joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e740
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6000], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x14001e7c3
xor edx, edx
add rcx, 0x6008
call fcn.140020820
mov r8, rsi
lea rcx, [rbx + 0x6008]
mov rdx, rbp
call fcn.140004150
mov eax, dword [rbx + 0x6008]
xor edx, edx
mov r9, qword [rbx + 0x6000]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x6010]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x1401a6b48]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14001e7cf
add rcx, 0x6008
call fcn.140004150
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ea30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1401a6b50]
cmp byte [rbx + 0x5f58], 0
jne 0x14001eb60
cmp dword [rbx + 0x5f80], 0
je 0x14001ea7b
mov r8d, 0x33eb
lea rdx, str.C:UsersdenisDesktopmenuimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001eb59
lea rdx, [0x1400ed458]
call fcn.1400038e0
mov rdi, rax
test rax, rax
je 0x14001eb59
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14001eb50
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001eb50
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x14001eb50
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001eb50
cmp rsi, 0xffffffffffffffff
je 0x14001eb50
mov rcx, rsi
call fcn.1400079f0
mov rbp, rax
test rax, rax
je 0x14001eb50
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rsi
je 0x14001eb30
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbp
call fcn.140007aa0
jmp 0x14001eb59
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14001eb46
mov rdx, rsi
mov rcx, rbp
call fcn.14001ede0
mov rcx, rbp
call fcn.140007aa0
jmp 0x14001eb59
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov byte [rbx + 0x5f58], 1
movss xmm0, dword [rbx + 0x5f5c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001ebef
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f5c], xmm0
jb 0x14001ebef
mov rdi, qword [rbx + 0x20]
xor ebp, ebp
test rdi, rdi
je 0x14001ebe2
mov rax, qword [0x1401a6b50]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f5c], ebp
call fcn.14001f040
lea rdx, [0x1400ed45c]
mov rcx, rdi
mov rsi, rax
call fcn.1400038e0
mov rdi, rax
test rax, rax
je 0x14001ebe9
mov r8, qword [rsp + 0x30]
lea edx, [rbp + 1]
mov r9, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001ebe9
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5f5c], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ed40
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1401a6b50]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001eda3
mov qword [rsp], rbx
lea rbx, [0x1400edc80]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001ed83
cmp byte [r8], r9b
jne 0x14001ed83
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001ed70
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f70]
not eax
mov r8, qword [r10 + 0x5f78]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001edcf
cmp dword [r8 + 8], eax
je 0x14001edd6
add r8, 0x48
cmp r8, rcx
jne 0x14001edc0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x140070bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.14005fc60
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x140070c06
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x140070c5d
mov ebp, 0x4b0000
jmp 0x140070c6b
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.1400620a0
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x140070c81
mov eax, r12d
jmp 0x140070c8a
mov edx, edi
mov ecx, ebp
call fcn.1400620a0
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x140070ca6
shl esi, 0x10
mov ecx, esi
jmp 0x140070d95
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x140070d04
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.14005fc60
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x140070cf4
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.140061f70
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.14005fc60
add ebx, eax
jmp 0x140070d9e
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x140070d11
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x140070d50
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.14005fc60
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x140070d55
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.140061f70
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.14005fc60
add ebx, eax
jmp 0x140070d9e
cmp eax, r12d
jge 0x140070d8e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.14005fc60
sub ebp, eax
sub r15d, esi
je 0x140070d8e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.140061f70
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.14005fc60
add ebx, eax
jmp 0x140070d9e
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.14005fc60
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp fcn.14005fc60
Function at 0x1400bce50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x140108018]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x1400bcfec
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x1400bcfec
cmp r10d, r14d
jne 0x1400bcef0
sub rbx, 0x10
jmp 0x1400bd034
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x1400bcf62
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x1400bcf24
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x1400bcf2c
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x1400bcf4b
movzx edx, r11b
mov rcx, rsi
call fcn.1400be000
test al, al
jne 0x1400bd045
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.1400be670
test al, al
jne 0x1400bd045
mov edx, dword [rsi + 0x64]
lea r9, [0x1400be9d0]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x1400bcf8e
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.1400bccd0
jmp 0x1400bcfe2
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.1400bccd0
test dil, dil
je 0x1400bcfda
cmp byte [rsi + 0x6a], 0
jne 0x1400bcfda
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x1400bd045
sub rbx, 0x10
jmp 0x1400bd034
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x1400bd049
mov ebp, dword [rbx]
jmp 0x1400bceb0
mov al, 1
jmp 0x1400bd052
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400c8b40
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x1400c33a0
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400c33bc
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400c3410
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400c3535
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1400c3535
test rax, rax
je 0x1400c3535
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400c3535
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x1400c34aa
lea rax, [0x1400c3590]
jmp 0x1400c3503
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400c3535
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400c3523
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x1400c34d0
lea rax, [0x1400c3560]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1400c354a
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x1400c4290
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400c429b
xor eax, eax
ret
lea r11, [0x1400e6f80]
not ecx
cmp r8d, 8
jb 0x1400c4371
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400c42c0
test r8d, r8d
je 0x1400c439d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400c4380
not ecx
mov eax, ecx
ret
Function at 0x140c0acdb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xffffffffca212d06
lea rsp, [rsp + 0x28]
jne 0x140c220e6
push 0x5400b31d
push 0xfffffffffb30573f
mov rcx, rax
call fcn.140c40808
call fcn.140c33f8f

Function at 0x140c0e5f5
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
adc rbx, rax
shl rdx, 0xc6
movzx r10d, cl
lea rbp, [rdi*8 - 0x4044b560]
xor r10, rbx
jmp r10
mov rbp, qword [r8]
mov r10d, 0x59228a00
pop rax
pop r10
mov di, word [rbp + riz]
mov r10d, 0xe34e805
mov bp, di
movzx edx, r10w
mov dx, word [r8 + r10 - 0xe34e7fd]
lea rsi, [r10*8 + 0x43ba3e80]
or bp, dx
movsx eax, sil
neg r10w
btr r10, rsi
not bp
bswap r10d
mov edx, 0x5d326a1c
lea rcx, [rdx*4 + 0x142e4b3b]
mov word [r8 + rdx - 0x5d326a14], bp
btc si, cx
dec sil
mov edx, dword [r11 + rdx - 0x5d326a1c]
movzx edi, r10b
lea rdi, [rcx + rdi*8 - 0x6701356]
adc r11, 3
call fcn.140c0a79a
mov rdi, qword [r8]
mov r10, qword [r8 + 8]
mov eax, 0x1c01b6bd
mov cl, byte [r8 + rax*2 - 0x38036d6a]
call fcn.140c08f06
sub eax, 0xa7282fbf
push r9
bts si, cx
btc rsi, 0xb9
and rdi, rcx
xor dword [rsp + rdi], eax
pop r9
imul rdx, rcx
bts ecx, 0x3d
jae 0x140c24ee2
inc eax
sar dil, 0xe7
xor eax, 0x4493d935
xchg word [rsp + rdi + 0xa], r10w
xadd cx, di
mov qword [rsp + rdi - 0x9b9f], r9
pop r9
movzx edx, dil
dec dil
xor dword [rsp + rdi*2 - 0x1374c], eax
bswap rdx
jmp 0x140c118f4
pop r9
lea rsi, [rbp*4 - 0x7ff39952]
movsxd rax, eax
dec rsi
add rbx, rax
sal cl, 0xe1
rol rdi, cl
mov rax, qword [rbp + r8 - 9]
sal ecx, 0xb2
sub cl, dh
or r10, 0xfffffffffe255f07
or cx, word es:[rax + r10*8 + 0xe9507c8]
lea r10, [rbp*4 - 0x3be089cf]
lea r8, [rdi + r8 - 0x26e97ffa]
push rdx
imul rdx, qword [rsp + r10 + 0x3be089ab]
mov word [r10 + r8 + 0x3be089ab], cx
sal rsi, 0x93
mov qword [rsp + rdi - 0x26e98000], rbx
ret
movsxd rax, eax
adc di, dx
jne 0x140c0358e

Function at 0x140c124db
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x140c19a37
Function at 0x140c1788c
Capabilities:
Encode data using xor

Disassembly:
mov byte [rsp + 0x1d], 0x86
xor eax, r9d
movzx ebp, dil
shl cx, 0x68
xadd word [rsp + rbp - 0x37], bp
xor eax, 0x1f992311
mov qword [rsp + rbp*2 - 0xc2ec], 0x61896d03
not byte [rsp + rbp - 0x6172]
movzx esi, cx
ror eax, 1
inc eax
rol cl, 0x81
neg eax
bswap eax
neg si
neg eax
rol dword [rsp + rbp - 0x616a], 0x81
mov qword [rsp + rbp*8 - 0x30bb0], r9
lea rdx, [rbp - 0x41cf9270]
imul cx, bp
xor dword [rsp + rbp - 0x615a], eax
and word [rsp + rbp*2 - 0xc2da], cx
shl byte [rsp + rbp*2 - 0xc2eb], 0xa7
pop rdx
mov r9, qword [rsp + rbp*2 - 0xc2dc]
push rsi
sal byte [rsp + rbp - 0x6173], 0x87
ror bpl, 0x27
movsxd rax, eax
bswap edi
add rbx, rax
lea r10, [rsi + rcx*4 - 0x677001f8]
or si, word [rsp + rdi - 0x49dae6d3]
mov eax, dword [r11 + rbp - 0x61ee]
xor eax, r9d
sal r10d, 0x54
xor eax, 0x42b300b0
neg esi
sahf
invalid
neg esi
lea rbp, [rcx*2 - 0x39e43f7d]
sub word [rsp + rdi - 0x49dae6c6], r10w
ror eax, 1
xchg word [rsp + rdi - 0x49dae6cd], si
neg eax
call fcn.140c0ed23
add byte [rax], al
add byte [rdi], bl
and al, 0xa8
in al, dx
mov dword [rdi + rbp*4], edx
wait
xor eax, dword [rbp - 0x5a]
add ah, byte [rbp + 0x675a175]
loopne 0x140c17940
jmp 0x140c1790d

Function at 0x140c22465
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.140c1abf8
shr r10b, 0xe5
lea r10, [rsi*2 + 0x5da02a11]
je fcn.140c383d0
mov edi, 0xa1213db6
add edi, edi
mov esi, dword [r11 + rdi - 0x42427b6c]
lea r11, [r11 + rdi - 0x42427b68]
movsx ebp, di
mov r10d, edi
lea rdx, [rdi*8 - 0x58d0f3e6]
xor esi, r9d
rol esi, 2
lea rdi, [rbp + r10 + 0x7202e292]
sar rdx, 0x4b
dec esi
bswap esi
mov ecx, edi
sub esi, 0xa7282fbf

Function at 0x140c306d4
Capabilities:
Authenticate hmac

Disassembly:
push 0xffffffffd13909be
lea rsp, [rsp + 0x18]
jne 0x140c1e5d5
push 0x1bac5511
pop r8
push r8
mov r8, rax
lea rsp, [rsp + 8]
jmp 0x140c19a37
push 0xffffffffa603293f
cmp ebx, 3
jmp 0x140c1a98d

Function at 0x140c37ee6
Capabilities:
Encode data using base64

Disassembly:
rol word [rsp + 3], 0x4d
inc r10
xor edi, 0x6c34d4b9
jmp 0x140c4171c
mov r10d, 0xb2add8be
mov edx, r10d
not edi
mov dword [r8 + riz], edi
btr r10w, 0x24
mov ecx, 0x23b32a01
mov esi, edx
jmp rbx
movzx r11d, byte [r10]
xor r11d, edi
call fcn.140c37ee6
pop r10
pop r9
bt r10w, 0x1f
movsxd rax, eax
movsx edi, r10b
add rbx, rax
shr rbp, 0xf
sar bpl, 0x82
rol r10b, 0x65
add rdx, rbx
jmp rdx
and r11d, 0xff
mov r11d, dword [rbx + r11*4]
mov qword [rsp], 0x343c3383
sal byte [rsp + 7], 0xc3
inc qword [rsp]
shr edi, 8
dec word [rsp + 2]
sete byte [rsp + 2]
xor edi, r11d
or word [rsp + 1], 0xea9d
jno 0x140c0ef8b
jmp 0x140c49dbb
neg byte [rsp + 5]
dec rdx
lea rsp, [rsp + 8]
jne 0x140c349d6
mov esi, 0xa8beba25
movsx ebx, sil
mov r11d, esi
pop r11
rol bx, 0xef
pop rbx
jmp 0x140c22678
Function at 0x140c406e5
Capabilities:
Hash data using murmur3
Parse pe header

Disassembly:
lea r8, [r8 + rdi - 0x23]
shr dl, 0xa6
call fcn.140c0d319
mov edx, 0xda1ba33b
movsx eax, dx
movzx ecx, dl
mov edi, dword [r11 + rcx*2 - 0x76]
movzx ebp, dx
lea r11, [r11 + rcx*8 - 0x1d4]
mul rdx
sal rdx, 0x9d
xadd rbp, rax
xor edi, r9d
add al, dh
sub cx, 0x6a5
bt rbp, rbp
bswap edi
neg edi
mov r10d, eax
imul rdx, rax
movsx esi, cl
not edi
idiv r10w
or r10b, bpl
or rax, r10
lea edi, [rsi + rdi - 0x705af95c]
imul rbp, rcx
push r9
jno 0x140c3b090
xor dword [rsp + rdx - 0x4676], edi
xor rsi, rbp
pop r9
movsxd rdi, edi
sub si, 0x4489
add rbx, rdi
cbw
mov rsi, qword [rdx + r8 - 0x4676]
mov eax, dword [rdx + rsi - 0x4676]
or bp, 0x533b
lea r8, [r8 + rdx - 0x4672]
mov edi, r10d
mov dword [r8 + rdx - 0x4676], eax
js 0x140c39d78
mov r10d, 0x162a0296
mov eax, r10d
mov rdi, qword [r8 + r10*2 - 0x2c54052c]
xchg r10w, ax
mov rbp, qword [r8 + rax - 0x162a028e]
movsx edx, r10w
or rdx, rax
jae 0x140c45331
mov edx, 0xfabd2916
movzx eax, dl
mov ecx, dword [r11 + rax*2 - 0x2c]
lea rsi, [rax + rdx*2 - 0xf4c02c3]
cdq
lea r11, [rdx + r11 + 4]
call fcn.140c225d3
shl r10d, cl
jb 0x140c2d8b2
xor edx, r9d
inc r10d
xchg ebp, ecx
movzx eax, bpl
rol edx, 3
xor edx, 0xc7282d85
mov esi, 0x9f1f693e
not edx
ror edx, 1
bt eax, ebp
not rbp
call fcn.140c44f1b
add rbx, rcx
or dil, dl
jge 0x140c06a73
call fcn.140c47591
mov ecx, 0xe8811abd
lea r8, [rdx + r8 - 0xec]
jb 0x140c3cf61
btc eax, 0x98
shrd rdi, rdx, cl
mov ebp, eax
bswap esi
cdqe
mov qword [r8 + rax*2 - 0x2000500], rdi
movzx ecx, al
bts r10, rax
mov esi, dword [r11 + r10*8 - 0x788]
sar r10, 0x8b
cwde
lea r11, [r11 + rax*2 - 0x4fc]
jne 0x140c2f110
xor al, 0x27
neg ax
xor esi, r9d
lea rdx, [rax - 0xd4790c7]
add esi, 0xc082a102
cdqe
sar r10w, 0x67
not esi
xor ebp, 0x527ec26
jp 0x140c05c8a
mov edx, 0xa704f829
mov rbp, qword [r8 + riz]
movzx edi, dl
lea rdx, [rdx*2 - 0x6beb36c5]
movzx r10w, byte [rbp + rdi - 0x29]
jmp 0x140c2110f
mov eax, edi
jmp rbx
mov qword [rsp + rdx - 0x579f8010], 0xffffffffe2bd7c39
sal rdx, 0x1d
ror ecx, 1
mov qword [rsp + rax - 0x579f8010], r9
mul si
xor dword [rsp + rax - 0x579f0100], ecx
pop r9
movsxd rcx, ecx
jmp 0x140c39b70

Function at 0x140c40b0d
Capabilities:
Authenticate hmac

Disassembly:
push 0xffffffff8131fc14
and word [rsp + 4], 0x71bd
call fcn.140c22dad
push 0x7e953085
lea rsp, [rsp + 0x28]
jne 0x140c12386
mov rcx, rax
push 0x2692cbbf
lea rsp, [rsp + 8]
jmp 0x140c19a37

Function at 0x140c4a25a
Capabilities:
Authenticate hmac

Disassembly:
push 0xffffffffdc3195b9
test ebx, ebx
lea rsp, [rsp + 0x18]
je 0x140c19a4e
Function at 0x14000f940
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14008d040]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x20], 1
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jg 0x14000f9b1
jmp 0x14000fa42
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x44]
call fcn.1400689f0
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000fa38
nop dword [rax]
cmp qword [rsi + 0x10], 0
je 0x14000fa02
mov rdx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000f9f4
mov rdx, qword [rsi]
lea rcx, [rsp + 0x6c]
call fcn.14004ff1c
test eax, eax
jne 0x14000fa26
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14000fa19
mov eax, dword [rsp + 0x48]
mov dword [rdx], eax
add qword [rdi + 8], 4
jmp 0x14000fa26
lea r8, [rsp + 0x48]
mov rcx, rdi
call fcn.14000fb50
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000f9e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140044a90
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret