joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400010d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x70
mov qword [rsp + 0x50], rcx
mov rcx, rdx
mov qword [rsp + 0x48], rdx
call fcn.1400017e0
xor r8d, r8d
mov ecx, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx

Function at 0x14000256c
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x28]
mov dx, word [rsp + 0x3e]
mov cx, dx
xor ecx, 0x3b02
mov r8w, cx
mov word [rsp + 0xae], r8w
mov ecx, dword [rsp + 0x38]
xor ecx, 0x494e30e1
mov qword [r12 + 0xb0], rcx
mov qword [r12 + 0xb0], rcx
mov r9, qword [rsp + 0xa0]
mov r10b, byte [rsp + rax + 0x40]
movsx ecx, r10b
mov r8w, cx
xor r9, 0x7f92b364
mov word [rsp + rax*2 + 0x60], r8w
add rax, 1
mov dword [rsp + 0xb0], 0xd7f5e461
cmp rax, r9
mov qword [rsp + 0x28], rax
jne 0x140002544
lea rcx, [rsp + 0x60]
call fcn.140002710
mov edx, dword [rsp + 0x38]
add edx, edx
mov dword [rsp + 0xb0], edx
add rsp, 0xb8
ret
Function at 0x1400037bc
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x5c], 0
jmp 0x1400035f1
mov ax, word [rsp + 0x44]
xor ax, 0x68ed
mov word [rsp + 0x76], ax
mov rax, qword [rsp + 0xb8]
add rsp, 0xc8
pop rbx
pop rsi
ret
mov eax, dword [rsp + 0x2c]
imul ecx, eax, 0x632e97ab
mov rdx, qword [rsp + 0x50]
cmp rdx, 0
setne r8b
mov dword [rsp + 0x70], ecx
and r8b, 1
mov byte [rsp + 0x6f], r8b
mov r9w, word [rsp + 0x44]
mov word [rsp + 0x76], r9w
mov r10, qword [rsp + 0x60]
mov qword [rsp + 0xc0], r10
jmp 0x14000367f
mov al, byte [rsp + 0x47]
or al, al
mov byte [rsp + 0x9f], al
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff0
mov qword [rsp + 0xb8], rcx
jmp 0x14000356c
mov eax, dword [rsp + 0x5c]
mov ecx, eax
mov edx, ecx
mov r8, qword [rsp + 0x80]
mov r9w, word [r8 + rdx*2]
mov r10w, r9w
add r10w, 0xffbf
mov r11w, r9w
add r11w, 0x20
cmp r10w, 0x1a
cmovb r9w, r11w
mov r8, qword [rsp + 0x48]
cmp word [r8 + rdx*2], r9w
sete bl
and bl, 1
mov byte [rsp + 0x8f], bl
mov r10w, word [rsp + 0x44]
xor r10w, 0xffff
mov bl, byte [rsp + 0x8f]
add eax, 1
mov ecx, dword [rsp + 0x58]
cmp r9w, 0
setne sil
and bl, sil
mov word [rsp + 0x76], r10w
cmp eax, ecx
setb sil
and bl, sil
mov dword [rsp + 0x5c], eax
test bl, 1
jne 0x1400035f1
jmp 0x140003773
movabs rax, 0x1a1e114c715c1fa2
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x78], rcx
mov dx, word [rsp + 0x44]
add dx, 0x4aa2
mov word [rsp + 0x76], dx
mov rcx, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x2c]
xor r8d, 0x282cadb6
mov dword [rsp + 0x70], r8d
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x90], 0x4355b145
mov qword [rsp + 0x80], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x90], rax
mov rax, qword [rcx + 0x20]
mov byte [rsp + 0x9f], 0xe0
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x30]
xor rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x50]
cmp rcx, rax
sete r9b
mov r10b, byte [rsp + 0x6f]
mov byte [rsp + 0x9f], 0xea
mov r11b, byte [rsp + 0x47]
sub r11b, 0xaa
and r10b, r9b
mov byte [rsp + 0x9f], r11b
test r10b, 1
jne 0x1400035ce
mov qword [rsp + 0x90], 0x1975387b
mov rax, qword [rsp + 0x78]
mov cx, word [rax + 0x48]
shr cx, 1
movzx edx, cx
mov dword [rsp + 0x58], edx
cmp cx, 0
je 0x1400037f9
jmp 0x14000355f
mov rax, qword [rsp + 0xa0]
mov cl, byte [rsp + 0x8f]
mov qword [rsp + 0xb8], rax
test cl, 1
jne 0x14000356c
jmp 0x1400037f9
mov dl, byte [rsp + 0x47]
and dl, 0x20
mov rcx, qword [rcx]
mov byte [rsp + 0x9f], dl
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x60]
mov r8, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], 0
cmp rcx, r8
je 0x14000356c
jmp 0x14000358c
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xb8], 0
cmp rax, rcx
je 0x14000356c
jmp 0x14000367f
Function at 0x140009640
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x50
mov qword [r11 - 0x38], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, rcx
xor ebx, ebx
mov rdi, qword [0x140079ef0]
mov dword [rdi + 0x2a8c], ebx
test rcx, rcx
je 0x14000978a
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x28], rbx
mov dword [rdi + 0x2a8c], ebx
mov qword [r11 - 0x20], rbx
mov qword [r11 - 0x18], rbx
lea edx, [rbx + 8]
lea rcx, [r11 - 0x20]
call fcn.14001e710
movsxd rcx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov byte [rcx + rax], bl
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov ecx, dword [rdi + 0x2aa0]
test ecx, ecx
jle 0x140009716
mov esi, ebx
cmp ebx, ecx
jl 0x1400096e9
mov r8d, 0x492
lea rdx, [0x140046340]
lea rcx, [0x140048b38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov r9, qword [rdi + 0x2aa8]
add r9, rsi
lea r8, [rsp + 0x38]
mov rdx, r9
mov rcx, rdi
call qword [r9 + 0x20]
inc ebx
add rsi, 0x30
mov ecx, dword [rdi + 0x2aa0]
cmp ebx, ecx
jl 0x1400096e9
mov eax, dword [rsp + 0x38]
test eax, eax
jg 0x140009738
mov r8d, 0x4b1
lea rdx, [0x140046340]
lea rcx, [0x140048b20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rsp + 0x38]
lea esi, [rax - 1]
lea rdx, [0x1400473d4]
mov rcx, rbp
call fcn.140003810
mov rdi, rax
mov rbx, qword [rsp + 0x40]
test rax, rax
je 0x140009775
movsxd r8, esi
mov r9, rax
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
test rbx, rbx
je 0x14000978a
dec qword [0x140079fc8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003ff60
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14003bc80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14003bd2c
cmp byte [rcx + 0x71], 0
je 0x14003bd2c
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14003bced
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003bcf1
sub eax, 1
je 0x14003bcf5
sub eax, 2
je 0x14003bd2c
xor al, al
jmp 0x14003bd2e
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14003bd23
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14003bced
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003bd2e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14003ff60
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x14004062c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400866e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14008670d
xor al, al
jmp 0x14008686f
mov rax, qword [0x1400a76c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400a76c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400a76d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400a76d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400a76e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400a76e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400a76f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400a76f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400a7700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140086861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400867b9
mov r11d, 2
jmp 0x1400867dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400867d3
mov r11d, 1
jmp 0x1400867dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140086885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140086822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14008683a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14008684a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140086858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400867a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14008686a
Function at 0x4140a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41422b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042ff00
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414105
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414114
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414133
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414143
cmp rbx, 0x1000
jae 0x41410b
jmp 0x4141ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414155
xor edx, edx
jmp 0x4141a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042ff00
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414139
jmp 0x414128
call fcn.0045e480
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434300
lea rax, [0x004a1e0f]
mov ebx, 0x18
nop dword [rax]
call fcn.00434b80
mov rax, qword [rsp + 0x38]
call fcn.004348c0
lea rax, [0x004a212f]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00434b80
mov rax, qword [rsp + 0x30]
call fcn.004348c0
call fcn.00434540
call fcn.00434360
lea rax, [0x004a3cd0]
mov ebx, 0x21
call fcn.00432960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045adc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004140a0
Function at 0x414260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414486
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042ff80
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4142d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4142e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414305
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414315
cmp rbx, 0x1000
jae 0x4142d9
nop
jmp 0x414398
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41432d
xor esi, esi
jmp 0x41438a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042ff80
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41430b
jmp 0x4142f6
call fcn.0045e480
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414420
nop dword [rax + rax]
call fcn.00434300
lea rax, [0x004a2148]
mov ebx, 0x19
call fcn.00434b80
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004348c0
lea rax, [0x004a212f]
mov ebx, 0x19
call fcn.00434b80
mov eax, dword [rsp + 0x34]
call fcn.004348c0
nop
call fcn.00434540
call fcn.00434360
lea rax, [0x0049f7fd]
mov ebx, 0xd
call fcn.00432960
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4143c0
call fcn.00434300
lea rax, [0x004a2148]
mov ebx, 0x19
call fcn.00434b80
mov rax, qword [rsp + 0x38]
call fcn.004348c0
lea rax, [0x004a212f]
mov ebx, 0x19
call fcn.00434b80
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004348c0
call fcn.00434540
call fcn.00434360
lea rax, [0x004a35f0]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00432960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045adc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414260
Function at 0x41c1a0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005832f2], 0
jne 0x41c287
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41c27a
lea rbx, [0x005556d8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41c260
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0045d060
lea rax, [0x004a56ce]
mov ebx, 0x2c
call fcn.00432960
nop
int3

Function at 0x41e560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e666
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41e5a3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41e65b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041f360
test rax, rax
je 0x41e65b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041e6a0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045ac80
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41e649
xor eax, eax
jmp 0x41e653
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41e591
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045adc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041e560
Function at 0x441420
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x441587
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x441432
cmp edx, ecx
jne 0x441575
nop word [rax + rax]
test rsi, rsi
jne 0x441575
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x441494
nop
call fcn.0045e8a0
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00441340
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x441570
mov rdx, qword [0x00530508]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x441565
mov rcx, qword [0x00530500]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00530f70]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00530f70], rax
nop
mov edx, 1
lea rsi, [0x00530f78]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x441553
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004a4f13]
mov ebx, 0x28
nop
call fcn.00432960
mov rax, rsi
mov rcx, rdx
call fcn.0045d040
call fcn.00431000
lea rax, [0x004a42c3]
mov ebx, 0x23
call fcn.00432960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045adc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00441420
Function at 0x473fe0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4740aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403100
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47408f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0048b9a0]
xor ebx, ebx
mov rcx, rdx
call fcn.004454a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004745c0
inc rbx
cmp rcx, rbx
jae 0x47407e
mov edi, 1
lea rsi, [0x0048b9a0]
call fcn.00445580
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004bed68]
lea rsi, [0x004be708]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045adc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00473fe0
Function at 0x140002320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
mov rax, qword [0x1400441a0]
add rax, 0x10000
mov rdi, rax
xor eax, eax
mov ecx, 0x10000
rep stosb byte [rdi], al
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x140035010]
movzx eax, word [rcx + rax*8 + 2]
mov dword [0x140035968], eax
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x140035010]
movzx eax, word [rcx + rax*8]
mov dword [0x14003596c], eax
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x140035010]
movzx eax, word [rcx + rax*8 + 4]
mov dword [0x140035970], eax
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x140035010]
movzx eax, word [rcx + rax*8 + 6]
mov dword [0x140035964], eax
mov dword [0x140035954], 0
mov dword [0x140035948], 0
mov edx, 0x10000
mov rcx, qword [0x1400441a8]
call qword [0x1400441c8]
mov dword [0x140035960], eax
cmp dword [0x140035960], 0
je 0x1400023e0
cmp dword [0x140035960], 0xffffffff
jne 0x1400023f6
mov dword [0x14003595c], 1
mov dword [0x140035960], 0
jmp 0x140002468
mov dword [0x14003595c], 0
cmp dword [0x140035960], 0x106
jae 0x14000241c
cmp dword [0x14003595c], 0
jne 0x14000241c
call fcn.140002130
jmp 0x140002400
mov dword [0x14003594c], 0
mov dword [rsp + 0x20], 0
jmp 0x14000243a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
jae 0x140002468
mov eax, dword [0x14003594c]
shl eax, 5
mov ecx, dword [rsp + 0x20]
mov rdx, qword [0x1400441a8]
movzx ecx, byte [rdx + rcx]
xor eax, ecx
and eax, 0x7fff
mov dword [0x14003594c], eax
jmp 0x140002430
add rsp, 0x30
pop rdi
ret

Function at 0x1400033e0
Capabilities:
Copy network traffic

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
mov r8, qword [rcx + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call sub.fwpkclnt.sys_FwpsCopyStreamDataToBuffer0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.140006190
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0xc0]
test eax, eax
jne 0x14000348a
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 0xc2]
test eax, eax
je 0x1400034a4
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x28]
test eax, eax
je 0x1400034a4
mov rax, qword [rsp + 0x50]
mov qword [rax + 0x18], 0
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x28]
test eax, eax
je 0x1400034bc
mov rax, qword [rsp + 0x50]
mov dword [rax], 1
mov al, 1
add rsp, 0x48
ret
Function at 0x140008ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x18
mov byte [rsp + 1], 0
jmp 0x140008afa
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x140008b81
mov byte [rsp], 0
jmp 0x140008b13
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x140008b7c
movzx eax, byte [rsp + 1]
mov rcx, qword [0x140035db0]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 0x20]
shl edx, 2
movzx r8d, byte [rsp + 1]
shl r8d, 2
lea edx, [r8 + rdx*4]
movzx r8d, byte [rsp]
add edx, r8d
movsxd rdx, edx
lea r8, [0x140035dc0]
movzx edx, byte [r8 + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 1]
mov r8, qword [0x140035db0]
lea rdx, [r8 + rdx*4]
mov byte [rdx + rcx], al
jmp 0x140008b0a
jmp 0x140008aef
add rsp, 0x18
ret
Function at 0x14001b600
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [rsp + 8], cl
movzx eax, byte [rsp + 8]
lea rcx, [0x1400308a0]
movzx eax, byte [rcx + rax]
ret

Function at 0x14001b620
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov byte [rsp + 8], cl
movzx eax, byte [rsp + 8]
lea rcx, [0x1400307a0]
movzx eax, byte [rcx + rax]
ret