joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087102
Capabilities:
Query environment variable

Disassembly:
jmp 0x14016cf40
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x14016d028
mov rsi, rax
cmp word [rax], r14w
je 0x14016cf93
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x14016cf7b
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x14016cf77
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.140087d37
movsxd rbp, eax
test eax, eax
je 0x14016d028
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.140086e2d
mov rdi, rax
test rax, rax
je 0x14016d016
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140087d37
test eax, eax
je 0x14016d016
mov rsi, rdi
mov rdi, r14
jmp 0x14016d019
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.140085a3c
jmp 0x14016d02b
mov rsi, r14
test rbx, rbx
je 0x14016d039
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14008711b
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1400c1ac0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1400c1490
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400c1b01
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401ef020]
jmp 0x1400c1b07
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400871b1
Capabilities:
Get geographical location

Disassembly:
jmp 0x14014a350
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.1401492d0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14014a3a3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x1401ef020]
jmp 0x14014a3c5
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.14008684c
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret
Function at 0x1400871bb
Capabilities:
Terminate process

Disassembly:
jmp 0x1400a8600
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14008742c
Capabilities:
Print debug messages

Disassembly:
jmp 0x140189850
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1401d7038]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140189876
jmp 0x1401898f3
mov rcx, qword [rbp + 0x30]
call fcn.140086b9e
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14018988f
jmp 0x1401898f3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1401898ac
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140085a6e
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140085f6e
test eax, eax
jne 0x1401898f3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140086d9c
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x140087968
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400a9940
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400a9960
xor al, al
jmp 0x1400a99e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400a9973
xor al, al
jmp 0x1400a99e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400a999d
xor al, al
jmp 0x1400a99e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400a99b1
xor al, al
jmp 0x1400a99e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400a99c3
xor al, al
jmp 0x1400a99e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400a99df
xor al, al
jmp 0x1400a99e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140087f08
Capabilities:
Terminate process

Disassembly:
jmp 0x140145fa0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140145fce
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140088804
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140087fda
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14014a140
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.140149150
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14014a175
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x1401ef020]
jmp 0x14014a17f
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret

Function at 0x1400884ee
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14014a1a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.140149190
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14014a1df
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x1401ef020]
jmp 0x14014a1ee
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret

Function at 0x140088877
Capabilities:
Print debug messages

Disassembly:
jmp 0x1401654e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140088958
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400c1c00
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400c1550
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400c1c49
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401ef020]
jmp 0x1400c1c58
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x140088a20
Capabilities:
Set environment variable

Disassembly:
jmp 0x14018bbb0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
lea rcx, [rsp + 0x70]
call fcn.1400866c6
lea rcx, [rsp + 0x40]
call fcn.1400866c6
call fcn.1400870a3
mov r8d, eax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
call fcn.14008647d
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14018bc1f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x40]
call fcn.140086a9a
lea rcx, [rsp + 0x70]
call fcn.140086a9a
mov eax, dword [rsp + 0x24]
jmp 0x14018bcac
call fcn.1400870a3
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call fcn.14008647d
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x14018bc66
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x40]
call fcn.140086a9a
lea rcx, [rsp + 0x70]
call fcn.140086a9a
mov eax, dword [rsp + 0x2c]
jmp 0x14018bcac
lea rcx, [rsp + 0x40]
call fcn.14008662b
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
call fcn.14008662b
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x40]
call fcn.140086a9a
lea rcx, [rsp + 0x70]
call fcn.140086a9a
mov eax, dword [rsp + 0x30]
add rsp, 0xa8
ret
Function at 0x140022e40
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140022e4d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140022e5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140022e45
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140022e75
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140022e62
sub eax, 3
jb 0x140022e8f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140022ec6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140022eb6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140022eb4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140022ea3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140022e02
jmp 0x140022e4d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xd600
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140022f12
cmp rsi, rcx
jae 0x140022f1a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140022ef9
cmp al, 0x8f
ja 0x140022ef9
cmp byte [rsi - 2], 0xf
je 0x140022eff
sub al, 0xe8
cmp al, 1
ja 0x140022ee3
cmp rsi, rcx
jae 0x140022f1a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140022ee9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140022f1a
lodsb al, byte [rsi]
jmp 0x140022ef9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x20000]
mov eax, dword [rdi]
or eax, eax
je 0x140022f77
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x27564]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140022f27
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140022f71
mov qword [rbx], rax
add rbx, 8
jmp 0x140022f47
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140022fb1
cmp al, 0xef
ja 0x140022fa3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140022f83
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140022f92
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140023030], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140023030
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140023020
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x140011a20
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x1401a27c8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x140011b0f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x140011b0f
mov rdx, qword [rsp + 0x70]
test r14, r14
je 0x140011aea
xorps xmm0, xmm0
test rdx, rdx
js 0x140011a91
cvtsi2ss xmm0, rdx
jmp 0x140011aa9
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x1401683d8]
test rbx, rbx
js 0x140011ac3
cvtsi2ss xmm0, rbx
jmp 0x140011adb
mov rax, rbx
mov rcx, rbx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
xor eax, eax
test rdi, rdi
je 0x140011b01
cmp rdx, rbx
jbe 0x140011afb
mov qword [rdi], rax
jmp 0x140011b01
sub rbx, rdx
mov qword [rdi], rbx
test rsi, rsi
je 0x140011bd8
jmp 0x140011bd5
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
cmp rdx, qword [rsp + 0x28]
jae 0x140011bb2
test r14, r14
je 0x140011ba1
mov rcx, rdx
xorps xmm0, xmm0
sub rcx, qword [rsp + 0x50]
js 0x140011b4b
cvtsi2ss xmm0, rcx
jmp 0x140011b60
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
mulsd xmm1, qword [0x1401683d8]
test rdx, rdx
js 0x140011b7a
cvtsi2ss xmm0, rdx
jmp 0x140011b92
mov rax, rdx
mov rcx, rdx
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvttsd2si rax, xmm1
mov dword [r14], eax
test rdi, rdi
je 0x140011ba9
mov qword [rdi], rdx
test rsi, rsi
je 0x140011bd8
xor eax, eax
jmp 0x140011bd5
test r14, r14
je 0x140011bbe
mov eax, dword [rsp + 0x24]
mov dword [r14], eax
test rdi, rdi
je 0x140011bcb
mov rax, qword [rsp + 0x30]
mov qword [rdi], rax
test rsi, rsi
je 0x140011bd8
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140068850
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop r14
pop rdi
pop rsi
ret
Function at 0x140072510
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.1400027f0
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.140002840
test esi, esi
jne 0x140072584
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp esi, 0xc0000017
jne 0x1400725ab
lea rcx, [0x140138fe8]
call fcn.140001cf0
mov rsi, rax
mov rcx, rsi
call fcn.140084c30
mov rcx, rsi
call fcn.140002950
lea rcx, [0x140138930]
call fcn.140001cf0
mov rsi, rax
mov rcx, rsi
call fcn.14007bd10
mov rcx, rsi
call fcn.140002950
int3

Function at 0x1400765e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 8], rax
xorps xmm4, xmm4
movaps xmmword [rbp + 0x10], xmm4
movaps xmmword [rbp + 0x20], xmm4
mov rax, qword [0x1401a27c8]
mov qword [rbp], rax
mov rsi, rcx
mov edi, dword [rsi + 8]
xor ebx, ebx
cmp edi, 0x40
jae 0x140076633
test dword [rsp], esp
sub rsp, 0x80
lea r14, [rsp + 0x20]
mov r15d, 0x40
jmp 0x14007665e
call fcn.140001724
mov rcx, qword [rax + 8]
lea edx, [rdi + 1]
cmp dword [rcx], ecx
call fcn.1400db8f0
mov rbx, rax
test rbx, rbx
jne 0x140076656
xor r14d, r14d
xor r15d, r15d
jmp 0x14007665e
lea r14, [rbx + 0x10]
mov r15d, dword [rbx + 8]
lea rcx, [rsi + 0xc]
mov edx, dword [rsi + 8]
mov edx, edi
mov qword [rbp + 0x18], rcx
mov dword [rbp + 0x20], edx
mov qword [rbp + 8], r14
mov dword [rbp + 0x10], r15d
lea rcx, [rbp + 0x18]
lea rdx, [rbp + 8]
call fcn.140093fb0
cmp edi, r15d
jae 0x14007674e
mov eax, edi
mov word [r14 + rax*2], 0
mov esi, 0x15051505
mov r12d, 0x15051505
xor eax, eax
test r15d, r15d
je 0x1400766aa
mov rax, r14
mov qword [rbp + 0x28], rax
cmp edi, 2
jle 0x1400766e5
add edi, 0xfffffffc
mov edx, esi
rol edx, 5
add esi, edx
mov edx, dword [rax]
or edx, 0x200020
xor esi, edx
mov edx, r12d
rol edx, 5
add r12d, edx
mov edx, dword [rax + 4]
or edx, 0x200020
xor r12d, edx
add rax, 8
cmp edi, 2
jg 0x1400766b3
test edi, edi
jle 0x1400766ff
mov edx, r12d
rol edx, 5
add edx, r12d
mov r12d, dword [rax]
or r12d, 0x200020
xor r12d, edx
xor eax, eax
mov qword [rbp + 0x28], rax
test rbx, rbx
je 0x140076720
call fcn.140001724
mov rcx, qword [rax + 8]
mov rdx, rbx
xor r8d, r8d
cmp dword [rcx], ecx
call fcn.1400dbb00
imul eax, r12d, 0x5d588b65
add eax, esi
lea rcx, [0x1401a27c8]
mov rcx, qword [rcx]
cmp qword [rbp], rcx
je 0x14007673e
call fcn.140003bb0
nop
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.1400ada00
int3
Function at 0x14007a790
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
mov qword [rsp + 0x60], r9
mov r10, qword [rcx]
mov ecx, dword [rcx + 8]
mov r11, qword [rdx]
mov esi, ecx
and esi, 0xfffffffc
mov edi, dword [rdx + 8]
xor ebx, ebx
xor ebp, ebp
test ecx, ecx
je 0x14007a9b4
lea r14, [0x1401364f0]
mov eax, esi
sar eax, 2
lea eax, [rax + rax*2]
cmp edi, eax
jl 0x14007a7d7
lea r15d, [rsi - 4]
jmp 0x14007a7ee
mov edx, 0x55555556
mov eax, edx
imul edi
mov r15d, edx
shr r15d, 0x1f
add r15d, edx
shl r15d, 2
test r15d, r15d
jle 0x14007a894
movsxd rax, ebx
lea rax, [r10 + rax*2]
movzx edx, word [rax]
movzx r12d, word [rax + 2]
movzx r13d, word [rax + 4]
movzx eax, word [rax + 6]
mov r9d, edx
or r9d, r12d
or r9d, r13d
or r9d, eax
test r9d, 0xffffff00
je 0x14007a82c
mov r9d, 0xffffffff
jmp 0x14007a861
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
movsxd r9, r12d
movsx r12, byte [r14 + r9]
movsxd r9, r13d
movsx r13, byte [r14 + r9]
cdqe
movsx rax, byte [r14 + rax]
shl edx, 0x12
or eax, edx
shl r12d, 0xc
or eax, r12d
shl r13d, 6
mov r9d, eax
or r9d, r13d
test r9d, r9d
jl 0x14007a9d1
movsxd rax, ebp
add rax, r11
mov edx, r9d
sar edx, 0x10
mov byte [rax], dl
mov edx, r9d
sar edx, 8
mov byte [rax + 1], dl
mov byte [rax + 2], r9b
add ebp, 3
add ebx, 4
cmp ebx, r15d
jl 0x14007a7f7
lea eax, [rsi - 4]
cmp r15d, eax
jne 0x14007a9d1
cmp ebx, esi
je 0x14007a9d1
lea eax, [rsi - 4]
cdqe
movzx eax, word [r10 + rax*2]
lea edx, [rsi - 3]
movsxd rdx, edx
movzx edx, word [r10 + rdx*2]
lea r9d, [rsi - 2]
movsxd r9, r9d
movzx r9d, word [r10 + r9*2]
lea r15d, [rsi - 1]
movsxd r15, r15d
movzx r10d, word [r10 + r15*2]
mov r15d, eax
or r15d, edx
or r15d, r9d
or r15d, r10d
test r15d, 0xffffff00
jne 0x14007a9d1
cdqe
movsx rax, byte [r14 + rax]
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
shl eax, 0x12
shl edx, 0xc
or eax, edx
cmp r10d, 0x3d
je 0x14007a959
movsxd r9, r9d
movsx r9, byte [r14 + r9]
movsxd r10, r10d
movsx r10, byte [r14 + r10]
or r10d, eax
shl r9d, 6
mov eax, r10d
or eax, r9d
jl 0x14007a9d1
add edi, 0xfffffffd
cmp ebp, edi
jg 0x14007a9d1
movsxd rdx, ebp
add r11, rdx
mov edx, eax
sar edx, 0x10
mov byte [r11], dl
mov edx, eax
sar edx, 8
mov byte [r11 + 1], dl
mov byte [r11 + 2], al
add ebp, 3
jmp 0x14007a9ad
cmp r9d, 0x3d
je 0x14007a996
movsxd r9, r9d
movsx r9, byte [r14 + r9]
mov edx, r9d
shl edx, 6
or eax, edx
jl 0x14007a9d1
lea edx, [rdi - 2]
cmp ebp, edx
jg 0x14007a9d1
mov edx, eax
sar edx, 0x10
movsxd r9, ebp
mov byte [r11 + r9], dl
sar eax, 8
lea edx, [rbp + 1]
movsxd rdx, edx
mov byte [r11 + rdx], al
add ebp, 2
jmp 0x14007a9ad
test eax, eax
jl 0x14007a9d1
lea edx, [rdi - 1]
cmp ebp, edx
jg 0x14007a9d1
sar eax, 0x10
movsxd rdx, ebp
mov byte [r11 + rdx], al
inc ebp
add ebx, 4
cmp esi, ecx
jne 0x14007a9d1
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
mov eax, 1
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
xor eax, eax
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14007f080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x30
xor eax, eax
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov edi, edx
mov rsi, r8
test edi, edi
jg 0x14007f0a2
mov edi, 1
mov rcx, rbx
neg rcx
lea rdx, [0x14012b9a8]
mov rax, rcx
or rax, 1
test dword [0x1401a67b0], 0x1000
je 0x14007f0d0
xor r8d, r8d
lzcnt r8, rax
xor r8d, 0x3f
jmp 0x14007f0d4
bsr r8, rax
movsxd rax, r8d
movzx ebp, byte [rdx + rax]
mov edx, ebp
shl rdx, 3
lea rax, [0x14012f898]
add rdx, rax
cmp rcx, qword [rdx]
setb cl
movzx ecx, cl
sub ebp, ecx
cmp edi, ebp
jge 0x14007f0fd
jmp 0x14007f0ff
mov ebp, edi
mov r14d, dword [rsi + 8]
add ebp, r14d
lea rcx, [0x1401370a0]
mov edx, ebp
call fcn.140001db0
mov rcx, rax
test rcx, rcx
jne 0x14007f120
xor eax, eax
jmp 0x14007f12e
lea rax, [rcx + 0xc]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movsxd rdx, ebp
lea r8, [rax + rdx*2]
mov r9, rbx
neg r9
cmp r9, 0x64
jb 0x14007f210
add r8, 0xfffffffffffffffc
add edi, 0xfffffffe
movabs rdx, 0x28f5c28f5c28f5c3
mov rax, r9
shr rax, 2
mul rdx
shr rdx, 2
imul rax, rdx, 0x64
sub r9, rax
lea rax, [0x140192280]
add r9d, r9d
movsxd r9, r9d
mov eax, dword [rax + r9*2 + 0xc]
mov dword [r8], eax
cmp rdx, 0x64
jae 0x14007f208
test rdx, rdx
je 0x14007f203
dec edi
movabs r9, 0xcccccccccccccccd
mov qword [rsp + 0x20], rdx
mov rax, rdx
mul r9
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
mov r9, qword [rsp + 0x20]
mov r10, r9
sub r10, rax
mov r9, rdx
add r8, 0xfffffffffffffffe
add r10, 0x30
mov word [r8], r10w
test r9, r9
jne 0x14007f1fe
test edi, edi
mov rdx, r9
jg 0x14007f18f
mov rax, r8
lea edx, [r14 - 1]
test edx, edx
jl 0x14007f232
cmp r14d, edx
jle 0x14007f218
add rax, 0xfffffffffffffffe
mov r8d, edx
movzx r8d, word [rsi + r8*2 + 0xc]
mov word [rax], r8w
dec edx
jns 0x14007f1e7
jmp 0x14007f232
mov rdx, r9
jmp 0x14007f18f
mov r9, rdx
jmp 0x14007f1d0
mov r9, rdx
jmp 0x14007f145
mov rdx, r9
jmp 0x14007f18a
add rax, 0xfffffffffffffffe
cmp edx, r14d
jae 0x14007f247
mov r8d, edx
movzx r8d, word [rsi + r8*2 + 0xc]
mov word [rax], r8w
dec edx
jns 0x14007f218
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, rcx
add rsp, 0x30
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
call fcn.1400ada00
int3