joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400271b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x140176810]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rsi, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], 0x400
mov ecx, 0x802
call fcn.1400dbb90
mov r14, rax
xor edx, edx
mov r8d, 0x802
mov rcx, rax
call fcn.1400ddc70
cmp qword [rbx + 0x18], 8
jb 0x140027229
mov rdx, qword [rbx]
jmp 0x14002722c
mov rdx, rbx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002727c
mov r8, rbx
lea rdx, str.Query_registry_value_with_key:
lea rcx, [rbp + 0x40]
call fcn.140022c70
cmp qword [rbp + 0x58], 8
jb 0x140027332
mov rcx, qword [rbp + 0x40]
call fcn.1400400f0
jmp 0x140027332
cmp dword [rsp + 0x30], 4
jne 0x140027310
mov ebx, dword [r14]
lea rcx, [rsp + 0x40]
call fcn.140027744
nop
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1400275dc
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140027930
mov rbx, rax
cmp rsi, rax
je 0x1400272e0
cmp qword [rsi + 0x18], 8
jb 0x1400272c6
mov rcx, qword [rsi]
call fcn.1400400f0
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
mov word [rsi], di
mov rdx, rbx
mov rcx, rsi
call fcn.140010474
cmp qword [rbp + 0x58], 8
jb 0x1400272f1
mov rcx, qword [rbp + 0x40]
call fcn.1400400f0
nop
lea rcx, [rbp - 0x28]
call fcn.140027860
lea rax, vtable.std::ios_base.0
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x28]
call fcn.1400db6b0
jmp 0x14002732f
cmp word [r14], di
je 0x140027321
mov rcx, r14
call fcn.1400ded00
mov rdi, rax
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.140010250
mov dil, 1
mov rcx, r14
call fcn.1400dde9c
mov al, dil
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1400dc400
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x170
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002738c
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov rax, qword [0x140176810]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14d, r9d
mov rbx, r8
mov rdi, rdx
mov r15, rcx
xor r12d, r12d
cmp qword [rdx + 0x10], r12
jne 0x1400273d5
xor al, al
jmp 0x1400274ed
mov esi, 4
cmp r9d, esi
je 0x140027412
cmp r9d, 1
jne 0x1400273ce
cmp qword [r8 + 0x18], 8
jb 0x1400273f1
mov rcx, qword [r8]
jmp 0x1400273f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [rax*2 + 2]
cmp qword [rbx + 0x18], 8
jb 0x14002740d
mov rax, qword [rbx]
jmp 0x14002742d
mov rax, rbx
jmp 0x14002742d
cmp qword [r8 + 0x18], 8
jb 0x14002741e
mov rcx, qword [r8]
jmp 0x140027421
mov rcx, rbx
call fcn.1400e2844
mov dword [rbp - 0x59], eax
lea rax, [rbp - 0x59]
cmp qword [rdi + 0x18], 8
jb 0x140027439
mov rdx, qword [rdi]
jmp 0x14002743c
mov rdx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400274eb
mov r8, rbx
lea rdx, str.Set_registry_value
lea rcx, [rbp - 9]
call fcn.140022c70
nop
lea r8, str._with_key:
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.14001bda8
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x49]
call fcn.140015508
cmp qword [rbp - 0x31], 8
jb 0x1400274a3
mov rcx, qword [rbp - 0x49]
call fcn.1400400f0
mov ebx, 7
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x39], r12
mov word [rbp - 0x49], r12w
cmp qword [rbp - 0x11], 8
jb 0x1400274c5
mov rcx, qword [rbp - 0x29]
call fcn.1400400f0
mov qword [rbp - 0x11], rbx
mov qword [rbp - 0x19], r12
mov word [rbp - 0x29], r12w
cmp qword [rbp + 0xf], 8
jb 0x1400273ce
mov rcx, qword [rbp - 9]
call fcn.1400400f0
jmp 0x1400273ce
mov al, 1
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400dc400
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400350e0
Capabilities:
Encode data using base64

Disassembly:
push rbx
push rdi
push r13
push r14
sub rsp, 0x28
mov r13, r9
mov rdi, r8
mov r14d, edx
mov rbx, rcx
test r8, r8
je 0x1400352f0
test r9, r9
je 0x1400352f0
mov ecx, edx
call fcn.140035040
cmp dword [r13], eax
jl 0x1400352f0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
xor r8d, r8d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x20], r15
mov eax, 0x55555556
mov r9d, r8d
lea r11d, [r8 + 0x13]
mov r10d, r8d
imul r14d
mov r15d, edx
mov eax, 0x6bca1af3
lea rbp, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
shr r15d, 0x1f
add r15d, edx
lea r12d, [r15*4]
imul r12d
mov esi, edx
sar esi, 5
mov eax, esi
shr eax, 0x1f
add esi, eax
js 0x140035244
cmp r8d, esi
jne 0x14003518f
imul ecx, esi, 0x4c
mov eax, r12d
sub eax, ecx
cdq
and edx, 3
lea r11d, [rdx + rax]
sar r11d, 2
test r11d, r11d
jle 0x140035213
mov ebp, r11d
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
nop
movzx eax, byte [rbx + 2]
movzx ecx, byte [rbx + 1]
movzx edx, byte [rbx]
shl edx, 8
add rdi, 4
add rbx, 3
or edx, ecx
shl edx, 8
or edx, eax
shl edx, 8
mov eax, edx
shl edx, 6
shr eax, 0x1a
movzx ecx, al
movzx eax, byte [rcx + r12]
mov byte [rdi - 4], al
mov eax, edx
shl edx, 6
shr eax, 0x1a
movzx ecx, al
movzx eax, byte [rcx + r12]
mov byte [rdi - 3], al
mov eax, edx
shr eax, 0x1a
movzx ecx, al
movzx eax, byte [rcx + r12]
mov byte [rdi - 2], al
mov eax, edx
shr eax, 0x14
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [rdi - 1], al
dec rbp
jne 0x1400351a0
lea r12d, [r15*4]
lea r9d, [r9 + r11*4]
inc r10d
mov word [rdi], 0xa0d
add r9d, 2
add rdi, 2
cmp r10d, esi
jle 0x140035179
lea rbp, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
test r9d, r9d
je 0x140035244
sub rdi, 2
sub r9d, 2
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
lea eax, [r15 + r15*2]
mov r15, qword [rsp + 0x20]
sub r14d, eax
je 0x1400352d7
lea r10d, [r14 + 1]
test r10d, r10d
je 0x1400352d7
test r14d, r14d
jle 0x140035271
movzx r8d, byte [rbx]
inc rbx
shl r8d, 8
cmp r14d, 1
jle 0x140035284
movzx eax, byte [rbx]
or r8d, eax
inc rbx
shl r8d, 8
cmp r14d, 2
jle 0x140035294
movzx eax, byte [rbx]
or r8d, eax
shl r8d, 8
test r10d, r10d
jle 0x1400352bc
mov edx, r10d
mov eax, r8d
inc rdi
shl r8d, 6
shr eax, 0x1a
movzx ecx, al
movzx eax, byte [rcx + rbp]
mov byte [rdi - 1], al
dec rdx
jne 0x1400352a0
mov edx, 4
add r9d, r10d
sub edx, r10d
test edx, edx
jle 0x1400352d4
mov ecx, edx
mov eax, 0x3d
rep stosb byte [rdi], al
add r9d, edx
mov rbp, qword [rsp + 0x50]
mov dword [r13], r9d
mov eax, 1
add rsp, 0x28
pop r14
pop r13
pop rdi
pop rbx
ret
xor eax, eax
add rsp, 0x28
pop r14
pop r13
pop rdi
pop rbx
ret
Function at 0x140035730
Capabilities:
Create directory

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x18], 8
mov rdi, rcx
jb 0x140035745
mov rdx, qword [rcx]
jmp 0x140035748
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x1400357aa
cmp eax, 0xb7
je 0x1400357aa
cmp eax, 0x50
je 0x1400357aa
cmp qword [rdi + 0x18], 8
mov qword [rsp + 0x40], rbx
jb 0x140035772
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.14003c140
lea r8, str.Unable_to_create_directoryPath_...Error_Code_is:__d_._At_desired_location:_s
lea rdx, str.Utilities
mov r9d, ebx
mov rcx, rax
mov qword [rsp + 0x20], rdi
call fcn.14003d0c0
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
mov al, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1400357c0
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbx, rcx
call fcn.140035a50
test al, al
jne 0x1400357e4
mov al, 1
jmp 0x14003585f
cmp qword [rbx + 0x18], 8
jb 0x1400357f0
mov rcx, qword [rbx]
jmp 0x1400357f3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
sete dil
test dil, dil
jne 0x14003585b
cmp qword [rbx + 0x18], 8
jb 0x14003580f
mov rbx, qword [rbx]
mov eax, dword [0x140184200]
test al, 1
jne 0x140035834
or eax, 1
mov dword [0x140184200], eax
call fcn.14003bda0
lea rcx, [0x140123810]
call fcn.1400dd8d0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, str.Failed_to_delete_file:__s_LastError:_d
lea rdx, str.Utilities
lea rcx, [0x140184130]
call fcn.14003d190
movzx eax, dil
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140035a50
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x140035a6c
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140035ac6
cmp qword [rbx + 0x18], 8
jb 0x140035a80
mov rbx, qword [rbx]
mov eax, dword [0x140184200]
test al, 1
jne 0x140035aa5
or eax, 1
mov dword [0x140184200], eax
call fcn.14003bda0
lea rcx, [0x140123810]
call fcn.1400dd8d0
nop
mov r9, rbx
lea r8, str.File__s_does_not_exist
lea rdx, str.Utilities
lea rcx, [0x140184130]
call fcn.14003ce50
xor al, al
jmp 0x140035ac8
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140035ad0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140176810]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor r9d, r9d
lea r8d, [r9 + 0x1c]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x140035b52
mov eax, dword [0x140184200]
test al, 1
jne 0x140035b34
or eax, 1
mov dword [0x140184200], eax
call fcn.14003bda0
lea rcx, [0x140123810]
call fcn.1400dd8d0
nop
lea r8, str.Unable_to_retreive_Local_App_Data_Path_from_Win_library:_n
lea rdx, str.Utilities
lea rcx, [0x140184130]
call fcn.14003d190
xor al, al
jmp 0x140035b7a
cmp word [rsp + 0x30], 0
jne 0x140035b5e
xor eax, eax
jmp 0x140035b68
lea rcx, [rsp + 0x30]
call fcn.1400ded00
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140010250
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400dc400
add rsp, 0x250
pop rbx
ret

Function at 0x14003b010
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x18
mov qword [rsp], 0xfffffffffffffffe
mov rdx, rcx
xor r8d, r8d
mov qword [rcx + 8], r8
mov byte [rcx + 0x51], r8b
mov qword [rcx + 0x58], 0x10
cmp byte [rcx + 0x51], r8b
jne 0x14003b042
mov byte [rcx + 0x51], 1
add rcx, 0x10
jmp 0x14003b045
mov rcx, r8
mov qword [rdx + 0x60], rcx
lea rcx, [rdx + 0x68]
mov byte [rcx + 0x49], r8b
mov qword [rcx + 0x50], 0x10
cmp byte [rcx + 0x49], r8b
jne 0x14003b070
mov byte [rcx + 0x49], 1
mov rax, rcx
neg rax
and eax, 0xf
lea r8, [rax + rcx]
mov qword [rcx + 0x58], r8
mov rcx, qword [rdx + 0xc0]
movups xmm0, xmmword [0x140149148]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140149158]
movups xmmword [rcx + 0x10], xmm1
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14003b0a0
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x18
mov qword [rsp], 0xfffffffffffffffe
mov rdx, rcx
xor ecx, ecx
mov qword [rdx + 8], rcx
mov byte [rdx + 0x51], cl
mov qword [rdx + 0x58], 0x10
cmp byte [rdx + 0x51], cl
jne 0x14003b0cf
mov byte [rdx + 0x51], 1
lea r8, [rdx + 0x10]
jmp 0x14003b0d2
mov r8, rcx
mov qword [rdx + 0x60], r8
mov byte [rdx + 0xa9], cl
mov qword [rdx + 0xb0], 0x10
cmp byte [rdx + 0xa9], cl
jne 0x14003b0fa
mov byte [rdx + 0xa9], 1
lea rcx, [rdx + 0x68]
mov qword [rdx + 0xb8], rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14003bda0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push rsi
sub rsp, 0x450
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x460], rbx
mov rax, qword [0x140176810]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea rsi, [0x140184130]
mov qword [rsp + 0x20], rsi
call fcn.1400d0d90
nop
lea rax, vtable.Logger.0
mov qword [0x140184130], rax
mov dword [0x1401841f8], 0
mov word [0x1401841fc], 0
lea rdx, [rsp + 0x40]
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14003be2b
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, 0x10
call fcn.1400de2bc
mov rbx, rax
test rax, rax
je 0x14003be4a
mov qword [rax], 0
mov byte [rax + 8], 0
jmp 0x14003be4c
xor ebx, ebx
mov qword [0x1401841f0], rbx
cmp qword [rbx], 0
jne 0x14003be73
lea r9, str.Local5071F542_DF26_4e46_810E_74570ED35255
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [rbx], rax
mov ecx, 0x110
call fcn.1400de2bc
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003be90
mov rcx, rax
call fcn.1400cea00
nop
mov qword [0x1401841e8], rax
mov edx, 0x1e
mov rcx, rax
call fcn.1400cc280
mov rcx, qword [0x1401841e8]
call fcn.1400ccaf0
mov eax, dword [0x140184220]
test al, 1
jne 0x14003bef2
or eax, 1
mov dword [0x140184220], eax
mov qword [0x140184228], 0
mov qword [0x140184230], 0
call fcn.1400ce0c0
mov qword [0x140184228], rax
lea rcx, [0x140123940]
call fcn.1400dd8d0
nop
mov rdx, qword [0x1401841e8]
lea rcx, [0x140184228]
call fcn.1400cce10
lea rcx, [0x1401400e0]
call fcn.1400ded00
mov r8, rax
lea rdx, [0x1401400e0]
lea rcx, [0x140184160]
call fcn.140010250
nop
mov rax, rsi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400dc400
mov rbx, qword [rsp + 0x460]
add rsp, 0x450
pop rsi
ret
Function at 0x14003d600
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r10d, r10d
mov rax, r8
mov r11, rcx
shr rax, 3
mov ebx, r10d
mov esi, r10d
test rax, rax
je 0x14003d654
mov rdi, rcx
mov r9, rdx
mov rsi, rax
sub rdi, rdx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rdi + r9]
lea r9, [r9 + 8]
xor rcx, qword [r9 - 8]
or rbx, rcx
dec rax
jne 0x14003d640
lea rax, [rsi*8]
sub r8, rax
jne 0x14003d677
test rbx, rbx
sete al
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov r9, rbx
add r11, rax
add rdx, rax
shr r9, 0x20
mov rsi, r10
or r9d, ebx
mov rbx, r8
shr rbx, 2
test rbx, rbx
je 0x14003d6c2
mov rdi, r11
mov rcx, rdx
mov rsi, rbx
sub rdi, rdx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx + rdi]
lea rcx, [rcx + 4]
xor eax, dword [rcx - 4]
or r9d, eax
dec rbx
jne 0x14003d6b0
lea rax, [rsi*4]
sub r8, rax
jne 0x14003d6e5
test r9d, r9d
sete al
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
add r11, rax
add rdx, rax
mov ecx, r9d
shr ecx, 0x18
mov eax, r9d
shr eax, 0x10
or cl, al
mov eax, r9d
shr eax, 8
or cl, al
or cl, r9b
test r8, r8
je 0x14003d723
sub r11, rdx
nop dword [rax]
movzx eax, byte [rdx + r11]
lea rdx, [rdx + 1]
xor al, byte [rdx - 1]
or cl, al
dec r8
jne 0x14003d710
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
test cl, cl
sete al
ret
Function at 0x140044a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, edx
mov edi, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova edi, ecx
cmp edi, dword [rbx]
jne 0x140044a94
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x140182a08]
test rax, rax
je 0x140044aa2
call rax
shl edi, 4
mov ecx, edi
call fcn.140040790
mov rcx, qword [0x140182a10]
mov rdi, rax
test rcx, rcx
je 0x140044abd
call rcx
test rdi, rdi
je 0x140044a87
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.140040ad0
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x140179e50]
xor edx, edx
mov rcx, rdi
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rbx], esi
shl r8, 4
call fcn.1400ddc70
mov rcx, qword [rbx + 8]
xor r11d, r11d
mov qword [rbx + 8], r11
test rcx, rcx
je 0x140044bd7
mov qword [rsp + 0x30], rbp
lea rbp, [0x140138ef0]
nop word [rax + rax]
mov r9d, dword [rcx + 0x20]
mov r10, qword [rcx + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x140044b52
movzx edx, byte [r10]
dec r9d
lea r10, [r10 + 1]
movzx r8d, byte [rdx + rbp]
lea edx, [rax*8]
xor r8d, edx
xor eax, r8d
test r9d, r9d
jg 0x140044b30
mov r9, qword [rcx]
xor edx, edx
div esi
mov r8d, edx
shl r8, 4
add r8, rdi
je 0x140044baa
mov eax, dword [r8]
test eax, eax
je 0x140044b72
mov rdx, qword [r8 + 8]
jmp 0x140044b75
mov rdx, r11
inc eax
mov qword [r8 + 8], rcx
mov dword [r8], eax
test rdx, rdx
je 0x140044baa
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x140044ba0
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x140044bc6
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x140044bc6
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140044bbe
mov qword [rax + 8], rcx
mov qword [rcx + 8], r11
mov qword [rbx + 8], rcx
mov rcx, r9
test r9, r9
jne 0x140044b20
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140044d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x20
mov rbp, r9
mov r9d, dword [rcx]
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
lea r12, [0x140138ef0]
test r9d, r9d
je 0x140044dba
xor eax, eax
mov r10, rdx
test r8d, r8d
jle 0x140044db0
nop dword [rax]
movzx ecx, byte [r10]
dec r8d
lea r10, [r10 + 1]
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x140044d90
xor edx, edx
div r9d
mov r15d, edx
jmp 0x140044dbd
xor r15d, r15d
mov r9d, r15d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140044bf0
mov rdx, rax
test rax, rax
je 0x140044e5a
mov rdi, qword [rax + 0x10]
test rbp, rbp
jne 0x140044e4a
mov rax, qword [rax + 8]
test rax, rax
je 0x140044df4
mov rcx, qword [rdx]
mov qword [rax], rcx
jmp 0x140044dfb
mov rax, qword [rdx]
mov qword [rbx + 8], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x140044e0b
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140044e2d
mov ecx, r15d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], rdx
jne 0x140044e2b
mov rax, qword [rdx]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, rdx
call fcn.140040ad0
dec dword [rbx + 4]
jne 0x140044e52
mov rcx, rbx
call fcn.140044900
mov rax, rdi
jmp 0x140044f2b
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, rdi
jmp 0x140044f2b
test rbp, rbp
jne 0x140044e66
xor eax, eax
jmp 0x140044f2b
mov ecx, 0x28
mov qword [rsp + 0x40], r14
call fcn.140040790
mov r14, rax
test rax, rax
jne 0x140044e85
mov rax, rbp
jmp 0x140044f26
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], edi
mov qword [rax + 0x10], rbp
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x140044ee4
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x140044ee4
add edx, edx
mov rcx, rbx
call fcn.140044a60
test eax, eax
je 0x140044ee4
xor eax, eax
test edi, edi
jle 0x140044edd
nop word [rax + rax]
movzx ecx, byte [rsi]
dec edi
lea rsi, [rsi + 1]
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test edi, edi
jg 0x140044ec0
xor edx, edx
div dword [rbx]
mov r15d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140044f04
mov edx, r15d
mov r8, r14
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.1400449f0
jmp 0x140044f24
mov rax, qword [rbx + 8]
mov qword [r14], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140044f18
mov qword [rax + 8], r14
mov qword [r14 + 8], 0
mov qword [rbx + 8], r14
xor eax, eax
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x14005e310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r15, rcx
mov r14d, edx
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r12d, r9d
mov r8d, dword [r11 + 0x30]
mov r10, qword [rax + 8]
mov r13, qword [r11]
movsxd rax, dword [r10 + 0x30]
mov ecx, r8d
mov dword [rsp + 0x78], r8d
cmp eax, r8d
mov qword [rsp + 0x28], rax
cmovl ecx, eax
xor ebx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, rax
imul r14, rax
cmp eax, r8d
je 0x14005e378
cmp byte [r13 + 0x13], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r14
sub rdi, rcx
test ebx, ebx
jne 0x14005e49e
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x30], rsi
cmp rdi, r14
jge 0x14005e480
mov rax, rdi
movsxd rbp, r8d
mov qword [rsp + 0x20], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x140179c70]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x14005e475
lea r8, [rsp + 0x20]
xor r9d, r9d
mov edx, r10d
mov rcx, r13
call fcn.14004ebf0
mov ebx, eax
test eax, eax
jne 0x14005e461
mov rcx, qword [rsp + 0x20]
call fcn.14004f490
mov ebx, eax
test eax, eax
jne 0x14005e461
mov rax, qword [rsp + 0x20]
movsxd r8, dword [rsp + 0x70]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x28]
add rdx, qword [rsp + 0x80]
call fcn.1400dc430
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x14005e461
test r12d, r12d
jne 0x14005e461
mov rax, qword [r15 + 0x28]
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0x3c]
mov eax, edx
mov byte [rsi + 0x1f], dl
shr eax, 0x18
mov byte [rsi + 0x1c], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0x1d], al
mov eax, edx
shr eax, 8
mov byte [rsi + 0x1e], al
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14005e470
call fcn.14004ef60
mov r8d, dword [rsp + 0x78]
add rdi, rbp
test ebx, ebx
je 0x14005e393
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x30]
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x140076b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
mov ebx, r9d
mov esi, r8d
mov r11, rdx
mov rdi, rcx
xor r10d, r10d
lea rax, [rcx + 0x88]
nop
cmp dword [rax + 0xc], 0
jle 0x140076bc3
cmp dword [rax], ebx
jne 0x140076bc3
movsx edx, word [rax + 4]
cmp edx, r8d
je 0x140076c11
inc r10d
add rax, 0x14
cmp r10d, 0xa
jl 0x140076bb0
mov r9d, r8d
mov qword [rsp + 0x40], rbp
mov ebp, dword [rsp + 0x60]
mov r8d, ebx
mov rdx, r11
mov rcx, r14
mov dword [rsp + 0x20], ebp
call fcn.140076aa0
movzx r8d, byte [rsp + 0x68]
test r8b, r8b
je 0x140076c2a
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x140076c3a
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r8b
jmp 0x140076c3a
mov ecx, dword [rcx + 0x74]
mov dword [rax + 0x10], ecx
inc dword [rdi + 0x74]
mov edx, dword [rax + 0xc]
mov rcx, rdi
call fcn.140076a00
mov eax, dword [rax + 0xc]
jmp 0x140076c41
mov r9d, ebp
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call fcn.1400767d0
mov eax, ebp
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret