joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400512c8
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov edi, r9d
mov r14, r8
mov r13, rdx
mov rbp, rcx
cmp r8, r15
jne 0x14005131b
movzx eax, word [rdx]
lea r14, [r11 + 0x18]
mov word [rsp + 0x70], ax
movzx eax, word [rdx + 2]
mov word [rsp + 0x72], ax
lea eax, [r15 + 0x5c]
mov word [rsp + 0x74], ax
mov word [r11 + 0x1e], r15w
lea rcx, [rsp + 0x20]
mov edx, 0x209
call fcn.14004bedc
mov rbx, qword [rsp + 0x20]
lea rcx, str.Device_
mov r8d, 8
mov rdx, rbp
mov word [rbx], r15w
call fcn.140045fc8
cmp al, r15b
jne 0x140051389
lea rcx, str.DosDevices_
mov r8d, 0xc
mov rdx, rbp
call fcn.140045fc8
cmp al, r15b
jne 0x140051389
cmp word [rbp], r15w
je 0x14005138c
cmp word [rbp + 2], r15w
je 0x14005138c
lea rcx, [rbp + 4]
mov edx, 0x3a
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, r15
je 0x14005138c
or edi, 1
lea rcx, [0x1400de138]
mov r8d, 0xb
mov rdx, rbp
call fcn.140045fc8
mov sil, byte [rsp + 0x80]
cmp al, r15b
je 0x1400513b6
and edi, 0xfffffffe
cmp sil, r15b
jne 0x1400513e3
cmp sil, r15b
je 0x1400513c5
movzx ecx, word [r13]
call fcn.140048bc8
mov r8, rbp
mov rdx, r13
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov r12d, eax
cmp eax, r15d
jne 0x1400513f7
cmp sil, r15b
jl 0x140051445
mov sil, r15b
mov r8d, 0x208
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x140051424
cmp sil, r15b
jle 0x140051445
mov r8d, 0x208
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, r15d
je 0x140051445
mov ecx, edi
mov r8, rbp
mov rdx, r13
or ecx, 0xe
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
cmp sil, r15b
mov r12d, eax
jl 0x140051445
cmp eax, r15d
jne 0x140051445
mov sil, 0xff
jmp 0x1400513b6
lea rcx, [rsp + 0x20]
call fcn.140044f24
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
mov eax, r12d
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140051470
Capabilities:
Get disk information via ioctl

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1e0
and qword [rsp + 0x38], 0
and qword [rax + 0x18], 0
mov rdi, rdx
mov rdx, rcx
mov r9d, 3
mov dword [rsp + 0x30], 0x20000000
mov dword [rsp + 0x28], r9d
and qword [rsp + 0x20], 0
lea rcx, [rax + 0x18]
mov r8d, 0x100080
call fcn.1400034e0
cmp qword [rsp + 0x200], 0
jne 0x1400514c7
or eax, 0xffffffff
jmp 0x140051555
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x200]
or dword [rsp + 0x44], 0xffffffff
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x2d1080
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14005152b
cmp qword [rsp + 0x200], 0xffffffffffffffff
je 0x1400514bf
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400514bf
test rdi, rdi
je 0x140051536
mov eax, dword [rsp + 0x40]
mov dword [rdi], eax
cmp qword [rsp + 0x200], 0xffffffffffffffff
mov edi, dword [rsp + 0x44]
je 0x140051553
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
add rsp, 0x1e0
pop rdi
ret
Function at 0x140051bdc
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
and qword [rsp + 0x78], 0
mov r14, qword [rsp + 0x90]
mov edi, 1
test r14, r14
lea rsi, [rsp + 0x78]
mov r12d, r9d
cmovne rdi, r14
cmp qword [rsp + 0x98], 0
mov eax, r8d
cmovne rsi, qword [rsp + 0x98]
mov rbx, rdx
mov rbp, rcx
test r9d, r9d
jg 0x140051c43
mov rcx, qword [rcx]
call fcn.140048d48
mov r12d, eax
mov eax, dword [rsp + 0x80]
shl rax, 7
xor edx, edx
movsxd r13, r12d
lea rax, [rax + r13 - 1]
mov rcx, rbx
div r13
xor edx, edx
add eax, 2
mov qword [rsp + 0x90], rax
lea r8d, [rax + 2]
imul r8d, r12d
call fcn.1400b93b0
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rbp]
and dword [rsp + 0x88], 0
xor r8d, r8d
call fcn.140045f34
mov rcx, qword [rbp]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, r12d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test r14, r14
jne 0x140051ccb
mov eax, 0x1c2
cmp byte [rax + rbx], 0xee
jne 0x140051cbf
mov edi, dword [rax + rbx + 4]
add rax, 0x10
cmp rax, 0x1f2
jle 0x140051cb5
mov rcx, qword [rbp]
mov rdx, r13
xor r8d, r8d
imul rdx, rdi
add rdx, qword [rsp + 0xa0]
call fcn.140045f34
mov r8, qword [rsp + 0x90]
mov rcx, qword [rbp]
and qword [rsp + 0x20], 0
inc r8d
lea rdx, [r13 + rbx]
imul r8d, r12d
lea r9, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp qword [rsp + 0x98], 0
lea eax, [r12 + r12]
cdqe
lea r14, [rax + rbx + 0x10000]
je 0x140051d81
mov r8, r13
xor edx, edx
mov rcx, r14
call fcn.1400b93b0
cmp qword [rsi], 2
jae 0x140051d48
mov rax, qword [rbx + 0x220]
mov qword [rsi], rax
mov rdx, qword [rsi]
mov rcx, qword [rbp]
xor r8d, r8d
imul rdx, r13
add rdx, qword [rsp + 0xa0]
call fcn.140045f34
mov rcx, qword [rbp]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, r12d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, rdi
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140052170
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x630
and dword [rax + 0x20], 0
mov r12, rdx
lea rsi, [rax - 0x418]
mov r13, r8
shl r12, 9
xor r8d, r8d
mov rdx, r12
mov ebp, r9d
mov rdi, rcx
and rsi, 0xfffffffffffffe00
call fcn.140045f34
cmp rax, r12
jne 0x14005227f
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x668]
lea rdx, [rsi + 0x200]
mov r8d, 0x200
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005227f
lea rdx, [rsi + 0x200]
mov r8d, 0x200
mov rcx, rsi
call fcn.1400177f8
cmp ebp, 1
jne 0x14005221a
lea rcx, [rsi + 0x3ce]
lea r8d, [rbp + 0xf]
mov rdx, r13
call fcn.1400177f8
xor eax, eax
mov ecx, 0xaa55
cmp ebp, 1
cmove ax, cx
xor r8d, r8d
mov rcx, rdi
mov rdx, r12
mov word [rsi + 0x3fe], ax
call fcn.140045f34
cmp rax, r12
jne 0x14005227f
lea rdx, [rsi + 0x200]
mov r8d, 0x200
mov rcx, rsi
call fcn.140044f54
test eax, eax
je 0x14005227f
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x668]
lea rdx, [rsi + 0x200]
mov r8d, 0x200
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r11, [rsp + 0x630]
mov eax, 1
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400522a4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov r15, rdx
xor ebp, ebp
mov dword [rdx], ebp
lea rcx, [rax + 0x20]
mov edx, 0x2008
mov r13, r8
call fcn.14004bc80
mov rbx, qword [rsp + 0x88]
lea rdi, [rbx + 0x800]
mov esi, 0x800
xor edx, edx
mov rcx, rdi
mov r8, rsi
mov dword [rsp + 0x78], ebp
call fcn.1400b93b0
lea r9, [rsp + 0x78]
mov r8d, esi
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebp
je 0x1400524d6
mov eax, dword [rbx + 0x1b4]
movzx ecx, word [rbx + 0x1fe]
mov r12b, bpl
cmp eax, 0x46424246
je 0x1400523f0
cmp eax, 0x534c5055
je 0x1400523f0
cmp eax, 0x5352424d
jne 0x1400524d6
mov esi, 0xaa55
cmp ecx, esi
jne 0x1400524d6
cmp dword [rbx + 0x1c], ebp
jne 0x1400524d6
mov ebp, 0x200
xor edx, edx
mov rcx, rdi
mov r8, rbp
call fcn.1400b93b0
xor r8d, r8d
mov edx, 0x4a00
mov rcx, r14
call fcn.140045f34
lea r9, [rsp + 0x78]
xor ebx, ebx
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x1400524d6
cmp dword [rdi + 0x1b4], 0x5352424d
movzx eax, word [rdi + 0x1fe]
jne 0x1400524d6
cmp eax, esi
jne 0x1400524d6
cmp dword [rdi + 0x1c], 0x25
jne 0x1400524d6
movzx esi, byte [rdi + 0x67]
cmp bx, si
jne 0x1400523dc
lea esi, [rbx + 1]
mov ebx, dword [rdi + 0x5c]
movzx eax, si
add ebx, eax
mov eax, dword [rdi + 0x60]
shl rax, 0x20
add rbx, rax
jmp 0x140052456
mov ebp, 0x200
mov esi, 1
xor edx, edx
mov r8, rbp
mov rcx, rdi
mov r12b, sil
call fcn.1400b93b0
xor r8d, r8d
mov edx, 0x8600
mov rcx, r14
call fcn.140045f34
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400524d6
mov al, byte [rdi + 0x1f8]
and al, 0xc0
cmp al, 0x40
jne 0x1400524d6
mov rbx, qword [rdi + 0x1f0]
add rbx, rsi
mov r8, rbp
xor edx, edx
mov rcx, rdi
call fcn.1400b93b0
mov rdx, rbx
shl rdx, 9
jmp 0x1400524a9
lea rdx, [0x1400de208]
lea rcx, [rdi + 3]
mov r8d, 0xa
call fcn.140044f54
cmp eax, r9d
je 0x1400524fc
cmp rbx, 0x41
je 0x1400524d6
cmp r12b, r9b
jne 0x1400524d6
mov r8, rbp
xor edx, edx
mov rcx, rdi
mov ebx, 0x41
call fcn.1400b93b0
mov edx, 0x8200
xor r8d, r8d
mov rcx, r14
call fcn.140045f34
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
cmp eax, r9d
jne 0x14005246c
lea rcx, [rsp + 0x88]
call fcn.140044f24
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rdi + 0x2c]
mov ebx, dword [rdi + 0x68]
mov eax, dword [rdi + 0x28]
and ecx, 0xffffffc0
shl rbx, 0x20
shl ecx, 9
or rbx, rax
mov dword [r15], ecx
cmp r13, r9
je 0x140052526
mov rcx, qword [rdi + 0x74]
shl rcx, 9
mov qword [r13], rcx
lea rcx, [rsp + 0x88]
call fcn.140044f24
shl rbx, 9
mov rax, rbx
jmp 0x1400524e7
Function at 0x140052658
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, dx
mov edx, 0x134
mov ebp, r9d
mov r15, rcx
call fcn.14004bf70
lea rcx, [rsp + 0x20]
mov edx, 0xca
call fcn.14004bedc
mov r12d, dword [rsp + 0x90]
movzx ebx, byte [rsp + 0x90]
and r12d, 0x100
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov rdi, qword [r15]
mov ecx, ebx
xor r8d, r8d
mov esi, eax
neg ecx
mov r13b, r8b
sbb al, al
and al, 0xfe
inc al
neg ebx
sbb ebx, ebx
mov byte [rsp + 0x90], al
and ebx, 0x19
cmp ebp, r8d
je 0x1400526e8
cmp ebp, 1
not esi
jle 0x1400526e8
and esi, 0xfffffffc
cmp ebx, 0x1a
movsxd r12, r12d
jge 0x14005276b
mov r15d, dword [rsp + 0x80]
cmp ebx, r8d
jl 0x140052766
mov ecx, ebx
mov edx, 1
movsx eax, al
shl edx, cl
lea ebp, [rbx + 0x41]
add ebx, eax
test esi, edx
je 0x14005275a
cmp r12, r8
je 0x140052728
movsx ecx, bpl
call fcn.1400b89dc
xor r8d, r8d
cmp eax, r8d
je 0x14005275a
cmp r13b, r8b
je 0x14005273b
cmp r14w, r8w
je 0x14005273b
mov word [rdi], r14w
add rdi, 2
movsx eax, bpl
mov r13b, 1
mov word [rdi], ax
add rdi, 2
cmp r15d, r8d
je 0x14005275a
mov eax, 0x3a
mov word [rdi], ax
add rdi, 2
cmp ebx, 0x1a
mov al, byte [rsp + 0x90]
jl 0x1400526f8
mov r15, qword [rsp + 0x70]
mov word [rdi], r8w
mov rbx, qword [r15]
lea rcx, [rsp + 0x20]
call fcn.140044f24
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400527c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
cmp byte [rcx], 0x23
mov r12, rdx
mov esi, ebx
sete sil
mov rdi, rcx
cmp esi, ebx
je 0x1400527f0
inc rdi
cmp byte [rdi], 0x23
mov bpl, bl
jne 0x14005280e
mov bpl, byte [rdi + 1]
cmp bpl, bl
jne 0x140052808
xor eax, eax
jmp 0x1400528b1
inc esi
add rdi, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, r12
inc eax
lea edx, [rax + rax*2]
call fcn.14004bd00
mov r11, qword [r12]
mov r8d, ebx
mov byte [r11], bl
mov r13, r11
mov cl, bl
jmp 0x140052851
mov al, byte [rdi]
cmp al, 0x3d
jne 0x1400528ca
cmp cl, bl
jle 0x14005284e
mov byte [r11], r8b
mov cl, bl
inc r11
mov r8d, ebx
inc rdi
cmp byte [rdi], bl
jne 0x140052835
mov rcx, r13
mov byte [r11], bl
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, ebx
je 0x1400528ad
movsxd r8, eax
mov r9, rbx
cmp r8, rbx
jle 0x1400528ad
mov eax, 0x66666667
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
inc ebx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
lea rax, [0x1400dcd98]
mov al, byte [rcx + rax]
xor al, byte [r9 + r13]
xor al, bpl
mov byte [r9 + r13], al
inc r9
cmp r9, r8
jl 0x140052870
mov rax, qword [r12]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
cmp al, 0x2b
jne 0x1400528d2
mov al, bl
jmp 0x1400528f0
cmp al, 0x2f
jne 0x1400528da
mov al, 1
jmp 0x1400528f0
cmp al, 0x39
ja 0x1400528e2
add al, 0xd2
jmp 0x1400528f0
cmp al, 0x5a
ja 0x1400528ea
add al, 0xcb
jmp 0x1400528f0
cmp al, 0x7a
ja 0x1400528f5
add al, 0xc5
movzx edx, al
jmp 0x1400528f8
or edx, 0xffffffff
cmp edx, ebx
jl 0x140052801
shl edx, cl
or r8d, edx
add cl, 6
cmp cl, 8
jge 0x14005291d
cmp cl, bl
jle 0x14005284e
cmp byte [rdi], bl
jne 0x14005284e
mov byte [r11], r8b
inc r11
shr r8d, 8
add cl, 0xf8
jmp 0x140052908
Function at 0x14005292c
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15b, r8b
mov r14, rdx
mov r12, rcx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x50]
mov ebp, eax
mov r13d, eax
xor sil, sil
call fcn.14004bc1c
test r15b, r15b
jne 0x140052a5a
mov eax, 0x14
lea rcx, [rsp + 0x50]
cmp ebp, eax
cmovl r13d, eax
lea ebx, [r13 + 4]
mov edx, ebx
call fcn.14004bd00
mov rdi, qword [rsp + 0x50]
movsxd r8, ebx
mov rcx, rdi
xor edx, edx
call fcn.1400b93b0
lea r11d, [rbp + 1]
mov rdx, r12
movsxd r8, r11d
mov rcx, rdi
call fcn.1400177f8
test ebp, ebp
jle 0x1400529cb
mov rax, rbp
add sil, sil
add sil, byte [r12]
inc r12
sub rax, 1
jne 0x1400529bb
mov al, sil
mov ecx, ebp
xor r12d, r12d
shr al, 5
sar ecx, 2
lea r11, [0x140000000]
add cl, al
mov al, sil
shr sil, 2
shl al, 3
movsxd r10, r13d
mov r9d, r12d
add cl, al
mov r8, r12
add cl, sil
add cl, bpl
movzx eax, cl
cdq
and edx, 0x3f
add eax, edx
and eax, 0x3f
sub eax, edx
cmp r10, r12
movsxd rcx, eax
mov sil, byte [rcx + r11 + 0xdcd50]
jle 0x140052a55
mov eax, 0x66666667
imul r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
inc r9d
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
mov al, byte [rcx + r11 + 0xdcd98]
xor al, sil
xor byte [r8 + rdi], al
inc r8
cmp r8, r10
jl 0x140052a1b
mov ebp, r13d
jmp 0x140052a5d
xor r12d, r12d
lea edx, [rbp + rbp*2 + 0x10]
mov rcx, r14
call fcn.14004bf70
mov rbx, qword [r14]
mov word [rbx], r12w
add rbx, 2
mov word [rbx], r12w
cmp byte [rdi], r12b
je 0x140052b6d
cmp r15b, r12b
jne 0x140052a9e
mov eax, 0x23
mov word [rbx], ax
mov word [rbx + 2], ax
movzx eax, sil
mov word [rbx + 4], ax
add rbx, 6
movsxd r8, r13d
mov r9b, 8
mov word [rbx], r12w
movzx edx, byte [rdi]
add r8, rdi
lea r10, [0x140000000]
inc rdi
mov cl, r9b
cmp cl, 6
jge 0x140052aca
cmp cl, r12b
jle 0x140052b27
cmp rdi, r8
jne 0x140052b2a
mov al, dl
and al, 0x3f
cmp r15b, r12b
je 0x140052ae0
movzx eax, al
mov al, byte [rax + r10 + 0xdcd50]
jmp 0x140052b07
cmp al, r12b
jne 0x140052ae9
mov al, 0x2b
jmp 0x140052b07
cmp al, 1
jne 0x140052af1
mov al, 0x2f
jmp 0x140052b07
cmp al, 0xc
jae 0x140052af9
add al, 0x2e
jmp 0x140052b07
cmp al, 0x26
jae 0x140052b01
add al, 0x35
jmp 0x140052b07
cmp al, 0x40
jae 0x140052b07
add al, 0x3b
movzx eax, al
shr edx, 6
mov word [rbx], ax
add rbx, 2
add cl, 0xfa
jns 0x140052abb
mov eax, 0x3d
mov word [rbx], ax
add rbx, 2
jmp 0x140052abb
cmp rdi, r8
jae 0x140052b5d
movzx eax, byte [rdi]
inc rdi
shl eax, cl
add cl, r9b
or edx, eax
cmp rdi, r8
jae 0x140052b5d
movzx eax, byte [rdi]
inc rdi
shl eax, cl
add cl, r9b
or edx, eax
cmp rdi, r8
jae 0x140052b5d
movzx eax, byte [rdi]
inc rdi
shl eax, cl
or edx, eax
add cl, r9b
cmp cl, r12b
jg 0x140052abb
mov word [rbx], r12w
mov rbx, qword [r14]
lea rcx, [rsp + 0x50]
call fcn.140044f24
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140052c04
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea rcx, [rsp + 0x30]
lea edx, [rax + rax*2]
call fcn.14004bc80
mov rdx, qword [rsp + 0x30]
xor ebx, ebx
lea r8, [rdx + 1]
mov byte [rdx], 0x20
mov r9d, ebx
mov byte [r8], bl
mov cl, bl
jmp 0x140052c5e
mov al, byte [rdi]
cmp al, 0x3d
jne 0x140052c97
cmp cl, bl
jle 0x140052c5b
mov byte [r8], r9b
mov cl, bl
inc r8
mov r9d, ebx
inc rdi
cmp byte [rdi], bl
jne 0x140052c46
mov byte [r8], bl
mov r9d, 0xfde9
mov rcx, rsi
or r8d, 0xffffffff
call fcn.14004c024
mov rbx, qword [rsi]
lea rcx, [rsp + 0x30]
call fcn.140044f24
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp al, 0x41
jb 0x140052ca3
cmp al, 0x5a
ja 0x140052ca3
sub al, 0x41
jmp 0x140052cc9
cmp al, 0x61
jb 0x140052caf
cmp al, 0x7a
ja 0x140052caf
sub al, 0x47
jmp 0x140052cc9
cmp al, 0x30
jb 0x140052cbb
cmp al, 0x39
ja 0x140052cbb
add al, 4
jmp 0x140052cc9
cmp al, 0x2b
jne 0x140052cc3
mov al, 0x3e
jmp 0x140052cc9
cmp al, 0x2f
jne 0x140052cf8
mov al, 0x3f
movzx eax, al
shl eax, cl
or r9d, eax
add cl, 6
cmp cl, 8
jge 0x140052ce9
cmp cl, bl
jle 0x140052c5b
cmp byte [rdi], bl
jne 0x140052c5b
mov byte [r8], r9b
inc r8
shr r9d, 8
add cl, 0xf8
jmp 0x140052cd4
mov rax, qword [rsi]
mov word [rax], bx
jmp 0x140052c7a
Function at 0x140054418
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
xor r8d, r8d
call fcn.140045f34
mov rcx, qword [rbx]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_SetEndOfFile]
Function at 0x140054aac
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, rcx
mov r12, rdx
lea rcx, [rax + 0x18]
mov edx, 0xa0000
movsxd rbp, r9d
mov rdi, r8
call fcn.14004bc80
mov rax, qword [rsp + 0x90]
mov r15b, byte [rsp + 0xa0]
and dword [rsp + 0x98], 0
lea r14, [rax + 0x20000]
mov qword [rsp + 0x30], rdi
and r14, 0xfffffffffffe0000
test r15b, r15b
jne 0x140054b17
xor ebp, ebp
xor r13d, r13d
jmp 0x140054b31
mov ecx, 0x1ff
lea rax, [rdi + rbp]
cqo
and rdx, rcx
add rax, rdx
and rax, rcx
sub rax, rdx
mov r13, rax
test rdi, rdi
jle 0x140054c20
mov ecx, 0x10000000
test ebp, ebp
jne 0x140054b4f
movsxd rax, r13d
cmp rdi, rax
jle 0x140054b4f
xor al, al
jmp 0x140054b51
mov al, 1
cmp rdi, rcx
mov esi, edi
mov rdx, r12
cmovg esi, ecx
mov r8d, esi
test al, al
je 0x140054bda
mov esi, 0x200
mov rcx, rbx
sub esi, ebp
mov eax, esi
cmp rax, rdi
cmovg esi, edi
xor edx, edx
lea r8d, [rdx + 1]
call fcn.140045f34
mov rcx, qword [rsp + 0x80]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x98]
mov r8d, 0x200
mov rdx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rcx, ebp
mov r8d, esi
mov rdx, r12
add rcx, r14
call fcn.1400177f8
mov rdx, rbx
mov rbx, qword [rsp + 0x80]
mov rcx, rbx
xor r8d, r8d
call fcn.140045f34
mov r8d, 0x200
mov rdx, r14
jmp 0x140054be8
test r15b, r15b
je 0x140054be8
and esi, 0xfffffe00
mov r8d, esi
and dword [rsp + 0x98], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x98]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r11d, esi
xor ebp, ebp
sub rdi, r11
add r12, r11
mov ecx, 0x10000000
test rdi, rdi
jg 0x140054b3f
lea rcx, [rsp + 0x90]
call fcn.140044f24
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140055688
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rdi, rcx
lea rcx, [0x1400f2c58]
mov esi, r9d
mov r13, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dil, byte [rdi + 0xd]
xor ebp, ebp
cmp esi, ebp
setl r15b
and dil, 0x11
cmp r15b, bpl
jne 0x1400556df
test sil, 0x40
je 0x1400556e2
mov dil, bpl
lea rdx, str.RANDOM
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, ebp
jne 0x14005573e
mov word [rsp + 0x20], bp
call fcn.1400475f0
movabs rdx, 0x7fffffffffffffff
lea rcx, [rsp + 0x20]
and rdx, rax
call fcn.1400a935c
mov edx, 3
mov rcx, r13
mov word [rsp + 0x5e], bp
call fcn.14004bf70
mov rsi, qword [r13]
movzx eax, word [rsp + 0x20]
lea rbp, [rsi + 2]
mov word [rsi], ax
jmp 0x140055890
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r12b, bpl
movsx r14d, dil
cmp r15b, bpl
jne 0x140055766
cmp word [rbx], 0x26
je 0x140055837
cmp dil, bpl
jne 0x140055809
mov edx, 0x52
mov rcx, r13
call fcn.14004bf70
mov rsi, qword [r13]
xor eax, eax
xor ecx, ecx
mov word [rsi], ax
mov rbp, rsi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [r13]
mov r8d, 0x50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
xor eax, eax
cmp edi, eax
jle 0x1400557e3
cmp word [rsi], ax
jne 0x1400557db
lea edx, [rdi + 0xc]
mov rcx, r13
call fcn.14004bf70
mov rsi, qword [r13]
xor eax, eax
xor ecx, ecx
mov word [rsi], ax
mov rbp, rsi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [r13]
lea r8d, [rdi + 0xa]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
xor eax, eax
cmp edi, eax
jg 0x140055889
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x140055883
xor eax, eax
cmp r12b, al
jne 0x14005587f
mov r12b, 1
cmp r15b, al
jne 0x14005587f
xor ebp, ebp
mov rcx, qword [rsp + 0xd0]
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rbx
call fcn.140017d60
cmp rax, rbp
jne 0x140055847
cmp r14d, ebp
jne 0x140055843
cmp r12b, bpl
jne 0x140055843
mov r12b, 1
jmp 0x140055766
add rbx, 2
mov r14d, 1
jmp 0x140055809
mov edi, ebp
jmp 0x140055855
mov rbx, qword [rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea edx, [rdi + 2]
mov rcx, r13
call fcn.14004bf70
mov rsi, qword [r13]
mov rbp, rsi
jmp 0x140055878
movzx eax, word [rbx]
mov word [rbp], ax
add rbp, 2
add rbx, 2
sub edi, 1
jns 0x140055869
jmp 0x140055890
mov edi, eax
jmp 0x140055885
xor eax, eax
cmp edi, eax
jle 0x140055890
movsxd rcx, edi
lea rbp, [rsi + rcx*2]
xor eax, eax
lea rcx, [0x1400f2c58]
mov word [rbp], ax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rax, rsi
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret