joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043004
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12, rdx
mov rdi, rcx
lea rdx, [rsp + 0x50]
mov r15, r9
mov rbx, r8
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
mov r10d, dword [rsp + 0x50]
mov r9d, 0
mov r11, rax
mov eax, 0x811c9dc5
add r10, r10
je 0x140043062
movzx ecx, byte [r9 + r11]
inc r9
xor ecx, eax
imul eax, ecx, 0x1000193
cmp r9, r10
jb 0x14004304d
xor edx, edx
mov dword [r15], eax
div dword [rdi + 0x18]
mov rdi, qword [rdi + 8]
mov dword [rbx], edx
test rdi, rdi
je 0x1400430e8
mov r14, qword [rsp + 0x70]
xor esi, esi
mov rdi, qword [rdi + rdx*8]
and qword [r14], rsi
test rdi, rdi
je 0x1400430e8
mov eax, dword [r15]
cmp dword [rdi + 0x18], eax
jne 0x1400430d2
mov rcx, qword [rdi]
lea rdx, [rsp + 0x58]
mov rbx, qword [r12]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
mov ecx, dword [rsp + 0x50]
cmp dword [rsp + 0x58], ecx
jne 0x1400430d2
mov r8d, ecx
mov rdx, rax
add r8, r8
mov rcx, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1400430db
mov rsi, rdi
mov rdi, qword [rdi + 0x10]
jmp 0x140043083
mov rax, qword [rsp + 0x78]
mov qword [r14], rsi
mov qword [rax], rdi
jmp 0x1400430f1
mov rax, qword [rsp + 0x78]
and qword [rax], 0
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400562ac
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov edi, edx
mov r15, rcx
test edx, edx
jne 0x1400562fc
lea r8d, [rdx + 0x30]
lea rcx, [rax - 0x50]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
mov edi, dword [rsp + 0x48]
cmp edi, 1
jae 0x1400562fc
mov eax, 0x80070057
jmp 0x1400564b6
xor ebx, ebx
mov qword [rsp + 0x90], rbx
lea ecx, [rbx + 0x38]
call fcn.1400cb4b8
test rax, rax
je 0x140056343
lea rcx, [0x1400d8910]
mov qword [rax], rcx
and qword [rax + 8], rbx
lea rcx, [0x1400d8d38]
mov qword [rax + 0x10], rcx
and qword [rax + 0x18], rbx
lea rcx, [0x1400d8d40]
mov qword [rax + 0x20], rcx
and qword [rax + 0x28], rbx
and qword [rax + 0x30], rbx
test rax, rax
je 0x140056360
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.14005650c
mov rbx, qword [rsp + 0x90]
lea r8, [rbx + 8]
lea rdx, [0x1400564d0]
mov ecx, 4
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x14005639d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov esi, 0x80004005
test ebx, ebx
cmovns ebx, esi
jmp 0x14005644e
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x1400564d0]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpoolWork]
mov rsi, rax
mov rcx, qword [rbx + 0x28]
cmp rax, rcx
je 0x1400563d0
test rcx, rcx
je 0x1400563cc
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CloseThreadpoolWork]
and qword [rbx + 0x28], 0
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x28], 0
jne 0x1400563fb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov esi, 0x80004005
test ecx, ecx
cmovns ecx, esi
test ecx, ecx
jns 0x140056400
jmp 0x14005644c
mov esi, 0x80004005
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CreateThreadpool]
mov r14, rax
mov rcx, qword [rbx + 0x18]
cmp rax, rcx
je 0x140056428
test rcx, rcx
je 0x140056424
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CloseThreadpool]
and qword [rbx + 0x18], 0
mov qword [rbx + 0x18], r14
cmp qword [rbx + 0x18], 0
jne 0x14005645f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, esi
test ecx, ecx
jns 0x14005645f
mov ebx, ecx
lea rcx, [rsp + 0x90]
call fcn.1400565a4
mov eax, ebx
jmp 0x1400564b6
mov edx, edi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_SetThreadpoolThreadMaximum]
lea rcx, [r15 + 0x10]
lea rax, [rsp + 0x90]
cmp rcx, rax
je 0x140056493
and qword [rsp + 0x90], 0
cmp rbx, qword [rcx]
je 0x140056493
mov rdx, rbx
call fcn.14005650c
nop
lea rcx, [rsp + 0x90]
call fcn.1400565a4
xor eax, eax
jmp 0x1400564b6
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140056cf4
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0xd0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
lea rdx, [rdi + 0xb8]
mov rcx, rdi
call fcn.140056a98
xor esi, esi
test eax, eax
js 0x140056d94
mov rcx, qword [rdi + 0x100]
call fcn.140059664
test eax, eax
js 0x140056d94
lea rbx, [rdi + 0xd8]
xor edx, edx
mov rcx, rbx
lea r8d, [rsi + 0x20]
call sub.msvcrt.dll_memset
mov rax, qword [rdi + 0xd0]
mov rdx, rbx
mov rcx, qword [rdi + 0xc0]
mov qword [rdi + 0xf0], rax
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_ConnectNamedPipe]
test eax, eax
jne 0x140056d77
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov dword [rdi + 0xf8], esi
cmp esi, 0x3e5
je 0x140056d92
mov rcx, qword [rdi + 0xf0]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400589b8
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rdx
mov rdi, rcx
mov esi, 1
lock add dword [rcx + 0x58], esi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_StartThreadpoolIo]
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x40], sil
mov rcx, qword [rbx]
add rcx, 0xb8
xor edx, edx
lea r8d, [rsi + 0x1f]
call sub.msvcrt.dll_memset
mov rcx, qword [rbx]
mov rax, qword [rcx + 0xb0]
mov qword [rcx + 0xd0], rax
mov r9, qword [rbx]
mov r8, qword [r9 + 0xf8]
sub r8, qword [r9 + 0xf0]
mov rax, qword [r9 + 0x98]
mov rcx, qword [rax + 0x20]
mov edx, dword [r9 + 0x108]
lea rax, [r9 + 0xb8]
sub r8d, edx
add rdx, qword [r9 + 0xf0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jne 0x140058a8d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x3e5
je 0x140058a8d
cmp eax, 0xea
je 0x140058a8d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140058aab
mov ebx, 0x8000ffff
jmp 0x140058aab
xor ebx, ebx
test ebx, ebx
js 0x140058aab
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x1400581da.0]
xor sil, sil
mov byte [rsp + 0x40], sil
test sil, sil
je 0x140058abe
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.api_ms_win_core_threadpool_l1_2_0.dll_CancelThreadpoolIo]
lock dec dword [rdi + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400bd6bc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov ebx, r9d
mov r14, r8
mov r15d, edx
mov rsi, rcx
mov ecx, edx
sub ecx, 0xe
je 0x1400bd82b
sub ecx, 1
je 0x1400bd774
sub ecx, 1
je 0x1400bd74b
cmp ecx, 1
je 0x1400bd722
test r9d, r9d
je 0x1400bd8ec
mov edx, r15d
mov rcx, r14
call fcn.140091ad4
add ebx, 0xffffffff
jne 0x1400bd70d
jmp 0x1400bd8ec
mov qword [rbp - 0x10], r14
xor edi, edi
mov byte [rbp - 8], dil
test r9d, r9d
je 0x1400bd746
mov byte [rbp - 8], dil
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.140098fd4
add ebx, 0xffffffff
jne 0x1400bd731
jmp 0x1400bd8ec
mov qword [rbp - 0x10], r14
xor edi, edi
mov byte [rbp - 8], dil
test r9d, r9d
je 0x1400bd76f
mov byte [rbp - 8], dil
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.140098fd4
add ebx, 0xffffffff
jne 0x1400bd75a
jmp 0x1400bd8ec
mov qword [rbp - 0x10], r14
xor edi, edi
mov byte [rbp - 8], dil
mov word [rbp + 0x38], di
mov r9, rbx
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov rcx, rax
sub rcx, rdx
sar rcx, 1
cmp rbx, rcx
jae 0x1400bd7c3
lea rbx, [rdx + rbx*2]
cmp rbx, rdx
jne 0x1400bd7a9
mov qword [rsi + 8], rdx
jmp 0x1400bd7e3
cmp rbx, rax
je 0x1400bd7e3
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_memmove]
mov qword [rsi + 8], rbx
jmp 0x1400bd7e3
cmp rcx, r9
jae 0x1400bd7e3
sub r9, rcx
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x20], rcx
mov r8, rax
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.1400c04f4
mov r15, qword [rsi]
mov r12, qword [rsi + 8]
cmp r15, r12
je 0x1400bd826
mov esi, 1
mov rbx, r15
add r15, 2
mov byte [rbp - 8], dil
lea rdx, [rbp + 0x38]
mov rcx, r14
call fcn.1400a0bdc
movzx eax, word [rbp + 0x38]
movzx ecx, ax
shr cx, 1
and ax, si
neg ax
xor cx, ax
mov word [rbx], cx
cmp r15, r12
jne 0x1400bd7f4
jmp 0x1400bd8ec
mov qword [rbp - 0x10], r14
xor edi, edi
mov byte [rbp - 8], dil
mov word [rbp + 0x38], di
mov r9, rbx
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov rcx, rax
sub rcx, rdx
sar rcx, 1
cmp rbx, rcx
jae 0x1400bd87a
lea rbx, [rdx + rbx*2]
cmp rbx, rdx
jne 0x1400bd860
mov qword [rsi + 8], rdx
jmp 0x1400bd89a
cmp rbx, rax
je 0x1400bd89a
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_memmove]
mov qword [rsi + 8], rbx
jmp 0x1400bd89a
cmp rcx, r9
jae 0x1400bd89a
sub r9, rcx
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x20], rcx
mov r8, rax
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.1400c04f4
mov r9, qword [rsi]
mov r10, qword [rsi + 8]
cmp r9, r10
je 0x1400bd8ec
mov esi, 1
mov rax, r9
add r9, 2
mov byte [rbp - 8], dil
mov ecx, dword [r14 + 0x18]
mov r11d, dword [r14 + 0x20]
sub ecx, r11d
cmp ecx, esi
jb 0x1400bd8e1
mov rdx, qword [r14 + 0x10]
movsx r8d, byte [r11 + rdx]
lea ecx, [r11 + 1]
mov dword [r14 + 0x20], ecx
mov word [rax], r8w
cmp r9, r10
jne 0x1400bd8ab
jmp 0x1400bd8ec
mov edx, esi
mov rcx, r14
call fcn.140071aac
nop
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400bdb28
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov ebx, r9d
mov rdi, r8
mov r14d, edx
mov rsi, rcx
mov r8d, edx
sub r8d, 0xe
je 0x1400bdc62
sub r8d, 1
je 0x1400bdc0e
sub r8d, 1
je 0x1400bdbbe
cmp r8d, 1
je 0x1400bdb98
test ebx, ebx
je 0x1400bdcc0
mov edx, r14d
mov rcx, rdi
call fcn.140091ad4
add ebx, 0xffffffff
jne 0x1400bdb83
jmp 0x1400bdcc0
mov qword [rbp - 0x10], rdi
mov byte [rbp - 8], 0
test ebx, ebx
je 0x1400bdbb9
mov byte [rbp - 8], 0
lea rdx, [rbp - 0x18]
mov rcx, rdi
call fcn.140098fd4
add ebx, 0xffffffff
jne 0x1400bdba4
jmp 0x1400bdcc0
mov qword [rbp - 0x10], rdi
mov byte [rbp - 8], 0
mov edx, ebx
call fcn.1400bf4c4
mov r14, qword [rsi]
mov r15, qword [rsi + 8]
cmp r14, r15
je 0x1400bdc09
mov esi, 1
mov rbx, r14
add r14, 4
mov byte [rbp - 8], 0
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.14008cb24
mov eax, dword [rbp + 0x28]
mov ecx, eax
shr ecx, 1
and eax, esi
neg eax
xor ecx, eax
mov dword [rbx], ecx
cmp r14, r15
jne 0x1400bdbde
jmp 0x1400bdcc0
mov qword [rbp - 0x10], rdi
mov byte [rbp - 8], 0
mov edx, ebx
call fcn.1400bf4c4
mov r14, qword [rsi]
mov r15, qword [rsi + 8]
cmp r14, r15
je 0x1400bdc60
mov esi, 1
mov rbx, r14
add r14, 4
mov byte [rbp - 8], 0
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.1400a0bdc
movzx eax, word [rbp + 0x28]
movzx ecx, ax
shr cx, 1
and ax, si
neg ax
xor ax, cx
cwde
mov dword [rbx], eax
cmp r14, r15
jne 0x1400bdc2e
jmp 0x1400bdcc0
mov qword [rbp - 0x10], rdi
mov byte [rbp - 8], 0
mov edx, ebx
call fcn.1400bf4c4
mov r9, qword [rsi]
mov r11, qword [rsi + 8]
cmp r9, r11
je 0x1400bdcc0
mov esi, 1
mov rax, r9
add r9, 4
mov byte [rbp - 8], 0
mov ecx, dword [rdi + 0x18]
mov r10d, dword [rdi + 0x20]
sub ecx, r10d
cmp ecx, esi
jb 0x1400bdcb5
mov rdx, qword [rdi + 0x10]
movsx r8d, byte [r10 + rdx]
lea ecx, [r10 + 1]
mov dword [rdi + 0x20], ecx
mov dword [rax], r8d
cmp r9, r11
jne 0x1400bdc82
jmp 0x1400bdcc0
mov edx, esi
mov rcx, rdi
call fcn.140071aac
nop
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400bde48
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov esi, r9d
mov rdi, r8
mov r14d, edx
mov rbx, rcx
mov ecx, edx
sub ecx, 0xe
je 0x1400bdfc2
sub ecx, 1
je 0x1400bdf66
sub ecx, 1
je 0x1400bdf0f
cmp ecx, 1
je 0x1400bdeb4
test r9d, r9d
je 0x1400be024
mov edx, r14d
mov rcx, rdi
call fcn.140091ad4
add esi, 0xffffffff
jne 0x1400bde9f
jmp 0x1400be024
mov qword [rbp - 0x10], rdi
mov byte [rbp - 8], 0
mov edx, r9d
mov rcx, rbx
call fcn.1400bf5c4
mov r14, qword [rbx]
mov r15, qword [rbx + 8]
cmp r14, r15
je 0x1400bdf0a
mov esi, 1
mov rbx, r14
add r14, 8
mov byte [rbp - 8], 0
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140098fd4
mov rax, qword [rbp - 0x20]
mov rcx, rax
shr rcx, 1
and rax, rsi
neg rax
xor rcx, rax
mov qword [rbx], rcx
cmp r14, r15
jne 0x1400bded8
jmp 0x1400be024
mov qword [rbp - 0x10], rdi
mov byte [rbp - 8], 0
mov edx, r9d
mov rcx, rbx
call fcn.1400bf5c4
mov r14, qword [rbx]
mov r15, qword [rbx + 8]
cmp r14, r15
je 0x1400bdf61
mov esi, 1
mov rbx, r14
add r14, 8
mov byte [rbp - 8], 0
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.14008cb24
mov eax, dword [rbp + 0x28]
mov ecx, eax
shr ecx, 1
and eax, esi
neg eax
xor eax, ecx
cdqe
mov qword [rbx], rax
cmp r14, r15
jne 0x1400bdf33
jmp 0x1400be024
mov qword [rbp - 0x10], rdi
mov byte [rbp - 8], 0
mov edx, r9d
mov rcx, rbx
call fcn.1400bf5c4
mov r14, qword [rbx]
mov r15, qword [rbx + 8]
cmp r14, r15
je 0x1400bdfc0
mov esi, 1
mov rbx, r14
add r14, 8
mov byte [rbp - 8], 0
lea rdx, [rbp + 0x28]
mov rcx, rdi
call fcn.1400a0bdc
movzx eax, word [rbp + 0x28]
movzx ecx, ax
shr cx, 1
and ax, si
neg ax
xor ax, cx
movsx rax, ax
mov qword [rbx], rax
cmp r14, r15
jne 0x1400bdf8a
jmp 0x1400be024
mov qword [rbp - 0x10], rdi
mov byte [rbp - 8], 0
mov edx, r9d
mov rcx, rbx
call fcn.1400bf5c4
mov r9, qword [rbx]
mov r11, qword [rbx + 8]
cmp r9, r11
je 0x1400be024
mov esi, 1
mov rax, r9
add r9, 8
mov byte [rbp - 8], 0
mov ecx, dword [rdi + 0x18]
mov r10d, dword [rdi + 0x20]
sub ecx, r10d
cmp ecx, esi
jb 0x1400be019
mov rdx, qword [rdi + 0x10]
movsx r8, byte [r10 + rdx]
lea ecx, [r10 + 1]
mov dword [rdi + 0x20], ecx
mov qword [rax], r8
cmp r9, r11
jne 0x1400bdfe6
jmp 0x1400be024
mov edx, esi
mov rcx, rdi
call fcn.140071aac
nop
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x1400cb87c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1401414b8], rbx
je 0x1400cb8c8
cmp rax, rbx
jne 0x1400cb8bb
mov ebx, 1
mov esi, ebx
jmp 0x1400cb8cd
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400cb8a0
mov ebx, 1
mov eax, dword [0x1401414c0]
cmp eax, ebx
jne 0x1400cb8e3
mov ecx, 0x1f
call fcn.1401db000
jmp 0x1400cb948
mov eax, dword [0x1401414c0]
test eax, eax
jne 0x1400cb942
mov dword [0x1401414c0], ebx
lea r15, [0x1400da930]
lea rdi, [0x1400da918]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400cb934
test eax, eax
jne 0x1400cb938
cmp qword [rdi], 0
je 0x1400cb929
mov rax, qword [rdi]
mov rcx, qword [case.0x1400581da.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400cb90a
test eax, eax
je 0x1400cb948
mov eax, 0xff
jmp 0x1400cba24
mov dword [0x140131750], ebx
mov eax, dword [0x1401414c0]
cmp eax, ebx
jne 0x1400cb96f
lea rdx, [0x1400da910]
lea rcx, [0x1400d9fb0]
call sub.msvcrt.dll__initterm
mov dword [0x1401414c0], 2
test esi, esi
jne 0x1400cb97c
xor eax, eax
xchg qword [0x1401414b8], rax
cmp qword [0x1401414d8], 0
je 0x1400cb9b0
lea rcx, [0x1401414d8]
call fcn.1400cbde0
test eax, eax
je 0x1400cb9b0
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1401414d8]
mov r9, qword [case.0x1400581da.0]
call r9
mov r8, qword [0x140131768]
mov rdx, qword [0x140131760]
mov ecx, dword [0x140131758]
call fcn.140009df0
mov dword [0x14013174c], eax
cmp dword [0x140131770], 0
jne 0x1400cb9e0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140131750], 0
jne 0x1400cb9f5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14013174c]
jmp 0x1400cba24
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400cbe60
add rsp, 0x28
jmp 0x1400cb87c

Function at 0x1400cbcf0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400cbd3c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400cbd34
cmp dword [rcx + 0x3c], edx
jl 0x1400cbd34
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400cbd34
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400cbd3c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140009a70
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, 2
cmp rcx, 1
jne 0x140009aa2
mov rdi, qword [0x140149178]
cmp rsi, rdi
jbe 0x140009ad5
lea rcx, [0x140149170]
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400766a0
lea rax, [rcx - 1]
test rcx, rax
jne 0x140009ab0
mov rsi, rcx
jmp 0x140009a81
call fcn.1400826d0
mov rsi, rax
jmp 0x140009a81
mov rcx, rdx
call fcn.1400826d0
cmp rsi, rax
cmovbe rsi, rax
cmp rsi, rdi
jb 0x140009a8d
add rsp, 0x28
pop rdi
pop rsi
ret
jae 0x140009ace
mov rax, qword [0x140149188]
test rax, rax
jns 0x140009afa
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
jmp 0x140009aff
cvtsi2ss xmm0, rax
divss xmm0, dword [0x140149190]
call fcn.1400c6d14
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x140117560]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rdi, 3
jb 0x140009aba
mov rax, rdi
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rdi
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x140009aba
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x140009ac2
Function at 0x14000a750
Capabilities:
Get file size

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rdi, rcx
mov rax, qword [0x140131028]
xor rax, rsp
mov qword [rsp + 0x88], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x40], r15
movaps xmm0, xmmword [0x140115d80]
movaps xmmword [rsi + 0x30], xmm0
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
lea rdx, str.GetLength
lea r8, str....._base_files_file_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0xac
call fcn.140078ba0
xor ebx, ebx
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.14007abd0
mov qword [r14], r15
mov rcx, qword [rdi]
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rbx, rbx
or rbx, qword [rdi]
mov rcx, rsi
call fcn.14005bd20
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140096c60
mov rax, rbx
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14000b370
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140131028]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov eax, dword [0x140149398]
mov ecx, dword [0x140140950]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000b3d0
lea rsi, [0x140149390]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140096c60
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x140149398]
call fcn.140094c5c
cmp dword [0x140149398], 0xffffffff
jne 0x14000b3ac
lea rsi, [rsp + 0x38]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140098da0
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x30]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.140094aec
mov rsi, rax
mov edi, dword [rdi]
mov eax, dword [0x1401493e0]
mov ecx, dword [0x140140950]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000b490
lea r8, [0x1401493b0]
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov r9d, edi
call fcn.14001b5c0
mov qword [0x140149390], rsi
lea rcx, [0x140149398]
call fcn.140094bfc
jmp 0x14000b3ac
lea rcx, [0x1401493e0]
call fcn.140094c5c
cmp dword [0x1401493e0], 0xffffffff
jne 0x14000b461
xorps xmm0, xmm0
movups xmmword [0x1401493d0], xmm0
movups xmmword [0x1401493c0], xmm0
movups xmmword [0x1401493b0], xmm0
lea rcx, [0x1401493b0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x1401493e0]
call fcn.140094bfc
jmp 0x14000b461