joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055910
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x390
vmovaps xmmword [rsp + 0x380], xmm6
mov rax, qword [0x14007a010]
xor rax, rsp
mov qword [rsp + 0x370], rax
cmp byte [0x140082541], 0
je 0x140055b44
mov rax, qword [0x1400832f0]
or dword [rax + 0x47d0], 0x40
mov dword [rax + 0x4830], 0x3eb33333
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, str.Novax_Watermark
call fcn.1400126c0
mov rax, qword [0x1400832f0]
vmovss xmm0, dword [rax + 0xe0]
vmovss dword [0x140082564], xmm0
cmp byte [0x140083fe0], 0
je 0x140055997
lea rcx, str.Novax
call fcn.14003aaa0
vmovss xmm6, dword [0x14006ef98]
vmovaps xmm1, xmm6
call fcn.140018120
cmp byte [0x140083fe0], 0
je 0x1400559d8
cmp byte [0x140083fd8], 0
jne 0x1400559cc
cmp byte [0x140083ff4], 0
jne 0x1400559cc
cmp byte [0x140082562], 0
je 0x1400559d8
lea rcx, [0x14006d938]
call fcn.14003aaa0
vmovaps xmm1, xmm6
call fcn.140018120
mov dword [rsp + 0x30], 0x100
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ebx, ebx
test eax, eax
je 0x140055a44
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rsp + 0x170]
mov r8d, 0x100
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
test eax, eax
jne 0x140055a44
cmp byte [0x140083fd8], bl
je 0x140055a44
lea rcx, [rsp + 0x70]
call fcn.14003aaa0
vmovaps xmm1, xmm6
call fcn.140018120
cmp byte [0x140083fd8], bl
je 0x140055a71
cmp byte [0x140083ff4], bl
jne 0x140055a65
cmp byte [0x140082562], bl
je 0x140055a71
lea rcx, [0x14006d938]
call fcn.14003aaa0
vmovaps xmm1, xmm6
call fcn.140018120
cmp byte [0x140083ff4], bl
je 0x140055ab2
vxorps xmm0, xmm0, xmm0
vmovss xmm1, dword [0x140082564]
vucomiss xmm1, xmm0
je 0x140055aa4
vmovss xmm0, dword [0x14006ed7c]
vdivss xmm1, xmm0, xmm1
vcvttss2si ebx, xmm1
mov edx, ebx
lea rcx, str._d_fps
call fcn.14003aaa0
vmovaps xmm1, xmm6
call fcn.140018120
cmp byte [0x140083ff4], 0
je 0x140055ad9
cmp byte [0x140082562], 0
je 0x140055ad9
lea rcx, [0x14006d938]
call fcn.14003aaa0
vmovaps xmm1, xmm6
call fcn.140018120
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
test eax, eax
jne 0x140055b44
cmp byte [0x140082562], al
je 0x140055b44
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x50]
lea rcx, str._02d:_02d:_02d
call fcn.14003aaa0
call fcn.140014950
nop
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.14005dd40
vmovaps xmm6, xmmword [rsp + 0x380]
add rsp, 0x390
pop rbx
ret
Function at 0x140056d10
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14007a010]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx eax, byte [0x140083ffc]
mov rsi, rcx
test al, al
jne 0x140056d68
movsxd rax, dword [rcx]
lea rcx, [0x14006cdb0]
mov rcx, qword [rcx + rax*8]
call fcn.14003b4d0
test al, al
je 0x140056f0e
mov byte [0x140083ffc], 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005dd40
add rsp, 0x60
pop rsi
ret
cmp al, 1
jne 0x140056f0e
mov qword [rsp + 0x78], rbx
lea rcx, [0x1400674c0]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
vmovaps xmmword [rsp + 0x40], xmm6
call fcn.14003b4d0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140056db7
imul rax, rax, 0x64
jmp 0x140056dd5
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7ffffffffbd3e27f
lea rdi, [rax + 0x42c1d80]
cmp rax, rcx
jl 0x140056df5
movabs rdi, 0x7fffffffffffffff
vmovsd xmm6, qword [0x14006eed8]
movabs rbp, 0x311cdad160000
movabs r14, 0x112e0be826d694b3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140056e2f
imul rbx, rax, 0x64
jmp 0x140056e50
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x140056ec2
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
mov rax, rdi
sub rax, rbx
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, rax
vcomisd xmm0, xmm6
lea r8, [rcx + rbp]
ja 0x140056e7c
lea r8, [rax + rcx]
add rax, rcx
lea rdx, [rcx + rbp]
vcomisd xmm0, xmm6
lea rcx, [rsp + 0x20]
cmovbe rdx, rax
mov rax, r14
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x20], rdx
sub r8d, eax
mov dword [rsp + 0x28], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140056e11
vmovaps xmm6, xmmword [rsp + 0x40]
lea rbx, [0x14006cb10]
mov r14, qword [rsp + 0x50]
lea rdi, [0x14006cda8]
mov rbp, qword [rsp + 0x80]
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140056efb
mov eax, dword [rbx]
mov dword [rsi], eax
mov byte [0x140083ffc], 0
add rbx, 4
cmp rbx, rdi
jne 0x140056ee3
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005dd40
add rsp, 0x60
pop rsi
ret
Function at 0x14005ce60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14005cec1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14005ce80
mov ecx, dword [r10]
jmp 0x14005cfaa
cmp ecx, 0x4e0
jb 0x14005cfaa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14005cee0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14005cf30
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14005eb74
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005ebbe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005ebbe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005ebbe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005ebbe
cmp dword [rcx + 0x84], 0xe
jbe 0x14005ebbe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005ebc0
xor al, al
add rsp, 0x28
ret
Function at 0x140002de0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003d010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002e0d
xor eax, eax
jmp 0x140002f53
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002e47
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002e47
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002f53
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002f46
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002e8a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002e99
movsx ecx, dil
jmp 0x140002eed
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140002f46
cmp eax, 1
jle 0x140002f07
cmp eax, 3
jne 0x140002f46
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14000d638
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002f4b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002f34
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14000e1e0
cmp rsi, rax
jne 0x140002f46
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140002f4b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400043c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x1400042e0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x14003d010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.1400076d0
mov eax, 1
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], eax
xor r9d, r9d
mov word [rsp + 0xb0], ax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140004385
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140004387
xor al, al
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400043c0
add rsp, 0xf0
pop rbx
ret

Function at 0x14000d614
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000d440
Function at 0x140004140
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x1400042e4
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rbx, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rbx + 0x30]
mov qword [rbx + 0xd8], rcx
mov rcx, qword [rax + 0x30]
movups xmm0, xmmword [rcx + 0x2d8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x2e8]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x2f8]
movups xmmword [rsp + 0x40], xmm0
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rax + 0x78]
mov qword [rsp + 0x18], rdx
call fcn.140054c00
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x348], edx
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rcx
call fcn.140004300
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x58], rcx
jmp 0x14000426f
nop
mov rax, qword [0x1401c92b0]
mov qword [rsp], rax
mov dword [rsp + 8], 0
call fcn.14005b240
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, rax
xor eax, eax
mov ebx, 1
lock cmpxchg dword [rcx + 0x348], ebx
sete sil
test sil, sil
je 0x14000424c
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe8], 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.140039a20
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x2d8], xmm0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x2e8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x2f8], xmm0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov dword [rsp], 2
call fcn.14002cd20
mov rax, qword [rsp + 0x60]
jmp 0x140004174
Function at 0x14001d420
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x14020c7b3], 0
jne 0x14001d585
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x14001d52e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x14001d57a
lea rbx, [0x1401ee658]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x14001d4ef
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x14001d54a
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x14001d455
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x14001d455
mov ecx, 0x40
nop
call fcn.140059c40
lea rax, [0x14014bed7]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.140030c20
nop
int3
Function at 0x1400205e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x140020726
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
call fcn.140031ec0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x50]
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], 1
mov qword [rsp + 0x28], 0
mov rcx, qword [rax + 0x48]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x38], 1
mov qword [rsp + 0x40], 0
xor ecx, ecx
jmp 0x140020653
inc qword [rsp + 0x40]
lea rdx, [rax + 1]
mov rax, rcx
mov rcx, rdx
cmp qword [rax + 0x38], rcx
jbe 0x140020707
mov qword [rsp + 0x10], rcx
mov rdx, qword [rax + 0x68]
imul rdx, rcx
add rdx, qword [rax + 0x18]
mov qword [rsp], rdx
call fcn.1400098c0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x58]
cmp qword [rcx + 0x30], rax
jbe 0x1400206f2
mov edx, 1
mov rbx, qword [rsp + 0x18]
movzx esi, byte [rsp + 0x20]
movzx ebx, byte [rbx]
test sil, bl
je 0x1400206ee
xor edx, 1
test dl, dl
je 0x1400206a5
nop
cmp sil, 0x80
jne 0x1400206e5
inc qword [rsp + 0x18]
mov byte [rsp + 0x20], 1
inc qword [rsp + 0x28]
nop
movzx edx, byte [rsp + 0x38]
cmp dl, 0x80
jne 0x1400206d5
inc qword [rsp + 0x30]
mov byte [rsp + 0x38], 1
jmp 0x140020644
shl edx, 1
mov byte [rsp + 0x38], dl
nop dword [rax + rax]
jmp 0x140020644
shl esi, 1
mov byte [rsp + 0x20], sil
jmp 0x1400206b6
xor edx, edx
jmp 0x1400206a1
mov rbx, qword [rsp + 0x30]
movzx esi, byte [rsp + 0x38]
movzx ebx, byte [rbx]
test sil, bl
setne dl
jmp 0x14002068c
lea rax, [0x1401498c6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1c
nop dword [rax + rax]
call fcn.140030c20
nop
call fcn.140057a20
jmp fcn.1400205e0
Function at 0x140023d40
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x140023fae
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
nop
lea rax, [0x1401f5010]
mov qword [rsp], rax
call fcn.140009f00
lea rax, [0x1401f4f80]
mov qword [rsp], rax
call fcn.140016d80
mov rax, qword [rsp + 8]
mov qword [rsp + 0x48], rax
nop
nop
lea rcx, [0x1401f5010]
mov qword [rsp], rcx
call fcn.14000a160
mov rax, qword [rsp + 0x48]
mov byte [rax + 0xa], 1
lea rdi, [rax + 0x10]
cmp dword [0x14020c9e0], 0
jne 0x140023f9f
mov rcx, qword [rsp + 0x68]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0x18], rcx
cmp dword [0x14020c9e0], 0
nop dword [rax]
jne 0x140023f78
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.1400238a0
cmp byte [rsp + 0x10], 0
je 0x140023f16
cmp dword [0x14020c7f0], 0
jne 0x140023e34
mov byte [rsp + 0x88], 1
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, qword [rsp + 0x60]
mov qword [rsp], rax
xorps xmm0, xmm0
movups xmmword [rsp + 8], xmm0
call fcn.140011c40
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0x18]
nop
inc dword [rcx + 0xd8]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x30], rcx
mov rbx, qword [rcx + 0xa0]
test byte [rbx], al
test byte [rax], al
mov qword [rsp], rdx
lea rax, [rbx + 0x1698]
mov qword [rsp + 0x38], rax
mov qword [rsp + 8], rax
call fcn.14001c880
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
mov qword [rsp + 8], 8
lea rax, [0x1400ad021]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
call fcn.14001c6e0
nop
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rcx + 0xd8]
lea ebx, [rdx - 1]
mov dword [rcx + 0xd8], ebx
cmp edx, 1
jne 0x140023e22
cmp byte [rax + 0xb1], 0
je 0x140023e22
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x140023e22
nop
nop
lea rax, [0x1401f5010]
mov qword [rsp], rax
call fcn.140009f00
nop
mov rax, qword [0x1401f4fb0]
sub rax, qword [0x1401f4f80]
mov qword [0x1401f4fb0], rax
mov rax, qword [0x1401f4f98]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov qword [0x1401f4f98], rcx
nop
nop
lea rax, [0x1401f5010]
mov qword [rsp], rax
call fcn.14000a160
mov byte [rsp + 0x88], 0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rcx, [rax + 0x20]
mov rdi, rcx
mov rbx, qword [rsp + 0x78]
call fcn.1400598c0
lea rdi, [rax + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.140059880
jmp 0x140023dfb
mov rcx, qword [rsp + 0x68]
call fcn.140059880
jmp 0x140023dc8
call fcn.140057a20
jmp fcn.140023d40
Function at 0x140059600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x140002b40
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.1400086a0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.140057a20
jmp 0x140002ae0
cmp byte [0x14020c7b2], 0
je 0x14005961f
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x18]
jmp 0x140056a40
jmp 0x140002ae0

Function at 0x140059640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x14020ca20]
nop
mov rcx, qword [rsp + 8]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*4]
xor rax, rcx
shl rcx, 0x20
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rcx, rax
movabs rax, 0x83cf8eadf876d2d7
imul rax, rcx
mov rcx, rax
shr rax, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x14020c7b2], 0
je 0x14005967c
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x14020cca0]
aesenc xmm0, xmmword [0x14020ccb0]
aesenc xmm0, xmmword [0x14020ccc0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x140008920

Function at 0x1400596a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x14020ca20]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x14020c7b2], 0
je 0x1400596dd
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x14020cca0]
aesenc xmm0, xmmword [0x14020ccb0]
aesenc xmm0, xmmword [0x14020ccc0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x1400089a0
Function at 0x14006edc0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x14006ee99
lea rsi, [rdx + rdx*2]
lea rdi, [0x1400b8f40]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x14006ee42
inc rdx
nop
jmp 0x14006ee18
cmp r9, 0xffffffffffffffe0
jle 0x14006ee4d
dec rdx
jmp 0x14006ee18
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.140059c20
nop
int3