joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001570c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000f228
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140015796
cmp byte [rbp - 0x21], r15b
je 0x140015791
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400157cc
call fcn.14000bdac
test eax, eax
jne 0x1400157b8
cmp byte [rbp - 0x21], r15b
je 0x1400157b0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400157cc
cmp byte [rbp - 0x21], r15b
je 0x1400157c9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000e804
test eax, eax
jne 0x14001586c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000f228
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001580b
cmp byte [rbp - 0x21], r15b
je 0x140015840
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140015840
call fcn.14000bdac
test eax, eax
jne 0x14001582c
cmp byte [rbp - 0x21], r15b
je 0x140015825
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140015840
cmp byte [rbp - 0x21], r15b
je 0x14001583d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000e804
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14001586c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14001586f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14001587d
mov rcx, rdi
call fcn.14000bb58
cmp byte [rbp + 0x3f], r15b
je 0x14001588c
mov rcx, qword [rbp + 0x27]
call fcn.14000bb58
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140017dc0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140017de8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140017de8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x46d200
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46d22c
call fcn.0046b140
shl rcx, 3
add rcx, 0x1480
mov qword [0x00d25478], rcx
ret
Function at 0x1400113f2
Capabilities:
Terminate process

Disassembly:
jmp 0x14001d100
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400114fb
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001e450
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001e470
xor al, al
jmp 0x14001e4f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001e483
xor al, al
jmp 0x14001e4f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001e4ad
xor al, al
jmp 0x14001e4f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001e4c1
xor al, al
jmp 0x14001e4f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001e4d3
xor al, al
jmp 0x14001e4f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001e4ef
xor al, al
jmp 0x14001e4f1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001dba0
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
push rbx
mov r8, rcx
xor ebx, ebx
xor eax, eax
xor ecx, ecx
xchg rbx, rsi
cpuid
xchg rbx, rsi
test eax, eax
jle 0x14001dcb2
mov esi, eax
mov eax, 1
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r9d, ecx
mov r10d, edx
mov r11d, eax
cmp esi, 7
jb 0x14001dbed
mov eax, 7
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
and ebx, 0x20
mov dword [r8], r11d
mov eax, r11d
and eax, 0xf
mov dword [r8 + 8], eax
shr r11d, 0xc
and r11d, 3
mov dword [r8 + 4], r11d
mov eax, r10d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r10d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r10d, 0x1a
and r10b, 1
mov byte [r8 + 0xe], r10b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x19], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x14001dce9
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov eax, 0x80000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp eax, 0x80000006
jle 0x14001dced
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
shr edx, 8
and dl, 1
mov byte [r8 + 0x18], dl
test dl, dl
je 0x14001dcf3
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x14001dc85
mov dl, byte [r8 + 0x18]
jmp 0x14001dce1
cmp byte [r8 + 0x19], 0
je 0x14001dce5
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp ebx, 0x7263694d
jne 0x14001dce5
cmp ecx, 0x666f736f
jne 0x14001dce5
cmp edx, 0x76482074
jne 0x14001dce5
mov byte [r8 + 0x18], 1
jmp 0x14001dce5
Function at 0x140030fe0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.14008819c
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140031050]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.14009b824
mov qword [rbx], rax
test rax, rax
je 0x140031037
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [0x14010bab0]
Function at 0x140032ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x140117038]
xor rax, rsp
mov qword [rsp + 0x78], rax
movzx eax, byte [0x140124b58]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x140033077
mov qword [rsp + 0x40], rdx
mov rbx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov rdi, qword [rcx + 8]
xor r13d, r13d
lea r12, [0x140100ba0]
movabs rcx, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x1400fda80]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x48], rbx
mov rbx, qword [rsp + 0x48]
mov rax, r13
shl rax, 4
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm6
mov rdx, qword [rax + r12]
mov rbp, qword [rax + r12 + 8]
mov byte [rsp + 0x77], bpl
mov r8, rbp
add r8, rbp
mov r15, rsi
mov rcx, rsi
call fcn.14008b140
mov word [rsp + rbp*2 + 0x60], 0
movzx eax, byte [rsp + 0x77]
mov rcx, rax
test al, al
jns 0x140032f99
mov rcx, qword [rsp + 0x68]
cmp rcx, rdi
ja 0x1400330d1
mov r14b, 1
test rcx, rcx
mov rsi, r15
je 0x1400330dc
mov rdx, rsi
test al, al
jns 0x140032fbd
mov rdx, qword [rsp + 0x60]
xor ebp, ebp
movzx edi, word [rbx + rbp*2]
cmp di, word [rdx + rbp*2]
jne 0x14003300e
inc rbp
cmp rcx, rbp
jne 0x140032fbf
mov rbp, rcx
test al, al
js 0x1400330e3
test r14b, r14b
jne 0x140033018
mov qword [rsp + 0x28], rbp
inc r13
movzx eax, byte [0x140124b58]
xor rax, 3
cmp r13, rax
mov rdi, qword [rsp + 0x30]
movabs rcx, 0xaaaaaaaaaaaaaaaa
jb 0x140032f51
jmp 0x140033077
xor r14d, r14d
mov rbp, qword [rsp + 0x28]
jmp 0x140032fd4
test rbp, rbp
je 0x140033077
mov rsi, qword [rsp + 0x38]
cmp rbp, qword [rsi + 8]
mov rdi, qword [rsp + 0x40]
je 0x140033077
lea rax, [0x140100bd0]
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], 1
movups xmm0, xmmword [rsi]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx], xmm0
xor r8d, r8d
call fcn.140072a70
mov rdx, qword [rsi + 8]
sub rdx, rbp
jb 0x1400330f5
mov rcx, qword [rdi + 8]
sub rax, rbp
cmp rdx, rax
cmovb rax, rdx
cmp rax, rcx
je 0x1400330a4
xor ebx, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400896c0
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov bl, 1
test rcx, rcx
je 0x140033079
mov rax, qword [rdi]
add rbp, rbp
add rbp, qword [rsi]
xor edx, edx
mov rdi, rbp
movzx ebp, word [rbp + rdx*2]
cmp bp, word [rax + rdx*2]
jne 0x140033077
inc rdx
cmp rcx, rdx
mov rbp, rdi
jne 0x1400330b6
jmp 0x140033079
xor r14d, r14d
mov rsi, r15
jmp 0x140033011
xor ebp, ebp
jmp 0x140032fd4
mov rcx, qword [rsp + 0x60]
call fcn.1400881d8
mov rsi, r15
jmp 0x140032fdc
int3
Function at 0x140045fc0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov edi, edx
mov rsi, rcx
lea rax, [0x1400fd1a0]
mov qword [rcx], rax
add rcx, 8
call fcn.140071a80
lea rcx, [rsi + 0x10]
call fcn.140071a80
xor ebx, ebx
mov byte [rsi + 0x18], bl
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], ebx
call fcn.140071a80
mov byte [rsi + 0x48], bl
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rbx
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
movups xmmword [rsi + 0xd0], xmm6
mov qword [rsi + 0xe0], rbx
mov ebp, 0x3f800000
mov dword [rsi + 0xe8], ebp
mov dword [rsi + 0xf0], ebx
movups xmmword [rsi + 0xf8], xmm6
movups xmmword [rsi + 0x108], xmm6
mov dword [rsi + 0x118], ebp
movups xmmword [rsi + 0x120], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x140], ebp
movups xmmword [rsi + 0x148], xmm6
movups xmmword [rsi + 0x158], xmm6
mov dword [rsi + 0x168], ebp
movups xmmword [rsi + 0x170], xmm6
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], ebp
mov qword [rsi + 0x1b0], rbx
movups xmmword [rsi + 0x198], xmm6
mov dword [rsi + 0x1a8], ebx
mov eax, dword [0x140106ebc]
mov dword [rsi + 0x1b8], eax
lea rcx, [rsi + 0x1c0]
call fcn.140053190
lea rcx, [rsi + 0x310]
movups xmmword [rsi + 0x2f8], xmm6
mov qword [rsi + 0x308], rbx
xor edx, edx
call fcn.140050660
lea rcx, [rsi + 0x318]
xor edx, edx
call fcn.140050660
lea rcx, [rsi + 0x320]
xor edx, edx
call fcn.140050660
movups xmmword [rsi + 0x328], xmm6
movups xmmword [rsi + 0x338], xmm6
mov dword [rsi + 0x348], ebp
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x360], xmm6
movups xmmword [rsi + 0x370], xmm6
mov byte [rsi + 0x380], bl
mov dword [rsi + 0x384], edi
mov byte [rsi + 0x388], bl
movups xmmword [rsi + 0x390], xmm6
movups xmmword [rsi + 0x3a0], xmm6
call fcn.140019e90
call fcn.140044af0
mov dword [rsi + 0x1a8], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x1a0], rax
mov rcx, rsi
call fcn.1400461f0
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x1400461db
call fcn.1400528d0
lea r8, [0x1401020ba]
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140052980
mov qword [0x1401279a8], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x140133008]
jmp 0x1400461a9
Function at 0x140078180
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x140117038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.14006ed80
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [0x14010bc80]
movsd xmm0, qword [0x140127568]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x1400781dd
jnp 0x140078242
ucomisd xmm0, xmm6
jne 0x1400781e9
jnp 0x14007836c
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x1400fde60]
subpd xmm1, xmmword [0x1400fde70]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x140101eb8]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400896c0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rbx, qword [0x14010ba50]
call rbx
mov rcx, rax
call qword [0x14010bb68]
mov r12d, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [0x14010bd48]
mov eax, dword [0x140127578]
mov ecx, dword [0x140120788]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140078373
mov eax, dword [0x140127588]
mov ecx, dword [0x140120788]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400783ad
rdtsc
mov r14, rax
mov r15, rdx
xor edi, edi
lea rbx, [rsp + 0x30]
mov qword [rbx], rdi
mov rcx, rbx
call qword [0x14010bc70]
mov rbp, qword [rbx]
call qword [0x14010ba50]
mov rcx, rax
mov edx, r12d
call qword [0x14010bd48]
mov qword [rbx], rdi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [0x14010bc78]
sub rbp, qword [0x140127580]
movq xmm1, rbp
punpckldq xmm1, xmmword [0x1400fde60]
subpd xmm1, xmmword [0x1400fde70]
haddpd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x140101eb0]
ucomisd xmm2, xmm1
ja 0x1400781dd
shl r15, 0x20
or r14, r15
sub r14, qword [0x140127570]
movq xmm0, r14
punpckldq xmm0, xmmword [0x1400fde60]
subpd xmm0, xmmword [0x1400fde70]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x140127568], xmm0
jmp 0x1400781dd
xor eax, eax
jmp 0x14007821b
lea rcx, [0x140127578]
call fcn.1400882f0
cmp dword [0x140127578], 0xffffffff
jne 0x14007828c
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x140127570], rdx
lea rcx, [0x140127578]
call fcn.140088388
jmp 0x14007828c
lea rcx, [0x140127588]
call fcn.1400882f0
cmp dword [0x140127588], 0xffffffff
jne 0x1400782b1
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [0x14010bc70]
mov rax, qword [rbx]
mov qword [0x140127580], rax
lea rcx, [0x140127588]
call fcn.140088388
jmp 0x1400782b1

Function at 0x14007c330
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
test r8, r8
je 0x14007c35b
xor ecx, ecx
lea r9, [0x1401063e0]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
inc rcx
cmp r8, rcx
jne 0x14007c340
ret
Function at 0x14007df30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x14007e013
test rax, rax
jne 0x14007e002
cmp dword [rsi + 0x50], 0
jne 0x14007e002
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x14007e053
lea rdi, [rsi + 0x20]
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400683c0
cmp rax, 0xffffffffffffffff
jne 0x14007e041
cmp dword [rsi + 0x58], 1
je 0x14007e01c
mov rax, qword [rsi + 0x10]
mov bl, 1
cmp rax, qword [rsi + 0x18]
je 0x14007e059
movabs r14, 0x100003600
nop dword [rax]
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400683c0
cmp rax, 0xffffffffffffffff
jne 0x14007e059
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x14007dff1
inc rax
mov qword [rsi + 0x10], rax
cmp rax, qword [rsi + 0x18]
jne 0x14007dfc0
jmp 0x14007e059
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x14007dfe2
bt r14, rcx
jae 0x14007dfe2
jmp 0x14007e059
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400e8420
mov rax, qword [rsi + 0x40]
jmp 0x14007df48
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x14007df9f
movabs rcx, 0x100003600
bt rcx, rax
jae 0x14007df9f
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x14007df75
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14009ba44
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14009bb98

Function at 0x1400ddef0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov edi, 2
cmp rdx, 1
jne 0x1400ddf2a
mov rsi, qword [r14 + 8]
cmp rdi, rsi
ja 0x1400de025
jae 0x1400de01b
mov rax, qword [r14 + 0x18]
test rax, rax
js 0x1400ddf45
cvtsi2ss xmm0, rax
jmp 0x1400ddf5a
lea rax, [rdx - 1]
test rdx, rax
jne 0x1400ddf38
mov rdi, rdx
jmp 0x1400ddf07
mov rcx, rdx
call fcn.1400667d0
mov rdi, rax
jmp 0x1400ddf07
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [r14 + 0x20]
call fcn.1400bac70
cvttss2si rcx, xmm0
mov rdx, rcx
subss xmm0, dword [0x1400fe520]
cvttss2si rax, xmm0
sar rdx, 0x3f
and rax, rdx
or rax, rcx
cmp rsi, 3
jb 0x1400de007
mov rcx, rsi
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rbx, rsi
sub rbx, rdx
movabs rdx, 0x3333333333333333
mov rcx, rbx
shr rcx, 2
and rbx, rdx
and rcx, rdx
add rcx, rbx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x1400de007
cmp rax, 2
jb 0x1400de00f
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x1400de00f
mov rcx, rax
call fcn.1400667d0
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rsi
jb 0x1400de025
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, r14
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400bfb90
Function at 0x140004890
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r14d, 0x13cc
mov eax, dword [r14 + rsi]
mov r12d, 0x13d0
test al, 1
jne 0x140004938
or eax, 1
mov dword [r14 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [r15 + 1]
lea r8, [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140004910
mov dword [rbx], 0x270
mov eax, dword [r14 + rsi]
mov ebx, Ordinal_26
test al, 2
jne 0x140004959
or eax, 2
mov dword [r14 + rsi], eax
mov qword [rsi + rbx], r15
mov qword [rsi + rbx + 8], 9
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
cmp rbp, 0xf
je 0x140004998
jbe 0x14000498f
mov rdx, rbp
mov rcx, rdi
call fcn.1400120f0
mov qword [rdi + 0x10], r15
jmp 0x140004998
test rbp, rbp
je 0x140004a42
lea r15, [rsi + rbx]
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789
nop dword [rax]
dec rbp
mov qword [rsp + 0x28], rbx
mov r14, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, r14
cmp rdx, 0xffffffffffffffff
jne 0x1400049e5
mov rcx, rbx
call fcn.140013a10
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.140013a10
mov eax, eax
or rsi, rax
jmp 0x1400049f5
inc rdx
lea rcx, [rsp + 0x28]
call fcn.140013460
mov rsi, rax
lea rax, [rsi + r14]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140004a2a
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140004a1f
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140004a39
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.1400124f0
test rbp, rbp
jne 0x1400049b0
mov rax, rdi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140004a60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea r14d, [rbp + 0xc]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x13c8
mov eax, dword [r15 + rsi]
mov r12d, 0x40
test al, 1
jne 0x140004af9
or eax, 1
mov dword [r15 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [rbp + 1]
lea r8, [rbx + 8]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140004ad1
mov dword [rbx], 0x270
mov eax, dword [r15 + rsi]
mov ecx, Ordinal_41
test al, 2
jne 0x140004b1a
or eax, 2
mov dword [r15 + rsi], eax
mov qword [rsi + rcx], rbp
mov qword [rsi + rcx + 8], 0x3d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
lea r15, [rsi + rcx]
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
nop dword [rax + rax]
dec r14
mov qword [rsp + 0x28], rbx
mov rbp, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x140004b85
mov rcx, rbx
call fcn.140013a10
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.140013a10
mov eax, eax
or rsi, rax
jmp 0x140004b95
inc rdx
lea rcx, [rsp + 0x28]
call fcn.140013460
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140004bca
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140004bbf
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140004bd9
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.1400124f0
test r14, r14
jne 0x140004b50
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret