joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400796d0
Capabilities:
Enumerate processes

Disassembly:
push rdi
push r12
push r13
sub rsp, 0xab0
xor edx, edx
mov r13, rcx
mov dword [rsp + 0x30], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdi, r13
movzx edx, word [rdi]
cmp dx, 0x20
je 0x140079716
cmp dx, 9
jne 0x14007971c
add rdi, 2
jmp 0x140079707
movzx eax, word [rdi]
mov qword [rsp + 0xad0], rbx
mov qword [rsp + 0xad8], rbp
mov qword [rsp + 0xae0], rsi
test ax, ax
je 0x1400797ff
xor esi, esi
cmp ax, 0x2d
je 0x140079825
cmp ax, 0x2b
jne 0x140079756
add rdi, 2
cmp word [rdi], 0x30
jne 0x140079784
movzx eax, word [rdi + 2]
cmp ax, 0x78
je 0x14007976c
cmp ax, 0x58
jne 0x140079784
movzx ecx, word [rdi + 4]
call fcn.140109c84
test eax, eax
je 0x140079784
mov eax, 1
add rdi, 4
jmp 0x140079786
mov eax, esi
movzx ebx, word [rdi]
mov ecx, esi
movsxd rbp, eax
cmp ebx, 0x20
je 0x1400797e1
cmp ebx, 9
je 0x1400797e1
test ebx, ebx
je 0x1400797fb
cmp ebx, 0x2e
je 0x140079825
test rbp, rbp
je 0x1400797c7
movzx ecx, bx
call fcn.14010a23c
mov ecx, esi
test eax, eax
sete cl
test ecx, ecx
je 0x1400797cf
movzx ecx, bx
call fcn.14000b9a0
jmp 0x140079825
lea eax, [rbx - 0x30]
cmp eax, 9
ja 0x1400797bd
movzx ebx, word [rdi + 2]
add rdi, 2
mov ecx, 1
cmp ebx, 0x20
jne 0x140079793
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400797f0
cmp ax, 9
jne 0x1400797f6
add rdi, 2
jmp 0x1400797e1
cmp word [rdi], si
jne 0x140079825
test ecx, ecx
je 0x140079825
mov rcx, r13
call fcn.140013c70
mov rcx, r13
test al, al
je 0x14007981e
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.14010a4d8
mov rsi, rax
jmp 0x140079825
call fcn.140109998
mov esi, eax
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov rbp, qword [rsp + 0xad8]
mov rbx, qword [rsp + 0xad0]
test eax, eax
je 0x1400798ec
nop dword [rax + rax]
test esi, esi
je 0x14007985e
cmp esi, dword [rsp + 0x38]
je 0x14007990c
lea rax, [rsp + 0x480]
lea r9, [rsp + 0x270]
lea r8, [rsp + 0x690]
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x5c]
mov qword [rsp + 0x20], rax
call fcn.14010b340
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x270]
lea rdx, [rsp + 0x480]
repne scasw ax, word [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x1400798b0
lea rcx, [rsp + 0x270]
mov rdx, r13
call fcn.140108424
mov rcx, r12
test eax, eax
je 0x140079919
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140079850
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0xae0]
add rsp, 0xab0
pop r13
pop r12
pop rdi
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x1400798f7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x1400798f7
Function at 0x14008f3d0
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, r8
cmp edx, 0x2af8
jae 0x14008f4b7
test rcx, rcx
je 0x14008f4b7
cmp qword [rcx + 8], 0
je 0x14008f4b7
cmp edx, dword [rcx + 0x20]
jae 0x14008f4b7
mov rcx, qword [rcx + 0x28]
mov eax, edx
lea r9, [rax + rax*4]
test r8, r8
je 0x14008f475
mov rax, qword [rcx + r9*8 + 0x10]
test rax, rax
je 0x14008f45a
mov rcx, qword [rax + 0x28]
mov rdx, r8
nop word [rax + rax]
movzx eax, word [rcx]
add rdx, 2
add rcx, 2
mov word [rdx - 2], ax
test ax, ax
jne 0x14008f430
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rax, [rcx - 1]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + r9*8]
mov r8d, 0x40
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cdqe
add rsp, 0x20
pop rdi
ret
mov rdi, qword [rcx + r9*8 + 0x10]
test rdi, rdi
je 0x14008f499
mov rdi, qword [rdi + 0x28]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rax, [rcx - 1]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + r9*8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, 0x3f
cdqe
cmp rax, rcx
cmova rax, rcx
add rsp, 0x20
pop rdi
ret
test r8, r8
je 0x14008f4c2
xor eax, eax
mov word [r8], ax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400935c0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, word [rcx]
xor bl, bl
mov rdi, rcx
test ax, ax
je 0x14009360c
nop dword [rax]
movzx eax, ax
cmp eax, 0x21
je 0x1400935fc
cmp eax, 0x2b
je 0x1400935f7
cmp eax, 0x5e
jne 0x14009360c
or bl, 2
jmp 0x1400935ff
or bl, 1
jmp 0x1400935ff
or bl, 4
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x1400935e0
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov r9, rax
mov rcx, rdi
call fcn.140019df0
movzx esi, al
test al, al
jne 0x14009363d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.140019cf0
test ax, ax
jne 0x140093655
xor edx, edx
movzx ecx, sil
call fcn.14001a4d0
mov ecx, pe_nt_image_headers64
test cx, ax
je 0x140093662
or bl, 8
movzx eax, bl
mov rbx, qword [rsp + 0x30]
movzx ecx, sil
mov rsi, qword [rsp + 0x38]
shl eax, 8
or eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140095740
Capabilities:
Get keyboard layout

Disassembly:
push rbx
push r12
sub rsp, 0x28
mov r12, rdx
mov rbx, rcx
nop
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14009575f
cmp ax, 9
jne 0x140095765
add rbx, 2
jmp 0x140095750
movzx eax, word [rbx]
test ax, ax
jne 0x140095775
add rsp, 0x28
pop r12
pop rbx
ret
cmp word [rbx + 2], 0
lea rcx, [rbx + 2]
jne 0x140095791
mov word [rdx + 2], ax
mov byte [rdx], 0
mov al, 1
add rsp, 0x28
pop r12
pop rbx
ret
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov byte [rdx], 1
xor sil, sil
mov edx, 0x2b
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x40], sil
call fcn.140109434
mov rbp, rax
test rax, rax
je 0x140095885
lea rdi, [rbp - 2]
cmp rdi, rbx
jbe 0x1400957e8
nop word [rax + rax]
movzx eax, word [rdi]
cmp ax, 0x20
je 0x1400957df
cmp ax, 9
jne 0x1400957e8
sub rdi, 2
cmp rdi, rbx
ja 0x1400957d0
sub rdi, rbx
lea rdx, str.Ctrl
mov rcx, rbx
sar rdi, 1
inc rdi
mov r8, rdi
call fcn.140108e4c
test eax, eax
jne 0x14009580d
or sil, 1
jmp 0x140095843
lea rdx, [0x14014d048]
mov r8, rdi
mov rcx, rbx
call fcn.140108e4c
test eax, eax
jne 0x140095829
or sil, 4
jmp 0x140095843
lea rdx, str.Shift
mov r8, rdi
mov rcx, rbx
call fcn.140108e4c
test eax, eax
jne 0x1400958b2
or sil, 0x10
mov byte [rsp + 0x40], sil
lea rbx, [rbp + 2]
nop dword [rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14009585f
cmp ax, 9
jne 0x140095865
add rbx, 2
jmp 0x140095850
cmp word [rbx], 0
je 0x1400958b2
lea rcx, [rbx + 2]
mov edx, 0x2b
call fcn.140109434
mov rbp, rax
test rax, rax
jne 0x1400957c1
xor ecx, ecx
cmp word [rbx + 2], cx
jne 0x1400958d9
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [rbx]
mov rdi, rax
call qword [sym.imp.USER32.dll_CharLowerW]
cmp ax, 0xa
jne 0x1400958b6
mov al, 0xd
movzx eax, al
mov word [r12 + 2], ax
jmp 0x1400958f9
xor al, al
jmp 0x140095924
lea rdx, [rsp + 0x40]
mov r9b, 1
mov r8, rdi
movzx ecx, ax
call fcn.140019f60
movzx esi, byte [rsp + 0x40]
movzx eax, al
mov word [r12 + 2], ax
jmp 0x1400958f9
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov r9, rax
mov rcx, rbx
call fcn.140019df0
movzx r11d, al
mov word [r12 + 2], r11w
test sil, 1
je 0x140095904
or byte [r12], 8
test sil, 4
je 0x14009590f
or byte [r12], 0x10
test sil, 0x10
je 0x14009591a
or byte [r12], 4
cmp word [r12 + 2], 0
setne al
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop r12
pop rbx
ret
Function at 0x14009ff50
Capabilities:
Parse credit card information

Disassembly:
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x10d40]
mov eax, 0x10e40
call fcn.1401110b0
sub rsp, rax
mov qword [rbp + 0x110], 0xfffffffffffffffe
mov qword [rsp + 0x10e78], rbx
movzx ebx, r9w
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], r8d
mov rsi, rdx
mov eax, 6
xor edi, edi
mov rcx, qword [rbp + 0x10d80]
test rcx, rcx
je 0x14009ffe2
lea rdx, [rbp + 0x120]
sub rdx, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x14009ffc0
mov rax, qword [rbp + 0x10d88]
test rax, rax
jne 0x1400a0a28
jmp 0x14009fff7
cmp r8w, 3
jne 0x1400a0003
mov word [rbp + 0x120], di
mov qword [rbp + 0x10d88], rdi
mov qword [rsp + 0x50], rsi
xor cl, cl
jmp 0x1400a0aa6
or al, byte [rax]
invalid
mov r8, rax
Function at 0x1400a7ee0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov rbp, r8
mov r15, rdx
mov r14, rcx
test r8, r8
je 0x1400a8165
cmp word [r8], 0
je 0x1400a8165
lea rax, vtable.CKuStringT_wchar_t__class_CKuStringUtilW_.0
mov qword [r11 - 0x40], rax
xor eax, eax
mov qword [r11 - 0x38], rax
mov byte [rsp + 0x38], al
mov rdx, r9
lea rcx, [r11 - 0x40]
call fcn.1400a6d30
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x80], rbx
lea rsi, [0x1401295d4]
test rbx, rbx
je 0x1400a7f66
mov rax, qword [rbx]
test rax, rax
cmovne rsi, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r12, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r13, rcx
test r12, r12
je 0x1400a812f
test rcx, rcx
je 0x1400a812f
lea rdx, [r12 + r12]
mov qword [r15], rdx
mov rcx, r14
call fcn.14001ad10
mov r11, qword [r14 + 8]
movzx edx, word [rbp]
movzx edi, dx
shr di, 3
and di, 0xf
movzx eax, dx
and ax, 7
shl ax, 4
or di, ax
mov eax, 0xff80
and dx, ax
or di, dx
mov rcx, rsi
call fcn.1400a6cb0
lea rdx, [r13 + rax]
add rdx, r12
movzx eax, dl
xor ax, di
mov word [r11], ax
lea r15, [rbp + 2]
add r11, 2
xor eax, eax
mov r10d, eax
mov r14d, eax
lea rbp, [r12 - 1]
test rbp, rbp
je 0x1400a80f5
movabs rdx, 0xa41a41a41a41a41b
xor ebx, ebx
nop dword [rax]
movzx eax, word [r11 - 2]
xor ax, word [r15 - 2]
movzx r9d, ax
shr r9w, 4
and r9w, 0xf
and ax, 0xf
shl ax, 4
or r9w, ax
movzx ecx, word [r15]
movzx r8d, cx
shr r8w, 3
and r8w, 0xf
movzx eax, cx
and ax, 7
shl ax, 4
or r8w, ax
mov eax, 0xff80
and cx, ax
or r8w, cx
movzx edi, r14b
movzx eax, r9w
xor rdi, rax
mov rax, rdx
mul rdi
mov rcx, rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 7
imul rcx, rcx, 0x9c
mov eax, 0x64
sub rax, rcx
add rdi, rax
movzx eax, word [rsi + r10*2]
sub eax, r14d
movzx ecx, r9w
add eax, r12d
add eax, ecx
xor edx, edx
div rdi
movzx eax, dl
xor ax, r8w
mov word [r11], ax
inc r10
cmp r10, r13
cmovae r10, rbx
add r15, 2
add r11, 2
inc r14
cmp r14, rbp
movabs rdx, 0xa41a41a41a41a41b
jb 0x1400a8020
mov rbx, qword [rsp + 0x80]
lea rax, vtable.CKuStringT_wchar_t__class_CKuStringUtilW_.0
mov qword [rsp + 0x28], rax
test rbx, rbx
je 0x1400a812b
mov eax, dword [rbx + 0x20]
dec eax
mov dword [rbx + 0x20], eax
jne 0x1400a812b
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400a8123
call fcn.140108f48
mov rcx, rdi
call fcn.140108f40
mov al, 1
jmp 0x1400a8167
lea rax, vtable.CKuStringT_wchar_t__class_CKuStringUtilW_.0
mov qword [rsp + 0x28], rax
test rbx, rbx
je 0x1400a8165
mov eax, dword [rbx + 0x20]
dec eax
mov dword [rbx + 0x20], eax
jne 0x1400a8165
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400a815d
call fcn.140108f48
mov rcx, rdi
call fcn.140108f40
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400a8190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r8
mov r12, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400a8410
test r8, r8
je 0x1400a8410
cmp dword [0x14016f83c], 0
je 0x1400a81e8
mov ecx, 0x76
mov rax, qword [0x140173258]
mov word [rax], cx
lea r14, vtable.CKuStringT_wchar_t__class_CKuStringUtilW_.0
mov qword [rsp + 0x28], r14
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov byte [rsp + 0x38], r15b
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1400a6d30
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x78], rbx
lea rsi, [0x1401295d4]
test rbx, rbx
je 0x1400a822e
mov rax, qword [rbx]
test rax, rax
cmovne rsi, rax
lea rdx, [rbp + 2]
mov rcx, rdi
call fcn.14001ad10
mov r11, qword [rdi + 8]
mov r10, rbp
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r13, rcx
shr r10, 1
je 0x1400a83e1
test rcx, rcx
je 0x1400a83e1
lea rax, [r10 + r10]
cmp rax, rbp
jne 0x1400a83e1
mov rcx, rsi
call fcn.1400a6cb0
lea rdx, [r13 + rax]
add rdx, r10
movzx edx, dl
xor dx, word [r12]
movzx ecx, dx
and cx, 0xf
shl cx, 3
movzx eax, dx
shr ax, 4
and ax, 7
or cx, ax
mov eax, 0xff80
and dx, ax
or cx, dx
mov word [r11], cx
lea r14, [r12 + 2]
add r11, 2
mov rbp, r15
mov r12, r15
lea r9, [r10 - 1]
test r9, r9
je 0x1400a83a3
movabs rcx, 0xa41a41a41a41a41b
mov ebx, eax
nop dword [rax]
movzx eax, word [r11 - 2]
xor ax, word [r14 - 2]
movzx r8d, ax
shr r8w, 4
and r8w, 0xf
and ax, 0xf
shl ax, 4
or r8w, ax
movzx edi, r12b
movzx eax, r8w
xor rdi, rax
mov rax, rcx
mul rdi
mov rcx, rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 7
imul rcx, rcx, 0x9c
mov eax, 0x64
sub rax, rcx
add rdi, rax
movzx eax, word [rsi + rbp*2]
sub eax, r12d
movzx ecx, r8w
add eax, r10d
add eax, ecx
xor edx, edx
div rdi
movzx edx, dl
xor dx, word [r14]
movzx ecx, dx
and cx, 0xf
shl cx, 3
movzx eax, dx
shr ax, 4
and ax, 7
or cx, ax
and dx, bx
or cx, dx
mov word [r11], cx
inc rbp
cmp rbp, r13
cmovae rbp, r15
add r14, 2
add r11, 2
inc r12
cmp r12, r9
movabs rcx, 0xa41a41a41a41a41b
jb 0x1400a82e0
mov rbx, qword [rsp + 0x78]
mov word [r11], r15w
lea rax, vtable.CKuStringT_wchar_t__class_CKuStringUtilW_.0
mov qword [rsp + 0x28], rax
test rbx, rbx
je 0x1400a83dd
mov eax, dword [rbx + 0x20]
dec eax
mov dword [rbx + 0x20], eax
jne 0x1400a83dd
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400a83d5
call fcn.140108f48
mov rcx, rdi
call fcn.140108f40
mov al, 1
jmp 0x1400a8412
mov qword [rsp + 0x28], r14
test rbx, rbx
je 0x1400a8410
mov eax, dword [rbx + 0x20]
dec eax
mov dword [rbx + 0x20], eax
jne 0x1400a8410
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400a8408
call fcn.140108f48
mov rcx, rdi
call fcn.140108f40
xor al, al
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400ab560
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rdi, r8
mov rsi, rdx
cmp rdx, 1
jae 0x1400ab591
xor al, al
jmp 0x1400ab73c
mov rbx, qword [rcx + 8]
mov eax, dword [rbx]
cmp eax, 0x4034b50
je 0x1400ab5a5
cmp eax, 0xfbfcb4af
jne 0x1400ab58a
lea rcx, [0x14014fb00]
call fcn.1400dd2e0
lea r12, vtable.CKuStringT_wchar_t__class_CKuStringUtilW_.0
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x38], 0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140071dd0
nop
lea r8, [0x1401295d4]
test rdi, rdi
cmovne r8, rdi
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x58]
call fcn.1400b6ed0
nop
mov qword [rsp + 0x28], r12
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ab62b
mov eax, dword [rcx + 0x20]
dec eax
mov dword [rcx + 0x20], eax
jne 0x1400ab62b
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400ab623
call fcn.140108f48
mov rcx, rdi
call fcn.140108f40
mov rax, qword [rsp + 0x60]
lea rcx, [0x1401295d4]
test rax, rax
je 0x1400ab646
mov rax, qword [rax]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x50], 0
lea rax, vtable.CStringCharFromWChar.0
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
call fcn.1400dd0f0
nop
mov r9, qword [rsp + 0x48]
lea r8, [0x1401389a0]
test r9, r9
je 0x1400ab686
mov rax, qword [r9]
test rax, rax
cmovne r8, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea r10, [rcx - 1]
mov eax, dword [rbx]
not eax
mov dword [rbx], eax
mov edi, 4
cmp rdi, rsi
jae 0x1400ab6d2
nop dword [rax + rax]
xor edx, edx
mov rax, rdi
div r10
movzx ecx, byte [rdx + r8]
xor cl, byte [rdi + rbx]
mov eax, 0xff
sub al, cl
mov byte [rdi + rbx], al
inc rdi
cmp rdi, rsi
jb 0x1400ab6b0
lea rax, vtable.CKuStringT_char__class_CKuStringUtilA_.0
mov qword [rsp + 0x40], rax
test r9, r9
je 0x1400ab70b
mov eax, dword [r9 + 0x20]
dec eax
mov dword [r9 + 0x20], eax
jne 0x1400ab70b
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400ab702
call fcn.140108f48
mov rcx, rdi
call fcn.140108f40
nop
mov qword [rsp + 0x58], r12
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x1400ab73a
mov eax, dword [rdi + 0x20]
dec eax
mov dword [rdi + 0x20], eax
jne 0x1400ab73a
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1400ab732
call fcn.140108f48
mov rcx, rdi
call fcn.140108f40
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x1400ac420
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x30
mov rsi, rdx
mov rdi, r8
movabs r12, 0xaaaaaaaaaaaaaaab
mov rax, r12
xor ebp, ebp
mov ebx, ebp
mul r8
mov rax, r12
shr rdx, 1
lea r8, [rdx + rdx*2 + 3]
shl r8, 2
mul r8
shr rdx, 1
lea rdx, [rdx + rdx + 2]
call fcn.14001ad10
mov r11, rax
test rax, rax
jne 0x1400ac4a8
lea rcx, [0x14014fa80]
call fcn.1400dd2e0
xor r8d, r8d
mov edx, 0x10000
xorpd xmm3, xmm3
mov rcx, rax
mov qword [rsp + 0x20], rbp
call fcn.1400ec710
lea eax, [rbp + 0x64]
jmp 0x1400ac5ed
lea r9, [0x1401699a0]
cmp rdi, 2
jbe 0x1400ac54c
mov r8, rax
lea rcx, [rdi - 3]
mov rax, r12
mul rcx
shr rdx, 1
inc rdx
mov rax, rdx
lea ebx, [rdx*4]
imul rax, rax, 0xfffffffffffffffd
add rdi, rax
nop dword [rax]
movzx eax, byte [rsi]
add r8, 8
add rsi, 3
shr rax, 2
movzx eax, word [r9 + rax*2]
mov word [r8 - 8], ax
movzx ecx, byte [rsi - 3]
movzx eax, byte [rsi - 2]
shr rax, 4
and ecx, 3
shl rcx, 4
add rcx, rax
movzx eax, word [r9 + rcx*2]
mov word [r8 - 6], ax
movzx ecx, byte [rsi - 2]
movzx eax, byte [rsi - 1]
shr rax, 6
and ecx, 0xf
lea rcx, [rax + rcx*4]
movzx eax, word [r9 + rcx*2]
mov word [r8 - 4], ax
movzx eax, byte [rsi - 1]
and eax, 0x3f
dec rdx
movzx eax, word [r9 + rax*2]
mov word [r8 - 2], ax
jne 0x1400ac4e0
test rdi, rdi
je 0x1400ac5e3
movzx eax, byte [rsi]
movsxd rcx, ebx
inc ebx
shr rax, 2
movzx eax, word [r9 + rax*2]
mov word [r11 + rcx*2], ax
movsxd rcx, ebx
inc ebx
cmp rdi, 1
jbe 0x1400ac5b5
movzx edx, byte [rsi]
movzx eax, byte [rsi + 1]
shr rax, 4
and edx, 3
shl rdx, 4
add rdx, rax
movzx eax, word [r9 + rdx*2]
mov word [r11 + rcx*2], ax
movzx eax, byte [rsi + 1]
movsxd rcx, ebx
and eax, 0xf
shl eax, 2
cdqe
movzx eax, word [r9 + rax*2]
mov word [r11 + rcx*2], ax
mov ecx, 0x3d
jmp 0x1400ac5d7
movzx eax, byte [rsi]
and eax, 3
shl eax, 4
cdqe
movzx eax, word [r9 + rax*2]
mov word [r11 + rcx*2], ax
movsxd rax, ebx
mov ecx, 0x3d
mov word [r11 + rax*2], cx
inc ebx
movsxd rax, ebx
inc ebx
mov word [r11 + rax*2], cx
movsxd rax, ebx
mov word [r11 + rax*2], bp
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x1400b1710
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor r12d, r12d
mov dword [rax - 0x18], r12d
mov dword [rax - 0x30], r12d
mov ebx, r12d
mov qword [rax - 0x38], rbx
mov qword [rax - 0x40], r12
mov ebp, 0x52
mov qword [rax - 0x28], rbp
lea edx, [rbp + 0x52]
xor ecx, ecx
call fcn.1401099a4
mov rsi, rax
test rax, rax
jne 0x1400b1775
xor ecx, ecx
call fcn.140108f48
mov esi, r12d
mov ebp, r12d
jmp 0x1400b18a2
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], r12d
mov word [rax], r12w
dec dword [0x140169a24]
jne 0x1400b1790
call fcn.14001ab20
mov rax, qword [0x14016e6d8]
mov edi, dword [rax]
add rax, 4
mov qword [0x14016e6d8], rax
mov eax, edi
shr eax, 0xb
xor edi, eax
mov eax, edi
and eax, 0xff3a58ad
shl eax, 7
xor edi, eax
mov eax, edi
and eax, 0xffffdf8c
shl eax, 0xf
xor edi, eax
mov eax, edi
shr eax, 0x12
xor edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rdi + rax]
mov rdx, rsi
call fcn.14000ba50
test rax, rax
je 0x1400b18a2
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx - 2]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400ac420
mov rbx, qword [rsp + 0x40]
test eax, eax
jne 0x1400b18a2
test rbx, rbx
je 0x1400b1834
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0xa
jbe 0x1400b1834
mov word [rbx + 0x14], r12w
lea rcx, [0x1401325c0]
call fcn.1400dd2e0
mov r8, rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov rdx, rbx
lea rcx, [0x140174d78]
call fcn.1400ac610
test eax, eax
jne 0x1400b18a2
mov rdi, qword [0x140174d80]
lea rcx, str.e4z__9_.354z___z.2_5_4t
call fcn.1400dd2e0
mov r8, rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov rdx, rdi
lea rcx, [0x140174d90]
call fcn.1400ac610
movzx ecx, byte [0x140174d70]
mov edx, 1
test eax, eax
cmove ecx, edx
mov byte [0x140174d70], cl
test rbx, rbx
je 0x1400b18bf
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rbx
call fcn.14010ec60
mov rcx, rbx
call fcn.140108f48
nop
test rsi, rsi
je 0x1400b18d9
mov r8, rbp
xor edx, edx
mov rcx, rsi
call fcn.14010ec60
mov rcx, rsi
call fcn.140108f48
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x1400b61f0
Capabilities:
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
sub rsp, 0x70
cmp word [rcx], 0
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov r12, rcx
je 0x1400b632e
test r9, r9
je 0x1400b632e
test r8, r8
je 0x1400b632e
cmp dword [r8], 0
je 0x1400b632e
mov qword [rsp + 0x98], rdi
xor edi, edi
test rdx, rdx
je 0x1400b6245
cmp word [rdx], di
cmove rbx, rdi
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
mov r9d, 0xa00000
mov dword [rsp + 0x58], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x68], 1
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1400b6297
xor eax, eax
mov rdi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r12
pop rsi
pop rbp
ret
or dword [rsi + 0x3c], 0x100
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsi + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rbx
mov qword [rsi + 0x58], rax
mov qword [rsi + 0x60], rax
xor eax, eax
mov qword [rbp], rax
mov qword [rsp + 0x30], rdi
mov qword [rbp + 8], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rbp + 0x10], rax
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400b6321
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x1400b627e
mov rdi, qword [rsp + 0x50]
mov rax, rdi
jmp 0x1400b627e
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r12
pop rsi
pop rbp
ret