joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400117fd
Capabilities:
Connect socket

Disassembly:
jmp 0x140017510
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x14003a0fc]
call fcn.1400119c4
mov rcx, qword [rbp + 0x1a0]
call fcn.1400116ae
mov rcx, qword [rbp + 0x1a0]
call fcn.1400113fc
mov rcx, qword [rbp + 0x1a0]
mov dword [rcx + 0x200], eax
lea rdx, str.Socket_created
lea rcx, [rbp + 0xc8]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0xc8]
mov rcx, qword [rbp + 0x1a0]
call fcn.140011866
nop
lea rcx, [rbp + 0xc8]
call fcn.1400111d1
lea rdx, str.Please_enter_the_hostname_to_connect_to:
lea rcx, [rbp + 0x108]
call fcn.14001144c
nop
mov r9b, 1
mov r8d, recv
lea rdx, [rbp + 0x108]
mov rcx, qword [rbp + 0x1a0]
call fcn.140011866
nop
lea rcx, [rbp + 0x108]
call fcn.1400111d1
mov rax, qword [rbp + 0x1a0]
add rax, 0x1e0
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140011910
mov rax, qword [rbp + 0x1a0]
add rax, 0x1d0
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rcx, rax
call fcn.140011771
mov eax, 2
mov rcx, qword [rbp + 0x1a0]
mov word [rcx + 0x1d0], ax
mov cx, 0x2cbb
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rbp + 0x1a0]
mov word [rcx + 0x1d2], ax
mov rax, qword [rbp + 0x1a0]
add rax, 0x1e0
mov rdx, rax
mov rcx, qword [rbp + 0x1a0]
call fcn.1400119fb
mov rcx, qword [rbp + 0x1a0]
mov dword [rcx + 0x1d4], eax
mov rax, qword [rbp + 0x1a0]
add rax, 0x1d0
mov rcx, qword [rbp + 0x1a0]
movsxd rcx, dword [rcx + 0x200]
mov r8d, reloc.WS2_32.dll_recv
mov rdx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1400176a6
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, eax
lea rdx, str.connect_failed
mov rcx, qword [rbp + 0x1a0]
call fcn.1400116c7
lea rdx, str.Connected_to_the_server_successfully
lea rcx, [rbp + 0x148]
call fcn.14001144c
nop
xor r9d, r9d
mov r8d, recv
lea rdx, [rbp + 0x148]
mov rcx, qword [rbp + 0x1a0]
call fcn.140011866
nop
lea rcx, [rbp + 0x148]
call fcn.1400111d1
mov rax, qword [rbp + 0x1a0]
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1400119a6
Capabilities:
Write file on windows

Disassembly:
jmp 0x140019b60
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140032040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14003a0f5]
call fcn.1400119c4
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x140019bc6
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140019bcd
mov al, 1
jmp 0x140019d1d
call fcn.1400112a8
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.1400112a8
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.1400117b7
movzx eax, al
test eax, eax
je 0x140019c1e
xor al, al
jmp 0x140019d1d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x140019c83
cmp dword [rbp + 0x154], 1
je 0x140019c8e
cmp dword [rbp + 0x154], 3
je 0x140019d0c
jmp 0x140019d1b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140019cde
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140019cde
xor al, al
jmp 0x140019d1d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140019cf9
mov dword [rbp + 0x154], 1
jmp 0x140019d03
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140019d1d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140019d1d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002bbf0]
call fcn.140011816
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400114ba
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x1400119fb
Capabilities:
Resolve dns

Disassembly:
jmp 0x140019410
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14003a0fc]
call fcn.1400119c4
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14001945f
lea rdx, str.gethostbyname___failed
mov rcx, qword [rbp + 0x100]
call fcn.1400116c7
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov eax, dword [rax]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140002c40
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x288], rdi
xor edx, edx
xor edi, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cf5
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002cec
mov qword [rsp + 0x280], rsi
lea rsi, str.iw3mp.exe
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x4c]
mov rax, rdi
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2]
cmp cx, word [rsi + rax*2]
jne 0x140002d2d
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rsi + rax*2 + 2]
jne 0x140002d2d
add rax, 2
cmp rax, 0xa
jne 0x140002cc0
mov edi, dword [rsp + 0x28]
mov rsi, qword [rsp + 0x280]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, qword [rsp + 0x288]
mov rbx, rax
test rax, rax
je 0x140002d45
mov edx, 0xcc18c90
mov rcx, rax
call fcn.140001000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002d7b
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002cb0
jmp 0x140002ce4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_open_process._Error_code:
mov ebx, eax
call fcn.140002e40
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003010]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Press_any_key_to_exit...
call fcn.140002e40
mov rcx, rax
lea rdx, [0x140003010]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140003060
add rsp, 0x270
pop rbx
ret
Function at 0x140003928
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003972
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003972
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003972
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003972
cmp dword [rcx + 0x84], 0xe
jbe 0x140003972
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003974
xor al, al
add rsp, 0x28
ret
Function at 0x14047ad55
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x20]
jne 0x140447caf
mov r8, rax
jmp 0x1404422c1
Function at 0x18001b7a4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
lea rsi, [0x180047840]
mov ebp, 0x800
lea r8, str.._._._..._._._.._._...
mov rcx, rsi
mov r9d, 0x1800
mov edx, ebp
call fcn.18001b8d4
xor r14d, r14d
mov eax, r14d
xor byte [rax + rsi], 0x8a
inc rax
cmp rax, rbp
jl 0x18001b7e6
lea rcx, [rsp + 0x20]
mov r8d, ebp
mov rdx, rsi
call fcn.180016644
jmp 0x18001b896
lea rcx, [rsp + 0x20]
call fcn.180016760
lea rcx, [rsp + 0x20]
movsx ebx, ax
call fcn.180016760
mov rcx, qword [0x180051d08]
movsx rdi, di
mov edx, ebx
shl rdi, 4
mov word [rdi + rcx], bx
dec edx
je 0x18001b880
dec edx
je 0x18001b869
dec edx
jne 0x18001b896
lea rcx, [rsp + 0x20]
movsx edx, ax
movsx rbx, ax
call fcn.1800168f4
mov rcx, qword [0x180051d08]
mov r8, rbx
mov rcx, qword [rdi + rcx + 8]
mov rdx, rax
call fcn.18001fe20
jmp 0x18001b896
lea rcx, [rsp + 0x20]
call fcn.180016654
mov rcx, qword [0x180051d08]
mov dword [rdi + rcx + 8], eax
jmp 0x18001b896
lea rcx, [rsp + 0x20]
call fcn.180016760
mov rdx, qword [0x180051d08]
mov word [rdi + rdx + 8], ax
lea rcx, [rsp + 0x20]
call fcn.180016760
movzx edi, ax
test ax, ax
jg 0x18001b807
mov r8, rbp
xor edx, edx
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp fcn.18001fa30

Function at 0x18001b8d4
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x18001b91a
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov ebx, edx
mov r11, rcx
xor r10d, r10d
movsxd rdi, r9d
mov eax, r10d
mov rcx, rdi
inc r10d
cdq
idiv r9d
movsxd rax, edx
sub rcx, rax
mov al, byte [rcx + r8 - 1]
xor byte [r11], al
inc r11
cmp r10d, ebx
jl 0x18001b8ed
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x18001b91c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov ebx, edx
mov r11, rcx
test edx, edx
jle 0x18001b949
mov eax, r10d
inc r10d
cdq
idiv r9d
movsxd rax, edx
mov cl, byte [rax + r8]
xor byte [r11], cl
inc r11
cmp r10d, ebx
jl 0x18001b92d
mov rbx, qword [rsp + 8]
ret
Function at 0x415540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4156eb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431d20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4155ae
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4155c1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4155e5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4155f9
cmp rbx, 0x1000
jae 0x4155b8
nop
jmp 0x415669
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41560d
xor edx, edx
jmp 0x415660
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431d20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4155ef
jmp 0x4155d5
call fcn.0045fba0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004362e0
lea rax, [0x004ac639]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00436be0
mov rax, qword [rsp + 0x38]
call fcn.004368e0
lea rax, [0x004ac6f9]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436be0
mov rax, qword [rsp + 0x30]
call fcn.004368e0
call fcn.00436540
call fcn.00436360
lea rax, [0x004ae897]
mov ebx, 0x21
call fcn.00434a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415540
Function at 0x415720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41594a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00431da0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41579b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4157ae
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4157d0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4157e4
cmp rbx, 0x1000
jae 0x4157a5
jmp 0x41586e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4157f6
xor esi, esi
jmp 0x415860
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00431da0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4157da
jmp 0x4157c2
call fcn.0045fba0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4158e9
call fcn.004362e0
lea rax, [0x004acaaf]
mov ebx, 0x19
call fcn.00436be0
mov rax, qword [rsp + 0x68]
call fcn.004368e0
lea rax, [0x004ac6f9]
mov ebx, 0x19
nop
call fcn.00436be0
mov eax, dword [rsp + 0x34]
call fcn.004368e0
call fcn.00436540
call fcn.00436360
lea rax, [0x004a970f]
mov ebx, 0xd
call fcn.00434a20
cmp eax, 0x5af
je 0x415893
call fcn.004362e0
lea rax, [0x004acaaf]
mov ebx, 0x19
call fcn.00436be0
mov rax, qword [rsp + 0x38]
call fcn.004368e0
lea rax, [0x004ac6f9]
mov ebx, 0x19
nop dword [rax]
call fcn.00436be0
mov eax, dword [rsp + 0x34]
call fcn.004368e0
call fcn.00436540
call fcn.00436360
lea rax, [0x004ae1a9]
mov ebx, 0x1f
call fcn.00434a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415720
Function at 0x41e020
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00597371], 0
jne 0x41e10f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41e105
lea rbx, [0x005697d0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41e0e7
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045e700
lea rax, [0x004b0153]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00434a20
nop
int3

Function at 0x420860
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x420961
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x4208a0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x420951
test byte [rax], al
lea rcx, [rax + 0x100c0]
mov rax, rcx
call fcn.004213c0
nop dword [rax]
test rax, rax
je 0x420951
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004209a0]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 8]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045bec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42093f
xor eax, eax
jmp 0x420949
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x420892
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045c000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00420860
Function at 0x442f60
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4430cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x442f78
cmp edx, ecx
jne 0x4430bd
nop dword [rax]
test rsi, rsi
jne 0x4430bd
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x442fd6
nop
call fcn.00460000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
nop dword [rax + rax]
call fcn.00442e60
mov rcx, qword [0x00543578]
mov rdx, qword [0x00543570]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
sar esi, 5
mov r8d, esi
shl esi, 5
sub edi, esi
test edi, edi
jl 0x4430b8
cmp edi, 0x20
sbb esi, esi
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x4430ad
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x00543f10]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x00543f10], rbx
mov edx, 1
lea rsi, [0x00543f18]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x44309c
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1228], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004af8fd]
mov ebx, 0x28
call fcn.00434a20
mov rcx, rax
mov rax, rsi
call fcn.0045e6e0
call fcn.00432f40
lea rax, [0x004aede5]
mov ebx, 0x23
call fcn.00434a20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045c000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00442f60
Function at 0x140005d30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140005d61
xor eax, eax
jmp 0x140005eab
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140005d9e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x140005d9e
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x140005eab
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140005ea0
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140005de5
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005df3
movzx ecx, di
jmp 0x140005e47
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005e60
sub eax, 1
je 0x140005e60
cmp eax, 2
jne 0x140005ea0
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140005ea3
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x140005e8e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140005ea0
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140008830
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret