joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55e6e0
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x1f8]
cmp r12, qword [r14 + 0x10]
jbe 0x55e96e
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x288], rbx
nop
nop
call fcn.004fb8c0
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x280]
mov rcx, qword [rax]
mov rax, rcx
call fcn.0053e5e0
test rbx, rbx
jne 0x55e8e2
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x130]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046cd94
mov rbp, qword [rbp]
mov qword [rsp + 0x258], 0
movups xmmword [rsp + 0x260], xmm15
mov qword [rsp + 0x260], 0
mov qword [rsp + 0x268], 0x20
lea rdx, [rsp + 0x130]
mov qword [rsp + 0x258], rdx
mov rbx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x298]
mov rsi, rax
lea rax, [rsp + 0x258]
call fcn.0053ddc0
nop dword [rax + rax]
test rbx, rbx
jne 0x55e8cc
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rdx + 8]
lea rdi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046cd94
mov rbp, qword [rbp]
mov qword [rsp + 0x240], 0
movups xmmword [rsp + 0x248], xmm15
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], 0x20
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x240], rdx
mov rbx, rax
mov rdi, qword [rsp + 0x238]
lea rax, [rsp + 0x240]
call fcn.00540880
mov qword [rsp + 0x230], rax
mov rdx, qword [rsp + 0x238]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 8]
shl rsi, 6
sub rsi, qword [rdx + 8]
lea rdx, [rsi + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rcx, [rdx + rsi]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x28], rcx
nop
mov rbx, rcx
lea rax, [0x006844a0]
call fcn.0044f620
mov rdx, qword [rsp + 0x230]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
mov r8, qword [rsp + 0x28]
mov rcx, r8
xor ebx, ebx
jmp 0x55e900
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
inc rbx
mov r8, r10
nop
cmp rbx, rdx
jge 0x55e919
mov r9, qword [rsi + rbx*8]
xor edi, edi
jmp 0x55e938
test r9, r9
je 0x55e8f8
jmp 0x55e94e
mov r10, r8
jmp 0x55e8f8
mov rbx, rcx
xor edi, edi
xor esi, esi
add rsp, 0x270
pop rbp
ret
mov byte [r8 + rax - 1], r9b
inc rdi
shr r9, 8
mov r8, r10
cmp rdi, 8
jge 0x55e914
lea r10, [r8 - 1]
test r10, r10
jl 0x55e90d
cmp rcx, r10
ja 0x55e929
jmp 0x55e965
lea rax, [0x00684420]
lea rbx, [0x0075db90]
nop dword [rax]
call fcn.00438940
mov rax, r10
call fcn.0046cae0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.0055e6e0
Function at 0x6019c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x601a95
movdqa xmm0, xmmword [0x0075cca0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x601a01
movdqa xmm0, xmmword [0x0075ccb0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x601b17
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x601aeb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0075c8f0]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0075ccc0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x60e900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60ea9b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x60e921
inc rcx
cmp rbx, rcx
jle 0x60ea91
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x60e91e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.005800e0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x009039e0]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.0060acc0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x60ea85
test rdx, rdx
je 0x60ea7a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x60ea49
xor eax, eax
lea rbx, [0x0075c8d4]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006dc90a]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.004535e0
jmp 0x60ea70
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0075b100]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.00453520
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0060e900
Function at 0x64fd80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x64fe82
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.00594580
test rdi, rdi
jne 0x64fdd3
mov rbx, qword [0x009189b8]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x006935e0]
call fcn.00413760
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call fcn.0064fd20
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403ae0
xorps xmm15, xmm15
mov r14, qword [0x0099fb20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x64fe55
xor eax, eax
lea rbx, [0x0075c8d4]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006dc90a]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.004535e0
jmp 0x64fe7c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0075b100]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.00453520
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0046a800
mov rax, qword [rsp + 8]
jmp fcn.0064fd80
Function at 0x666f60
Capabilities:
Persist via run registry key

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x66707b
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rcx
nop dword [rax]
cmp rdi, 1
jne 0x66703f
movzx edx, byte [rcx]
cmp dl, 0x32
jg 0x667001
cmp byte [rcx], 0x31
je 0x666fd3
cmp dl, 0x32
je 0x666fa5
cmp rdi, 1
jmp 0x66703f
mov ecx, 0x24
lea rdi, [0x006dd18b]
mov esi, 7
mov r8, rax
mov r9, rbx
mov eax, 0x80000001
lea rbx, [0x006eb229]
call fcn.00666000
add rsp, 0x38
pop rbp
ret
mov ecx, 0x2d
lea rdi, [0x006deec3]
mov esi, 0xd
mov r8, rax
mov r9, rbx
mov eax, 0x80000001
lea rbx, [0x006eebc7]
call fcn.00666000
add rsp, 0x38
pop rbp
ret
cmp byte [rcx], 0x33
je 0x66701c
cmp byte [rcx], 0x34
je 0x667011
cmp rdi, 1
jmp 0x66703f
call fcn.00666620
add rsp, 0x38
pop rbp
ret
mov rsi, rcx
mov r8, rdi
mov rcx, rax
mov rdi, rbx
lea rax, [0x006e093f]
mov ebx, 0x11
call fcn.006663c0
add rsp, 0x38
pop rbp
ret
nop
jne 0x66704d
cmp byte [rcx], 0x30
jne 0x66704d
xor eax, eax
xor ebx, ebx
jmp 0x667075
mov ecx, 0x2d
lea rdi, [0x006deec3]
mov esi, 0xd
mov r8, rax
mov r9, rbx
mov eax, 0x80000001
lea rbx, [0x006eebc7]
call fcn.00666000
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a800
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00666f60
Function at 0x14009e5f4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14009e66c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14009e66c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14009e66c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x14009e660
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14009e67e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14009e64e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14009e66e

Function at 0x14009eecc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009ef16
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009ef16
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009ef16
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009ef16
cmp dword [rcx + 0x84], 0xe
jbe 0x14009ef16
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009ef18
xor al, al
add rsp, 0x28
ret

Function at 0x1400aea48
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400aea7f
call fcn.14009d2b0
mov dword [rax], 0x16
call fcn.1400c0714
xor eax, eax
jmp 0x1400aeb0d
mov rdx, r9
mov rcx, r8
call fcn.1400aeb30
mov rbx, rax
test rax, rax
je 0x1400aeb0a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400aeba0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400aeaf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400b1878
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400aeade
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400aeaed
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.14009c600
jmp 0x1400aeb0a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400aeb07
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400aec74
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400aedbc
Function at 0x1400aedbc
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400aedbc
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400aee2b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400aee2b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400aee2b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400aee2b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400aee2b
cmp dword [rcx + 0x84], 0xe
jbe 0x1400aee2b
cmp dword [rcx + 0xf8], 0
je 0x1400aee2b
mov ecx, ebx
call fcn.1400aecf4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400aef50
nop
cmp dword [rbp + 0x20], 0
je 0x1400aee79
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400aed88
int3
Function at 0x1400d14d0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x14013b040]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x14014cac0], 0
jne 0x1400d1590
mov rdi, qword [0x14014cac8]
test rdi, rdi
je 0x1400d15ad
cmp byte [rdi + 0x17], 0
jns 0x1400d1516
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14014cac0], rax
inc rax
cmp rax, 1
ja 0x1400d1590
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400d0e60
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1400d1671
xor esi, esi
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14009f1f0
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov ecx, 0x18
call fcn.14009d274
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400d0e60
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x14011c0c0]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1400e8ed0
movsx rax, byte [rdi + 0x17]
mov rcx, rdi
test rax, rax
jns 0x1400d1617
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
jne 0x1400d163d
lea rdx, str.debug.log
mov r8d, 9
mov rcx, rdi
call fcn.140093610
mov qword [0x14014cac8], rdi
jmp 0x1400d150d
add rax, rax
test rax, rax
je 0x1400d161c
lea rdx, [rax - 2]
cmp word [rcx + rax - 2], 0x5c
mov rax, rdx
jne 0x1400d1640
cmp rdx, 0xfffffffffffffffe
je 0x1400d161c
sar rdx, 1
inc rdx
mov rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.140097250
jmp 0x1400d161c
mov rcx, qword [0x14014cac8]
lea rdx, [rsp + 0x40]
call fcn.140018a70
mov rcx, qword [0x14014cac8]
call fcn.1400eaec0
cmp word [rax], 0x5c
je 0x1400d16ad
mov rcx, qword [0x14014cac8]
lea rdx, [0x14011e67a]
mov r8d, 1
call fcn.140093610
mov rcx, qword [0x14014cac8]
lea rdx, str.debug.log
mov r8d, 9
call fcn.140093610
mov rcx, qword [0x14014cac8]
cmp byte [rcx + 0x17], 0
jns 0x1400d16d6
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14014cac0], rax
inc rax
cmp rax, 1
ja 0x1400d1590
mov qword [0x14014cac0], 0
jmp 0x1400d158e

Function at 0x1400d69a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400d69d7
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x1400d69b1
ret

Function at 0x1400d6a50
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400d6a88
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x1400d6a61
ret
Function at 0x1400dce00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x1400dce6d
movzx edx, word [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov word [rsp + 0x20], dx
mov rdx, rsi
mov r8, rdi
call qword [0x14012fc00]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov qword [rsi], rdi
test al, al
jns 0x1400dce4f
call fcn.14009d26c
jmp 0x1400dce4f
mov rax, qword [r9 + 0x30]
mov qword [rbp - 0x20], rax
lea rcx, [0x14014bb50]
mov qword [rbp - 8], rax
cmp rax, rcx
jne 0x1400dcf97
lea rdx, [0x14014bd28]
lea rcx, [rbp - 0x20]
call fcn.14008d240
mov r14, rax
mov rcx, qword [rbp - 8]
lea rax, [0x14014bb50]
cmp rcx, rax
je 0x1400dcec7
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x1400dcec7
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x14012fc00]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rbp - 0x20]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x14011c0c0]
movaps xmmword [rbx], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x14012fc00]
movsx rax, byte [rbx + 0x17]
test rax, rax
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
mov r8, rax
cmovs r8, rdx
test r8, r8
je 0x1400dce5f
test al, al
mov r14, rbx
cmovs r14, rcx
jmp 0x1400dcf6d
xor edi, edi
jmp 0x1400dcf4b
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1400dcf40
xor edi, edi
mov al, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add r14, 2
test al, al
mov r8, rbx
cmovs r8, rcx
movzx r9d, al
cmovs r9, rdx
lea r8, [r8 + r9*2]
cmp r14, r8
je 0x1400dce5f
test rdi, rdi
je 0x1400dcf29
movzx eax, word [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
jne 0x1400dcf2d
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x14012fc00]
jmp 0x1400dcf38
mov rax, qword [rbp - 8]
lock inc dword [rax + 8]
jmp 0x1400dce89
Function at 0x1400f5470
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rdx, qword [rcx]
mov r8, qword [rcx + 8]
mov rax, r8
sub rax, rdx
je 0x1400f54ad
js 0x1400f54b1
shr rax, 2
lea r9, [0x14012a148]
movzx r10d, al
movzx r11d, byte [rdx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
inc rdx
cmp rdx, r8
jne 0x1400f548c
cmp eax, dword [rcx + 0x18]
sete al
ret
xor eax, eax
jmp 0x1400f54a6
int3
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005480]
mov dword [rax], 1
mov rax, qword [0x140005490]
mov dword [rax], 1
mov rax, qword [0x1400054a0]
mov dword [rax], 1
mov rax, qword [0x140005400]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001a50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002722
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x1400027ba
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x14000279e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002792
cmp qword [rbp - 0x10], 0
je 0x140002792
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002758
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400027bb
nop
add rsp, 0x30
pop rbp
ret