 + 0x10]
cmp qword [r14 + 0x18], 0x10
jb 0x14000c289
mov r14, qword [r14]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8d, 1
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x14000c301
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000c31b
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c2fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c2fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ddd0
jmp 0x14000c31b
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
xor rsi, r13
mov qword [r12], rsi
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14002ddb0
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400018d0
nop
int3
Function at 0x140020ed0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14003b010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140020f01
xor eax, eax
jmp 0x140021050
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140020f3e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x140020f3e
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x140021050
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140021045
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140020f85
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140020faf
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, di
je 0x140021045
movzx edi, si
jmp 0x140021045
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], si
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140021005
sub eax, 1
je 0x140021005
cmp eax, 2
jne 0x140021045
movzx ecx, word [rsp + 0x50]
jmp 0x140020f91
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x140021033
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140021045
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne di, si
mov rbp, qword [rsp + 0xb0]
movzx eax, di
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14002ddb0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400219d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 0x1384], 0xffffffff
lea r9, [rcx + 8]
mov dword [rcx + 4], edx
mov r8d, 1
nop word [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8
mov dword [r9 - 4], edx
cmp r8, 0x270
jb 0x1400219f0
mov dword [rcx], 0x270
mov rax, rcx
ret

Function at 0x140022350
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140022384
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140022370
ret
Function at 0x140022e20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14003b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140022ef5
cmp byte [rcx + 0x72], 0
je 0x140022ef5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140022ef1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140022eb6
sub eax, 1
je 0x140022eba
cmp eax, 2
jne 0x140022ef1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002ddb0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140022ee8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140022ef1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140022e9e
xor al, al
jmp 0x140022e9e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002ddb0
add rsp, 0x60
pop rbx
ret

Function at 0x140023580
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 4], edx
lea r9, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r8d, edx
lea r9, [r9 + 4]
shr r8d, 0x1e
xor r8d, edx
imul edx, r8d, 0x6c078965
add edx, eax
inc rax
mov dword [r9 - 4], edx
cmp rax, 0x270
jb 0x140023590
mov dword [rcx], 0x270
ret