joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011f39a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14011f370
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x14011f430
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14011f48a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14011f480
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x140122330
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.1401223a0
shl edx, 4
test eax, eax
jne 0x140122396
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x14012235b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x14012bd60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, qword [rsp + 0xa8]
mov r12, rcx
mov r13, rdx
mov rbx, r8
mov r15, r9
cmp r8, 0xf
jbe 0x14012bf47
lea rdi, [r8 - 0x10]
mov r8, qword [rsp + 0xa0]
shr rdi, 4
lea rsi, [rdi + 1]
shl rsi, 4
mov qword [rsp + 0x28], rsi
lea r14, [rcx + rsi]
mov rsi, rdx
jmp 0x14012bdbb
mov rsi, rcx
mov rcx, qword [r12]
xor rcx, qword [r8]
add r12, 0x10
mov rdx, rsi
mov qword [rsi], rcx
mov rcx, qword [r12 - 8]
xor rcx, qword [r8 + 8]
mov r8, r15
mov qword [rsi + 8], rcx
mov rcx, rsi
call rbp
lea rcx, [rsi + 0x10]
mov r8, rsi
cmp r12, r14
jne 0x14012bdb8
mov rsi, qword [rsp + 0x28]
shl rdi, 4
and ebx, 0xf
lea rdx, [r13 + rdi]
add rsi, r13
xor eax, eax
test rbx, rbx
je 0x14012bf42
movzx ecx, byte [r14 + rax]
xor cl, byte [rdx + rax]
mov byte [rsi + rax], cl
add rax, 1
cmp rbx, rax
jne 0x14012be0c
movzx eax, byte [rdx + rbx]
mov byte [rsi + rbx], al
cmp rbx, 0xf
je 0x14012bf10
movzx eax, byte [rdx + rbx + 1]
mov byte [rsi + rbx + 1], al
cmp rbx, 0xe
je 0x14012bf10
movzx eax, byte [rdx + rbx + 2]
mov byte [rsi + rbx + 2], al
cmp rbx, 0xd
je 0x14012bf10
movzx eax, byte [rdx + rbx + 3]
mov byte [rsi + rbx + 3], al
cmp rbx, 0xc
je 0x14012bf10
movzx eax, byte [rdx + rbx + 4]
mov byte [rsi + rbx + 4], al
cmp rbx, 0xb
je 0x14012bf10
movzx eax, byte [rdx + rbx + 5]
mov byte [rsi + rbx + 5], al
cmp rbx, 0xa
je 0x14012bf10
movzx eax, byte [rdx + rbx + 6]
mov byte [rsi + rbx + 6], al
cmp rbx, 9
je 0x14012bf10
movzx eax, byte [rdx + rbx + 7]
mov byte [rsi + rbx + 7], al
cmp rbx, 8
je 0x14012bf10
movzx eax, byte [rdx + rbx + 8]
mov byte [rsi + rbx + 8], al
cmp rbx, 7
je 0x14012bf10
movzx eax, byte [rdx + rbx + 9]
mov byte [rsi + rbx + 9], al
cmp rbx, 6
je 0x14012bf10
movzx eax, byte [rdx + rbx + 0xa]
mov byte [rsi + rbx + 0xa], al
cmp rbx, 5
je 0x14012bf10
movzx eax, byte [rdx + rbx + 0xb]
mov byte [rsi + rbx + 0xb], al
cmp rbx, 4
je 0x14012bf10
movzx eax, byte [rdx + rbx + 0xc]
mov byte [rsi + rbx + 0xc], al
cmp rbx, 3
je 0x14012bf10
movzx eax, byte [rdx + rbx + 0xd]
mov byte [rsi + rbx + 0xd], al
cmp rbx, 1
jne 0x14012bf10
movzx eax, byte [rdx + 0xf]
mov byte [rsi + 0xf], al
nop
mov r8, r15
mov rdx, rsi
mov rcx, rsi
call rbp
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rdi, qword [rsp + 0xa0]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, rdx
jmp 0x14012bf1b
mov rdx, qword [rsp + 0xa0]
mov rsi, r13
mov r14, rcx
jmp 0x14012be01
Function at 0x14012d550
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xc8]
mov rbx, rcx
mov rdi, rdx
mov r12, r9
test r8, r8
je 0x14012d5d3
lea r13, [rcx + r8]
mov ecx, dword [rsp + 0xc0]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
test ecx, ecx
jne 0x14012d5e0
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
movzx edx, byte [rsi]
xor edx, eax
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov byte [rdi - 1], dl
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x14012d590
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
xor al, byte [rsi]
mov byte [rdi - 1], al
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x14012d5e0
jmp 0x14012d5d3
Function at 0x14012f320
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x30]
cmp qword [rcx + 0x170], 0
mov r14, qword [rcx + 0x160]
lea rsi, [rax*8]
mov rax, qword [rcx + 0x38]
mov rbx, rcx
mov r12, rdx
lea r15, [rcx + 0x60]
mov rbp, r8
lea rdi, [rax*8]
lea r13, [rcx + 0x40]
je 0x14012f373
mov rdx, r15
mov rcx, r13
call r14
mov rax, rsi
mov rdx, rdi
mov rcx, r13
bswap rax
bswap rdx
xor rax, qword [rbx + 0x40]
xor rdx, qword [rbx + 0x48]
movq xmm1, rdx
movq xmm0, rax
mov rdx, r15
punpcklqdq xmm0, xmm1
movups xmmword [rbx + 0x40], xmm0
call r14
movdqu xmm0, xmmword [rbx + 0x40]
movdqu xmm2, xmmword [rbx + 0x20]
pxor xmm0, xmm2
movups xmmword [rbx + 0x40], xmm0
test r12, r12
je 0x14012f3e0
cmp rbp, 0x10
ja 0x14012f3e0
mov r8, rbp
mov rdx, r12
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.14006cd10
mov eax, 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140134600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140134720
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140134660
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140134660
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140134660
Function at 0x140142930
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x90]
mov r12, rcx
mov esi, edx
mov r14, r8
mov edi, r9d
test edx, edx
js 0x140142ae0
test r9d, r9d
js 0x140142ae0
cmp ebx, 0xa
jle 0x14014296b
cmp r9d, ebx
jle 0x1401429b0
mov r8d, 0x9f
mov edx, 0x71
mov ecx, 4
mov dword [rsp + 0x20], 0x110
lea r9, str.rsa_pk1.c
mov r14d, 0xffffffff
call fcn.1400ba710
mov eax, r14d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r8d, 0xce
lea rdx, str.rsa_pk1.c
mov ecx, ebx
call fcn.14006d260
mov r13, rax
test rax, rax
je 0x140142aeb
movsxd rbp, ebx
xor edx, edx
mov rcx, rax
mov r8, rbp
call sub.msvcrt.dll_memset
movsxd r8, edi
mov rdx, r14
sub rbp, r8
lea rcx, [r13 + rbp]
call sub.msvcrt.dll_memcpy
movzx eax, byte [r13 + 1]
xor r8d, r8d
xor r9d, r9d
movzx edx, byte [r13]
mov ecx, 2
xor eax, 2
movzx eax, al
mov r10d, eax
sub eax, 1
not r10d
and eax, r10d
mov r10d, edx
sub edx, 1
not r10d
and r10d, edx
and r10d, eax
sar r10d, 0x1f
nop dword [rax]
movzx edx, byte [r13 + rcx]
mov r11d, r8d
xor r11d, ecx
add rcx, 1
mov eax, edx
sub edx, 1
not eax
and eax, edx
mov edx, r9d
not edx
sar eax, 0x1f
and edx, r11d
or r9d, eax
and edx, eax
xor r8d, edx
cmp ebx, ecx
jg 0x140142a30
lea eax, [r8 - 0xa]
mov edx, r8d
xor edx, 0xa
xor eax, 0xa
or eax, edx
mov edx, esi
xor eax, r8d
add r8d, 1
sar eax, 0x1f
sub ebx, r8d
not eax
sub edx, ebx
mov r14d, ebx
and r10d, eax
mov eax, ebx
xor edx, ebx
xor eax, esi
or edx, eax
xor esi, edx
sar esi, 0x1f
not esi
test esi, r10d
jne 0x140142ab0
mov rcx, r13
call fcn.14006d560
jmp 0x14014296b
movsxd r8, r8d
mov rcx, r12
lea rdx, [r13 + r8]
movsxd r8, ebx
call sub.msvcrt.dll_memcpy
mov rcx, r13
call fcn.14006d560
cmp ebx, 0xffffffff
jne 0x140142995
jmp 0x14014296b
mov r14d, 0xffffffff
jmp 0x140142995
mov r8d, 0x41
mov edx, 0x71
mov ecx, 4
mov dword [rsp + 0x20], 0xd0
lea r9, str.rsa_pk1.c
mov r14d, 0xffffffff
call fcn.1400ba710
jmp 0x140142995
Function at 0x140144bc0
Capabilities:
Check for software breakpoints

Disassembly:
push r12
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
cmp eax, r9d
jne 0x140144c98
movzx r9d, byte [r8]
lea edx, [r9 - 0x6a]
cmp dl, 1
ja 0x140144c98
lea rdx, [r8 + 1]
lea r12d, [rax - 2]
cmp r9b, 0x6b
je 0x140144c18
movsxd rax, r12d
cmp byte [rdx + rax], 0xcc
jne 0x140144cc7
mov r8d, r12d
call sub.msvcrt.dll_memcpy
mov eax, r12d
add rsp, 0x30
pop r12
ret
lea r12d, [rax - 3]
test r12d, r12d
jle 0x140144c4b
xor eax, eax
jmp 0x140144c36
cmp r8b, 0xbb
jne 0x140144c58
add eax, 1
cmp r12d, eax
je 0x140144c90
movzx r8d, byte [rdx]
add rdx, 1
cmp r8b, 0xba
jne 0x140144c28
sub r12d, eax
test eax, eax
jne 0x140144bf2
mov dword [rsp + 0x20], 0x83
jmp 0x140144c60
mov dword [rsp + 0x20], 0x7b
mov r8d, 0x8a
mov edx, pe_nt_image_headers64
mov ecx, 4
mov r12d, 0xffffffff
lea r9, str.rsa_x931.c
call fcn.1400ba710
mov eax, r12d
add rsp, 0x30
pop r12
ret
xor r12d, r12d
jmp 0x140144bf2
mov r8d, 0x89
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x70
lea r9, str.rsa_x931.c
mov r12d, 0xffffffff
call fcn.1400ba710
jmp 0x140144c07
mov r8d, 0x8b
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x8b
lea r9, str.rsa_x931.c
mov r12d, 0xffffffff
call fcn.1400ba710
jmp 0x140144c07
Function at 0x14014ff10
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbp, rcx
test rcx, rcx
je 0x1401501b5
mov r9d, 0x14d
mov edx, 0x1e
mov ecx, 9
lea r8, str.eng_list.c
call fcn.14006cb20
mov r12, qword [0x1405a65f8]
test r12, r12
jne 0x14014ff69
jmp 0x140150068
mov r12, qword [r12 + 0xd0]
test r12, r12
je 0x140150068
mov rdx, qword [r12]
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14014ff58
test byte [r12 + 0xa8], 4
jne 0x14014ffc0
add dword [r12 + 0xac], 1
mov r9d, 0x164
mov edx, 0x1e
mov ecx, 0xa
lea r8, str.eng_list.c
call fcn.14006cb20
mov rax, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.1400aec50
test rax, rax
je 0x140150068
movdqu xmm1, xmmword [r12 + 0x20]
movdqu xmm0, xmmword [r12 + 0x30]
movdqu xmm2, xmmword [r12 + 0x10]
movdqu xmm3, xmmword [r12]
movups xmmword [rax + 0x20], xmm1
movups xmmword [rax], xmm3
movups xmmword [rax + 0x10], xmm2
movups xmmword [rax + 0x30], xmm0
mov rdx, qword [r12 + 0x40]
mov qword [rax + 0x40], rdx
movdqu xmm4, xmmword [r12 + 0x48]
movups xmmword [rax + 0x48], xmm4
mov rdx, qword [r12 + 0x58]
mov qword [rax + 0x58], rdx
movdqu xmm1, xmmword [r12 + 0x78]
movdqu xmm0, xmmword [r12 + 0x88]
movdqu xmm5, xmmword [r12 + 0x68]
movups xmmword [rax + 0x78], xmm1
movups xmmword [rax + 0x68], xmm5
movups xmmword [rax + 0x88], xmm0
mov rdx, qword [r12 + 0xa0]
mov qword [rax + 0xa0], rdx
mov edx, dword [r12 + 0xa8]
mov r12, rax
mov dword [rax + 0xa8], edx
jmp 0x14014ff8d
mov ecx, 0xa
mov r9d, 0x164
mov rsi, rbp
mov edx, 0x1e
lea r8, str.eng_list.c
lea r12, str.dynamic
call fcn.14006cb20
mov rdi, r12
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x1401501b0
lea rcx, str.OPENSSL_ENGINES
call sub.msvcrt.dll_getenv
mov rcx, r12
test rax, rax
mov rbx, rax
lea rax, str._i2pd_stage_lib_engines
cmove rbx, rax
call fcn.14014ff10
mov r12, rax
test rax, rax
je 0x1401501b0
xor r9d, r9d
mov r8, rbp
lea rdx, [0x1404c867c]
mov rcx, rax
call fcn.140150bb0
test eax, eax
je 0x14015015f
xor r9d, r9d
lea r8, [0x1404c867f]
lea rdx, str.DIR_LOAD
mov rcx, r12
call fcn.140150bb0
test eax, eax
je 0x14015015f
xor r9d, r9d
mov r8, rbx
lea rdx, str.DIR_ADD
mov rcx, r12
call fcn.140150bb0
test eax, eax
je 0x14015015f
xor r9d, r9d
lea r8, [0x1404c8692]
lea rdx, str.LIST_ADD
mov rcx, r12
call fcn.140150bb0
test eax, eax
je 0x14015015f
xor r9d, r9d
xor r8d, r8d
lea rdx, str.LOAD
mov rcx, r12
call fcn.140150bb0
test eax, eax
jne 0x14014ffa9
mov rcx, r12
xor r12d, r12d
call fcn.1400aee30
mov r8d, 0x74
mov edx, 0x6a
mov dword [rsp + 0x20], 0x186
lea r9, str.eng_list.c
mov ecx, 0x26
call fcn.1400ba710
mov r8, rbp
mov ecx, 2
lea rdx, [0x1404c86a2]
call fcn.1400bb680
mov rax, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor r12d, r12d
jmp 0x14015015f
mov dword [rsp + 0x20], 0x14a
lea r9, str.eng_list.c
mov r8d, 0x43
xor r12d, r12d
mov edx, 0x6a
mov ecx, 0x26
call fcn.1400ba710
jmp 0x14014ffa9
Function at 0x140154610
Capabilities:
Encode data using base64

Disassembly:
push rbx
xor r11d, r11d
test r8d, r8d
jle 0x1401546c7
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
jmp 0x140154684
movzx eax, byte [rdx + 1]
add rdx, 3
shl eax, 8
or eax, r9d
movzx r9d, byte [rdx - 1]
mov ebx, eax
or r9d, eax
shr eax, 0xc
and eax, 0x3f
shr ebx, 0x12
movzx eax, byte [r10 + rax]
movzx ebx, byte [r10 + rbx]
mov byte [rcx - 3], al
mov eax, r9d
and r9d, 0x3f
shr eax, 6
mov byte [rcx - 4], bl
and eax, 0x3f
movzx eax, byte [r10 + rax]
mov byte [rcx - 2], al
movzx eax, byte [r10 + r9]
mov byte [rcx - 1], al
sub r8d, 3
je 0x1401546c7
movzx eax, byte [rdx]
mov rbx, rcx
add r11d, 4
add rcx, 4
shl eax, 0x10
mov r9d, eax
cmp r8d, 2
jg 0x140154630
je 0x1401546d0
shr eax, 0x12
movzx eax, byte [r10 + rax]
mov byte [rbx], al
mov eax, r9d
shr eax, 0xc
and eax, 0x30
movzx eax, byte [r10 + rax]
mov byte [rbx + 1], al
mov eax, 0x3d
mov byte [rbx + 2], al
mov byte [rbx + 3], 0x3d
mov eax, r11d
mov byte [rcx], 0
pop rbx
ret
movzx edx, byte [rdx + 1]
shl edx, 8
or edx, eax
shr eax, 0x12
movzx eax, byte [r10 + rax]
mov byte [rbx], al
mov eax, edx
shr edx, 6
shr eax, 0xc
and edx, 0x3c
and eax, 0x3f
movzx eax, byte [r10 + rax]
mov byte [rbx + 1], al
movzx eax, byte [r10 + rdx]
jmp 0x1401546c0
Function at 0x140169920
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
mov r12, r8
test r8, r8
je 0x1401699c9
test rcx, rcx
je 0x1401699f0
mov rcx, qword [rcx + 0x10]
lea r13, [rsp + 0x20]
test rdx, rdx
je 0x1401699ab
movq xmm0, rdx
movq xmm1, r8
lea r13, [rsp + 0x20]
punpcklqdq xmm0, xmm1
mov rdx, r13
movaps xmmword [rsp + 0x20], xmm0
call fcn.1400b7c70
test rax, rax
je 0x140169990
mov rax, qword [rax + 0x10]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov ecx, 4
lea rdi, [0x1404cbc80]
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x1401699e0
mov rcx, qword [rbx + 0x10]
lea rax, [0x1404cbc84]
mov rdx, r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.1400b7c70
test rax, rax
jne 0x140169979
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, r12
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x14016997d
jmp 0x1401699a7
mov rcx, r8
call sub.msvcrt.dll_getenv
jmp 0x14016997d
Function at 0x140194f80
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1401a17f0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1401a17f0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x140194ff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x1405a72d4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140195198
mov rax, qword [0x1405a72d8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14019503c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1401950c7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x140195020
mov rcx, r12
call fcn.140195d50
mov rbp, rax
test rax, rax
je 0x1401951d2
mov rax, qword [0x1405a72d8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140195e80
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1405a72d8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1401951e1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1401950c0
sub eax, 4
and eax, 0xfffffffb
jne 0x140195150
add dword [0x1405a72d4], 1
cmp ebx, 8
jae 0x1401950f8
test bl, 4
jne 0x1401951a0
test ebx, ebx
je 0x1401950e9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x1401951c0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x1401950e9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x14019512a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x1405a72d8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1401950c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140194f80
nop dword [rax]
xor edi, edi
jmp 0x140195047
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x1401950e9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x1401950e9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140194f80
mov rax, qword [0x1405a72d8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140194f80
nop
nop dword [rax]
Function at 0x1401959c0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1405a75c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1405a75a0]
test rbx, rbx
je 0x140195a14
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140195a0b
test r12, r12
je 0x140195a0b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1401959f0
lea rcx, [0x1405a75c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140195d50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1404d9ff0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140195dc9
mov rcx, r10
call fcn.140195c20
test eax, eax
je 0x140195dc9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140195dc6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x140195dbd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140195dc9
add r8, 0x28
cmp r8, r9
jne 0x140195da8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x1401a3a30
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x1401a3b42
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x1401a3b1a
add rax, 1
cmp rax, 0x6b
je 0x1401a3b37
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x1401a3b10
cmp edx, 0x6a
je 0x1401a3b37
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x1401a3b2b