joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030e40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x58], rsi
mov rsi, rcx
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140041db8.0]
cmp qword [0x1403ebb08], 0
je 0x140030ecd
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1403ebb08]
mov rdi, qword [rsp + 0x50]
sub rdi, qword [rsp + 0x40]
cmp rdi, qword [rax + 0x40]
jbe 0x140030ecd
xor ecx, ecx
call fcn.1400cd940
mov r9, qword [rsp + 0x40]
lea rdx, str.FGenericReadRequestWorker::DoWork
mov rcx, qword [0x1403ebb08]
mov r8d, eax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400cac50
lock dec dword [rsi + 0x10]
cmp qword [0x1403ebb08], 0
mov rsi, qword [rsp + 0x58]
je 0x140030f2e
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1403ebb08]
mov rdi, qword [rsp + 0x40]
sub rdi, qword [rsp + 0x48]
cmp rdi, qword [rax + 0x40]
jbe 0x140030f2e
xor ecx, ecx
call fcn.1400cd940
mov r9, qword [rsp + 0x48]
lea rdx, str.FAsyncTask::DoWork
mov rcx, qword [0x1403ebb08]
mov r8d, eax
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400cac50
add rsp, 0x30
pop rdi
ret

Function at 0x140031da0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
movzx ebx, dl
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor esi, esi
test bl, bl
je 0x140031e14
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140031e03
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x140041db8.0]
test al, al
je 0x140031e14
mov rcx, rdi
call fcn.140030e40
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x140031e36
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140041db8.0]
jmp 0x140031e36
xor eax, eax
lock cmpxchg dword [rdi + 0x10], esi
je 0x140031e14
mov rcx, rdi
call fcn.140030e40
sfence
cmp qword [rdi + 0x20], rsi
je 0x140031e3a
mov rcx, qword [rdi + 0x18]
xor r8d, r8d
mov edx, 0xffffffff
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140041db8.0]
mov qword [rdi + 0x20], rsi
cmp qword [0x1403ebb08], 0
je 0x140031e93
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1403ebb08]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
sub rdi, rbx
cmp rdi, qword [rax + 0x40]
jbe 0x140031e93
xor ecx, ecx
call fcn.1400cd940
mov rcx, qword [0x1403ebb08]
lea rdx, str.FAsyncTask::EnsureCompletion
mov r8d, eax
mov r9, rbx
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400cac50
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140033830
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x30], eax
jne 0x1400338fd
cmp rsi, qword [rbx + 0x48]
jb 0x1400338c9
mov rcx, rbx
call fcn.140035420
mov ecx, eax
add rcx, qword [rbx + 0x48]
cmp rsi, rcx
jae 0x1400338c9
xor ecx, ecx
lea r8, [0x14038cb68]
movsxd rax, ecx
imul rbx, rax, 0x4020
add rbx, r8
mov edx, dword [rbx + 0x4018]
cmp dword [rbx], edx
jae 0x140033893
mov eax, dword [rbx + 0x10]
sub eax, 0x10
cmp dword [rsi - 0x10], eax
jbe 0x1400338a5
inc ecx
cmp ecx, 0xe
jb 0x140033871
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor ecx, ecx
test edx, edx
je 0x1400338c9
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx + rcx*8 + 0x18]
mov rax, qword [rdi + 8]
cmp rax, rsi
je 0x1400338d4
inc ecx
cmp ecx, edx
jb 0x1400338b0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov r8, qword [rdi]
mov edx, 0xcd
mov rcx, rax
call fcn.140260ab0
mov qword [rdi], 0
dec dword [rbx]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp fcn.1400e9e70

Function at 0x140038840
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x14037ec08]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r12d, r12d
lea r14, [rsp + 0x40]
mov ebx, r12d
lea rbp, [r11 + 0x10]
mov rdi, rcx
mov esi, 0x400
call fcn.140023640
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x20], r12
mov r8d, 0x200
mov r15, rax
mov rcx, qword [rax]
call qword [0x1402729b8]
test eax, eax
mov ebp, 0xffffffff
cmovs eax, ebp
cmp eax, 0x200
jae 0x1400388d0
cmp eax, ebp
jne 0x14003892a
nop dword [rax + rax]
mov rcx, rbx
call qword [0x1402727f8]
movsxd rdi, esi
lea rcx, [rdi + rdi]
call qword [0x1402727e8]
mov rbx, rax
mov r14, rax
test rax, rax
je 0x140038942
mov r9, qword [rsp + 0x490]
lea rax, [rsp + 0x498]
mov rcx, qword [r15]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov qword [rsp + 0x20], r12
call qword [0x1402729b8]
test eax, eax
cmovs eax, ebp
cmp eax, esi
cmovge eax, ebp
add esi, esi
cmp eax, ebp
je 0x1400388d0
cdqe
mov rcx, r14
mov word [r14 + rax*2], r12w
call sub.KERNEL32.dll_OutputDebugStringW
mov rcx, rbx
call qword [0x1402727f8]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14025eac0
add rsp, 0x450
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140038d90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp r8d, 0x10
jbe 0x140038db2
lea rcx, str.Alignment___16_is_not_supported_n
call sub.KERNEL32.dll_OutputDebugStringW
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsi + 0x30], eax
jne 0x140038f07
xor ebp, ebp
lea r10, [0x14038cb68]
mov edx, ebp
nop word [rax + rax]
movsxd rax, edx
imul rax, rax, 0x4020
add rax, r10
mov r9d, dword [rax]
mov r8d, dword [rax + 0x4018]
cmp r9d, r8d
jae 0x140038e06
mov ecx, dword [rax + 0x10]
sub ecx, 0x10
cmp edi, ecx
jbe 0x140038e68
inc edx
cmp edx, 0xe
jb 0x140038de0
mov eax, dword [rsi + 0x40]
lea ecx, [rdi + 0x10]
add eax, 0xf
mov r8d, 0x200000
and eax, 0xfffffff0
mov edx, edi
add ecx, eax
mov dword [rsi + 0x40], eax
cmp ecx, r8d
ja 0x140038ee3
mov rbx, qword [rsi + 0x38]
mov dword [rsi + 0x40], ecx
mov ecx, eax
add rbx, rcx
mov eax, edi
mov qword [rbx], rax
mov rax, qword [rsi + 0x38]
add rax, 0x10
add rcx, rax
mov qword [rbx + 8], rcx
lea rcx, str.Malloc_Size_d_LargeMemoryPoolOffset_d__n
mov r8d, dword [rsi + 0x40]
call fcn.140038840
mov rax, qword [rbx + 8]
jmp 0x140038f0e
mov edx, ebp
test r8d, r8d
je 0x140038e83
nop
mov ecx, edx
mov rbx, qword [rax + rcx*8 + 0x18]
cmp qword [rbx], rbp
je 0x140038ea9
inc edx
cmp edx, r8d
jb 0x140038e70
mov edx, edi
lea rcx, str.AllocateFromPool_run_out_of_memory_allocating__u_bytes_for__u_allocations_n
call fcn.140038840
lea rcx, str.Please_increase_MaxNumAllocations_for_that_pool__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400e8840
mov rax, rbp
jmp 0x140038f0e
cmp dword [rax + 4], edx
mov r8d, edi
cmovae edx, dword [rax + 4]
inc dword [rax + 0xc]
mov dword [rax + 4], edx
lea edx, [r9 + 1]
cmp dword [rax + 8], edx
mov dword [rax], edx
cmovae edx, dword [rax + 8]
mov dword [rax + 8], edx
mov edx, 0xfe
mov rcx, qword [rbx + 8]
mov qword [rbx], r8
call fcn.140260ab0
mov rbp, qword [rbx + 8]
mov rax, rbp
jmp 0x140038f0e
sub r8d, eax
lea rcx, str.MallocCrash_run_out_of_memory_allocating__u_bytes__free__u_bytes_n
call fcn.140038840
lea rcx, str.Please_increase_LARGE_MEMORYPOOL_SIZE__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400e8840
jmp 0x140038f0c
call fcn.1400e9e70
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14004bba0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, [0x140291ea8]
mov qword [rcx + 8], rdx
mov qword [rcx], rax
mov rdi, rcx
mov byte [rcx + 0x10], 0
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
lea rcx, [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor eax, eax
mov dword [rdi + 0x7c], 0x80
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x58], rax
mov qword [rdi + 0x70], rax
mov dword [rdi + 0x78], eax
mov dword [rdi + 0x84], eax
mov qword [rdi + 0x90], rax
mov dword [rdi + 0x98], eax
mov qword [rdi + 0xa0], rax
mov qword [rdi + 0xa8], rax
mov dword [rdi + 0x80], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov dword [rdi + 0x40], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140055990
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx], 0xffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x1400559c1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov eax, 0xffffffff
lock cmpxchg dword [rdi], ecx
cmp eax, 0xffffffff
je 0x1400559c1
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140055a35
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rsi
call qword [case.0x140041db8.0]
mov ecx, dword [0x1403caf34]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140055a22
lea rbx, [rax + 0x30]
mov qword [rsp + 0x30], rbp
movsxd rbp, dword [rbx + 8]
lea ecx, [rbp + 1]
mov dword [rbx + 8], ecx
cmp ecx, dword [rbx + 0xc]
jle 0x140055a16
mov edx, ebp
mov rcx, rbx
call fcn.140061fb0
mov rax, qword [rbx]
mov qword [rax + rbp*8], rsi
mov rbp, qword [rsp + 0x30]
mov ecx, dword [rdi]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400674d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push r14
sub rsp, 0x38
mov r14, rdx
mov r12, rcx
movsxd rdx, dword [rcx + 8]
test edx, edx
jne 0x1400674f1
xor eax, eax
add rsp, 0x38
pop r14
pop r12
ret
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rsp + 0x58], rbx
movabs r9, 0x10ffffffc0ffe5
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
movzx ecx, word [rax]
mov qword [rsp + 0x30], rdi
mov edi, r8d
mov qword [rsp + 0x28], r13
mov r13d, r8d
mov qword [rsp + 0x20], r15
test cx, cx
je 0x14006753d
cmp cx, 0x2f
jne 0x140067601
mov rax, qword [r14]
mov dword [rax], r8d
mov bpl, 1
mov r15, rdx
mov rbx, r8
nop word [rax + rax]
movsxd rdx, edi
inc rbx
inc edi
cmp rbx, r15
jge 0x14006758e
nop dword [rax]
mov rax, qword [r12]
movzx eax, word [rax + rbx*2]
test ax, ax
je 0x14006757d
cmp ax, 0x2f
jne 0x140067633
mov rax, qword [r14]
mov dword [rax], r8d
mov al, 1
cmp bpl, al
jne 0x14006758e
inc edi
inc rbx
cmp rbx, r15
jl 0x140067560
mov esi, edi
sub esi, edx
test bpl, bpl
je 0x1400675c6
cmp r13d, edx
je 0x1400675c3
mov rcx, qword [r12]
movsxd rax, r13d
movsxd r8, esi
add r8, r8
lea rdx, [rcx + rdx*2]
lea rcx, [rcx + rax*2]
call fcn.140260aa6
xor r8d, r8d
movabs r9, 0x10ffffffc0ffe5
add r13d, esi
xor bpl, 1
cmp rbx, r15
jl 0x140067550
mov rdi, qword [rsp + 0x30]
mov eax, r15d
mov r15, qword [rsp + 0x20]
sub eax, r13d
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov dword [r12 + 8], r13d
mov r13, qword [rsp + 0x28]
add rsp, 0x38
pop r14
pop r12
ret
lea eax, [rcx - 0x2b]
cmp ax, 0x34
ja 0x140067613
movzx eax, ax
bt r9, rax
jb 0x14006761d
sub cx, 0x61
cmp cx, 0x19
ja 0x14006762b
mov rax, qword [r14]
inc dword [rax]
cmp dword [rax], 0xe
jle 0x14006753d
xor bpl, bpl
jmp 0x140067540
lea ecx, [rax - 0x2b]
cmp cx, 0x34
ja 0x140067645
movzx ecx, cx
bt r9, rcx
jb 0x14006764f
sub ax, 0x61
cmp ax, 0x19
ja 0x14006765d
mov rax, qword [r14]
inc dword [rax]
cmp dword [rax], 0xe
jle 0x14006757d
xor al, al
jmp 0x14006757f

Function at 0x140067670
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
movzx eax, word [rcx]
lea r9, [rcx + 2]
not edx
test ax, ax
je 0x1400676d9
lea r10, [0x14036f430]
nop word [rax + rax]
movzx r8d, ax
lea r9, [r9 + 2]
mov eax, edx
shr edx, 8
xor rax, r8
shr r8, 8
movzx ecx, al
xor edx, dword [r10 + rcx*4]
mov eax, edx
shr edx, 8
xor r8, rax
movzx eax, r8b
xor edx, dword [r10 + rax*4]
movzx eax, word [r9 - 2]
movzx ecx, dl
shr edx, 8
xor edx, dword [r10 + rcx*4]
movzx ecx, dl
shr edx, 8
xor edx, dword [r10 + rcx*4]
test ax, ax
jne 0x140067690
not edx
mov eax, edx
ret
Function at 0x1400884c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r13
sub rsp, 0x48
movsxd rdi, dword [rdx + 8]
mov r13, rcx
cmp edi, 1
jg 0x1400884e4
call fcn.140023dc0
mov rax, r13
add rsp, 0x48
pop r13
pop rdi
ret
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x20]
mov rbx, qword [rdx]
xor r8d, r8d
mov qword [rsp + 0x40], r12
mov edx, edi
xor r12d, r12d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], edi
call fcn.1400228d0
mov r15, qword [rsp + 0x20]
mov r8, rdi
add r8, r8
mov rdx, rbx
mov rcx, r15
call fcn.140260aa0
movsxd rdx, dword [rsp + 0x28]
test edx, edx
je 0x14008861b
movzx ecx, word [r15]
mov edi, r12d
mov qword [rsp + 0x68], rbp
movabs r8, 0x43ffffff95ffb
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x38], r14
test cx, cx
je 0x14008857a
lea eax, [rcx - 0x2d]
cmp ax, 0x32
ja 0x14008856b
movzx eax, ax
bt r8, rax
jb 0x14008857a
sub cx, 0x61
cmp cx, 0x19
jbe 0x14008857a
xor bpl, bpl
jmp 0x14008857d
mov bpl, 1
mov r14, rdx
mov rbx, r12
movsxd rdx, edi
inc rbx
inc edi
cmp rbx, r14
jge 0x1400885cb
movzx eax, word [r15 + rbx*2]
test ax, ax
je 0x1400885ba
lea ecx, [rax - 0x2d]
cmp cx, 0x32
ja 0x1400885ac
movzx ecx, cx
bt r8, rcx
jb 0x1400885ba
sub ax, 0x61
cmp ax, 0x19
jbe 0x1400885ba
xor al, al
jmp 0x1400885bc
mov al, 1
cmp bpl, al
jne 0x1400885cb
inc edi
inc rbx
cmp rbx, r14
jl 0x140088590
mov esi, edi
sub esi, edx
test bpl, bpl
je 0x1400885fc
cmp r12d, edx
je 0x1400885f9
movsxd rax, r12d
lea rdx, [r15 + rdx*2]
movsxd r8, esi
add r8, r8
lea rcx, [r15 + rax*2]
call fcn.140260aa6
movabs r8, 0x43ffffff95ffb
add r12d, esi
xor bpl, 1
cmp rbx, r14
jl 0x140088583
mov r14, qword [rsp + 0x38]
mov edx, r12d
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov eax, dword [rsp + 0x2c]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov qword [r13], r15
mov r15, qword [rsp + 0x30]
mov dword [r13 + 0xc], eax
mov rax, r13
mov dword [r13 + 8], edx
add rsp, 0x48
pop r13
pop rdi
ret

Function at 0x140095cd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1403cde64]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140095d22
lea ecx, [rax + 0x10]
mov qword [rsp + 0x20], rbx
call fcn.14001c7e0
mov rbx, rax
test rax, rax
je 0x140095d08
mov byte [rax], 5
xor eax, eax
mov qword [rbx + 4], rax
mov dword [rbx + 0xc], eax
jmp 0x140095d0b
mov rbx, rax
mov ecx, dword [0x1403cde64]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x140099790
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
lea r9, [0x1402969b0]
jmp 0x14009b2d0
mov qword [rsp + 0x10], rbx
push rdi
mov rdi, r9
mov rbx, r8
mov r11d, edx
mov r10, rcx
test edx, edx
je 0x14009b303
nop word [rax + rax]
lea ecx, [r11 - 1]
cmp word [r10 + rcx*2], 0x3d
jne 0x14009b303
mov r11d, ecx
test ecx, ecx
jne 0x14009b2f0
mov eax, r11d
mov qword [rsp + 0x10], rsi
and al, 3
cmp al, 1
je 0x14009b3e9
xor edx, edx
mov esi, 0x100
cmp r11d, 4
jb 0x14009b380
nop dword [rax]
nop word [rax + rax]
mov eax, edx
mov r9d, edx
movzx ecx, word [r10]
add r10, 2
cmp cx, si
jae 0x14009b3e9
movzx r8d, byte [rcx + rdi]
cmp r8b, 0xff
je 0x14009b3e9
shl eax, 6
inc r9d
or eax, r8d
cmp r9d, 4
jl 0x14009b335
mov byte [rbx + 2], al
add r11d, 0xfffffffc
shr eax, 8
mov byte [rbx + 1], al
shr eax, 8
mov byte [rbx], al
add rbx, 3
cmp r11d, 4
jae 0x14009b330
test r11d, r11d
je 0x14009b3db
mov r8d, edx
nop dword [rax + rax]
movzx eax, word [r10]
lea r10, [r10 + 2]
cmp ax, si
jae 0x14009b3e9
movzx ecx, byte [rax + rdi]
cmp cl, 0xff
je 0x14009b3e9
shl edx, 6
inc r8d
or edx, ecx
cmp r8d, r11d
jb 0x14009b390
cmp r11d, 4
jge 0x14009b3ca
mov ecx, 4
sub ecx, r11d
shl edx, 6
sub rcx, 1
jne 0x14009b3c1
shr edx, 8
cmp r11d, 3
jb 0x14009b3d6
mov byte [rbx + 1], dl
shr edx, 8
mov byte [rbx], dl
mov al, 1
mov rsi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
pop rdi
ret
mov rsi, qword [rsp + 0x10]
xor al, al
mov rbx, qword [rsp + 0x18]
pop rdi
ret

Function at 0x14009b400
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov rsi, r8
mov ebx, edx
mov r11, rcx
mov r10, r8
cmp edx, 3
jb 0x14009b4aa
mov eax, 0xaaaaaaab
mov qword [rsp + 0x10], rdi
mul ebx
shr edx, 1
mov edi, edx
nop word [rax + rax]
movzx ecx, byte [r11 + 1]
add ebx, 0xfffffffd
movzx r8d, byte [r11]
movzx edx, byte [r11 + 2]
add r11, 3
shl r8d, 8
or r8d, ecx
shl r8d, 8
or r8d, edx
mov eax, r8d
shr r8d, 6
and eax, 0x3f
mov ecx, r8d
shr rcx, 6
movzx eax, byte [rax + r9]
mov word [r10 + 6], ax
mov eax, r8d
and eax, 0x3f
movzx eax, byte [rax + r9]
mov word [r10 + 4], ax
mov rax, rcx
and eax, 0x3f
shr rcx, 6
movzx eax, byte [rax + r9]
mov word [r10 + 2], ax
movzx eax, byte [rcx + r9]
mov word [r10], ax
add r10, 8
sub rdi, 1
jne 0x14009b430
mov rdi, qword [rsp + 0x10]
test ebx, ebx
je 0x14009b512
movzx ecx, byte [r11]
xor al, al
cmp ebx, 2
jne 0x14009b4be
movzx eax, byte [r11 + 1]
shl ecx, 8
mov r8d, 0x3d
movzx eax, al
or ecx, eax
mov word [r10 + 6], r8w
shl ecx, 8
shr ecx, 6
mov edx, ecx
cmp ebx, 1
je 0x14009b4e8
mov eax, ecx
and eax, 0x3f
movzx r8d, byte [rax + r9]
mov word [r10 + 4], r8w
shr rdx, 6
mov rax, rdx
shr rdx, 6
and eax, 0x3f
movzx eax, byte [rax + r9]
mov word [r10 + 2], ax
movzx eax, byte [rdx + r9]
mov word [r10], ax
add r10, 8
mov rbx, qword [rsp + 0x18]
xor eax, eax
mov word [r10], ax
sub r10, rsi
sar r10, 1
mov eax, r10d
pop rsi
ret
Function at 0x14009c1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push r14
sub rsp, 0x58
mov r14, rdx
mov rsi, rcx
cmp rcx, rdx
je 0x14009c3af
mov qword [rsp + 0x50], rbx
mov r9d, 4
mov qword [rsp + 0x48], rbp
lea rbx, [rcx + 0x38]
mov qword [rsp + 0x40], rdi
mov rcx, rbx
movsxd rdi, dword [rdx + 0x48]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x28], r15
call fcn.140019620
mov rax, qword [r14 + 0x40]
lea rdx, [r14 + 0x38]
mov r9, qword [rbx + 8]
mov r8, rdi
shl r8, 2
test rax, rax
cmovne rdx, rax
test r9, r9
cmovne rbx, r9
mov rcx, rbx
call fcn.140260aa0
mov dword [rsi + 0x48], edi
mov rcx, rsi
movsxd rbx, dword [r14 + 8]
mov edx, ebx
call fcn.1400774b0
mov edx, dword [rsi + 8]
lea eax, [rdx + rbx]
mov dword [rsi + 8], eax
cmp eax, dword [rsi + 0xc]
jle 0x14009c25a
mov rcx, rsi
call fcn.140087830
mov eax, dword [r14 + 0x30]
lea r15, [r14 + 0x10]
lea rcx, [rsi + 0x10]
mov dword [rsi + 0x30], eax
mov eax, dword [r14 + 0x34]
mov dword [rsi + 0x34], eax
cmp rcx, r15
je 0x14009c27d
mov rdx, r15
call fcn.140029600
mov rax, qword [r14]
xor ebp, ebp
mov rcx, qword [rsi]
mov r14, rbx
test ebx, ebx
jle 0x14009c3aa
sub rax, rcx
mov qword [rsp + 0x38], r12
lea rbx, [rcx + 0x1c]
mov qword [rsp + 0x30], r13
lea edi, [rbp + 1]
lea rcx, [rax - 0xc]
mov qword [rsp + 0x78], rcx
lea r12, [rax - 0x18]
mov rsi, qword [rsp + 0x78]
lea rcx, [rax + 0x44]
mov qword [rsp + 0x80], rcx
lea r13, [rax - 0x1c]
lea rcx, [rax + 0x48]
mov qword [rsp + 0x88], rcx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r15 + 0x10]
lea rdx, [rbx + r13]
test rax, rax
lea rcx, [rbx - 0x1c]
mov r8, r15
cmovne r8, rax
mov eax, ebp
test ebp, ebp
jns 0x14009c2ff
lea eax, [rbp + 0x1f]
sar eax, 5
cdqe
test dword [r8 + rax*4], edi
je 0x14009c362
call fcn.140023dc0
xor eax, eax
mov dword [rbx + 0x20], 0x80
lea rcx, [rbx - 0xc]
mov qword [rbx - 4], rax
lea rdx, [rsi + rbx]
mov qword [rcx], rax
mov qword [rbx + 0x14], rax
mov dword [rbx + 0x1c], eax
mov dword [rbx + 0x28], eax
mov qword [rbx + 0x34], rax
mov dword [rbx + 0x3c], eax
mov dword [rbx + 0x24], 0xffffffff
call fcn.14002c570
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx + rbx]
mov dword [rbx + 0x44], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + rbx]
mov dword [rbx + 0x48], eax
jmp 0x14009c36d
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, dword [rbx + r12]
mov dword [rbx - 0x18], eax
inc ebp
rol edi, 1
add rbx, 0x68
sub r14, 1
jne 0x14009c2e0
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x28]
add rsp, 0x58
pop r14
pop rsi
ret
mov rax, rsi
jmp 0x14009c38e
mov rax, rsi
add rsp, 0x58
pop r14
pop rsi
ret
Function at 0x1400b3ce0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
sub rsp, 0x50
cmp qword [rcx + 0x80], 0
mov rsi, rcx
je 0x1400b3eb0
mov qword [rsp + 0x70], rbx
mov ecx, 0x48
mov qword [rsp + 0x48], rdi
call fcn.14001c7e0
mov rdi, rax
test rax, rax
je 0x1400b3e09
cmp dword [rsi + 0xa8], 0
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
je 0x1400b3d3d
mov rbp, qword [rsi + 0xa0]
jmp 0x1400b3d44
lea rbp, [0x140280be0]
lea rax, str._J_v_
mov qword [rdi], rax
mov rcx, qword [rsi + 0x90]
mov rax, qword [rsi + 0x80]
movzx r12d, byte [rsi + 0xb0]
movzx r13d, byte [rsi + 0x98]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x30], 0
mov qword [rdi + 0x38], 0
test rbp, rbp
je 0x1400b3deb
cmp word [rbp], 0
je 0x1400b3deb
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rbp + rbx*2], 0
jne 0x1400b3da0
inc ebx
xor edx, edx
xor ecx, ecx
test ebx, ebx
jle 0x1400b3dc6
mov edx, ebx
lea rcx, [rdi + 0x30]
call fcn.140019a30
mov edx, dword [rdi + 0x38]
mov ecx, dword [rdi + 0x3c]
lea eax, [rdx + rbx]
mov dword [rdi + 0x38], eax
cmp eax, ecx
jle 0x1400b3dd9
lea rcx, [rdi + 0x30]
call fcn.1400197d0
mov rcx, qword [rdi + 0x30]
mov rdx, rbp
movsxd r8, ebx
add r8, r8
call fcn.140038f30
mov r15, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x78]
mov byte [rdi + 0x40], r12b
mov r12, qword [rsp + 0x40]
mov byte [rdi + 0x41], r13b
mov r13, qword [rsp + 0x38]
jmp 0x1400b3e0b
xor edi, edi
mov rbx, qword [0x1403caef8]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
sfence
test rbx, rbx
je 0x1400b3e3a
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x140041db8.0]
jmp 0x1400b3e42
mov rcx, rdi
call fcn.1400b4a70
cmp qword [0x1403ebb08], 0
je 0x1400b3e9b
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1403ebb08]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
sub rdi, rbx
cmp rdi, qword [rax + 0x40]
jbe 0x1400b3e9b
xor ecx, ecx
call fcn.1400cd940
mov rcx, qword [0x1403ebb08]
lea rdx, str.FAutoDeleteAsyncTask::Start
mov r8d, eax
mov r9, rbx
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
call fcn.1400cac50
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x70]
mov qword [rsi + 0x80], 0
movzx eax, byte [rsi + 9]
shr al, 1
not al
and al, 1
add rsp, 0x50
pop rsi
ret