joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400011c0
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2e0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0x202
lea rdx, [rsp + 0x30]
xor esi, esi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000121a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.WSAStartup_failed._n
call fcn.140001b50
lea ecx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, pe_nt_image_headers64
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x140001257
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_getting_hostname._n
call fcn.140001b50
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x2f8], rbx
mov qword [rsp + 0x300], rbp
call qword [sym.imp.WS2_32.dll_WSACleanup]
xorps xmm0, xmm0
lea rax, [rsp + 0x1d0]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x140001290
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x1400013a0
mov qword [rdi + 0x18], 0xf
cmp rbx, 0x10
jae 0x1400012da
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x1d0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], sil
jmp 0x14000136c
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x14000130f
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002480
test rax, rax
je 0x140001336
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000134a
mov ecx, 0x16
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, 0x1000
jb 0x14000133d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400013a6
jmp 0x1400012f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000134a
call fcn.140002480
mov rsi, rax
mov r8, rbx
mov qword [rdi], rsi
lea rdx, [rsp + 0x1d0]
mov qword [rdi + 0x10], rbx
mov rcx, rsi
mov qword [rdi + 0x18], rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov rbx, qword [rsp + 0x2f8]
mov rax, rdi
mov rbp, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140002460
mov rsi, qword [rsp + 0x308]
add rsp, 0x2e0
pop rdi
ret
call fcn.1400011a0
int3
call fcn.140001100
int3
Function at 0x140002df4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e3e
mov ecx, malloc
cmp word [rax], cx
jne 0x140002e3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e40
xor al, al
add rsp, 0x28
ret
Function at 0x140002f00
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140002f44
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.140002f50
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140002f34
mov qword [rdi], rsi
call fcn.140059c20
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140004688
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
xor edx, edx
call fcn.140003788
mov dword [rsi + 0x120], ebx
mov dword [rsi + 0x124], edi
movaps xmm0, xmmword [section..rdata]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [rsi + 0x128], rcx
mov qword [rsi + 0x130], 0x20
mov qword [rsi + 0x138], 0x40
mov dword [rsi + 0x140], ebx
lea rax, [rsi + 8]
mov qword [rsi + 8], 0
xor rax, 0xffffffffb37cc16a
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rsi
mov dword [rsi + 0x28], ebx
lea rcx, [rsi + 0x30]
mov r8d, 0xf0
xor edx, edx
call fcn.14014b870
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140148650
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140006380
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x30], rax
test rdx, rdx
je 0x140006423
cmp dword [0x1401c86b0], ecx
jg 0x140006423
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
movsxd r13, eax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rbp, [rsi + r13]
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15, rsi
nop
cmp r15, rbp
jae 0x140006417
mov dword [rsp + 0x2c], 0
mov r8d, ebp
sub r8d, r15d
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r15
mov r9, r14
call r12
test eax, eax
je 0x140006417
mov eax, dword [rsp + 0x2c]
add r15, rax
test eax, eax
jne 0x1400063e0
test edi, edi
je 0x140006423
cmp byte [r13 + rsi - 1], 0xa
jne 0x140006442
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140148650
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
lea r14, [0x1401859ff]
lea r15, [0x140185a00]
lea rdi, [rsp + 0x2c]
mov rbx, r14
nop word cs:[rax + rax]
cmp rbx, r15
jae 0x140006423
mov dword [rsp + 0x2c], 0
mov r8d, r14d
sub r8d, ebx
inc r8d
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rbx
mov r9, rdi
call r12
test eax, eax
je 0x140006423
mov eax, dword [rsp + 0x2c]
add rbx, rax
test eax, eax
jne 0x140006470
jmp 0x140006423
Function at 0x14000d156
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r15, [rsp + 0x34]
mov dword [r15], 0xaaaaaaaa
mov qword [rsp + 0x20], r15
mov r8, r9
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000d201
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x28]
mov qword [r12], rax
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, eax
mov r14, qword [r12]
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000d201
test ebp, ebp
setne al
cmp r14, rsi
sete sil
and sil, al
jmp 0x14000d203
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140148650
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14000db50
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov qword [rcx], 0
mov rbx, qword [rdx]
mov qword [rdx], 0
lea r14, [rbx + 1]
cmp r14, 2
jae 0x14000db7e
cmp qword [rsi], rbx
jne 0x14000db88
jmp 0x14000dbaa
call fcn.140059c20
cmp qword [rsi], rbx
je 0x14000dbaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14000dbb7
cmp r14, 2
jae 0x14000dbd1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140059c20
mov rcx, qword [rsi]
call fcn.140038f70
mov qword [rsi], 0
cmp r14, 2
jb 0x14000dba2
mov qword [rsi], rbx
call fcn.140059c20
jmp 0x14000dba2

Function at 0x14000df20
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea r14, [rbx + 1]
cmp r14, 2
jae 0x14000df47
cmp qword [rsi], rbx
jne 0x14000df51
jmp 0x14000df73
call fcn.140059c20
cmp qword [rsi], rbx
je 0x14000df73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14000df80
cmp r14, 2
jae 0x14000df9a
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140059c20
mov rcx, qword [rsi]
call fcn.140038f70
mov qword [rsi], 0
cmp r14, 2
jb 0x14000df6b
mov qword [rsi], rbx
call fcn.140059c20
jmp 0x14000df6b
Function at 0x140014040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14001419a
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [rcx + 0x60], 0
je 0x1400141e7
mov edi, dword [rsi + 0x5c]
test bl, bl
je 0x140014308
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
jmp 0x140014308
cmp byte [rsi + 0x61], 0
je 0x140014217
mov rcx, qword [rsi + 0x40]
call fcn.14016823c
mov edi, 0xffffffff
cmp eax, 0xffffffff
je 0x140014308
test bl, bl
je 0x1400142ec
movzx ebx, al
mov dword [rsi + 0x5c], ebx
jmp 0x1400142ff
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x60], rdi
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov r15d, 1
cmovge r15d, eax
xor r14d, r14d
mov rcx, qword [rsi + 0x40]
call fcn.14016823c
cmp eax, 0xffffffff
je 0x140014303
mov byte [rsp + r14 + 0x60], al
inc r14
cmp r15, r14
jne 0x140014239
lea r12, [rsp + 0x60]
mov byte [r12 - 1], 0xaa
lea r13, [rsp + 0x50]
mov qword [r13], rdi
lea rbp, [rsp + 0x48]
mov qword [rbp], rdi
mov edi, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r14d, dword [rdx]
movss xmm6, dword [rdx + 4]
lea r9, [rsp + r15]
add r9, 0x60
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x5f]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x60]
call qword [0x1401de008]
cmp eax, 1
jne 0x140014330
mov rax, qword [rsi + 0x50]
mov dword [rax], r14d
movss dword [rax + 4], xmm6
cmp r15, 8
je 0x140014308
mov rcx, qword [rsi + 0x40]
call fcn.14016823c
cmp eax, 0xffffffff
je 0x140014308
mov byte [rsp + r15 + 0x60], al
inc r15
jmp 0x14001427a
mov rdx, qword [rsi + 0x40]
movzx ebx, al
mov ecx, ebx
call fcn.14016f254
cmp eax, 0xffffffff
je 0x140014308
mov edi, ebx
jmp 0x140014308
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140148650
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 2
je 0x140014308
cmp eax, 3
jne 0x140014342
mov al, byte [rsp + 0x60]
mov byte [rsp + 0x5f], al
test bl, bl
je 0x140014350
movzx edi, byte [rsp + 0x5f]
mov dword [rsi + 0x5c], edi
jmp 0x140014308
mov ebx, r15d
test rbx, rbx
jle 0x140014372
mov rdx, qword [rsi + 0x40]
dec rbx
mov eax, ebx
movzx ecx, byte [rsp + rax + 0x60]
call fcn.14016f254
cmp eax, 0xffffffff
jne 0x140014353
jmp 0x140014308
movzx edi, byte [rsp + 0x5f]
jmp 0x140014308

Function at 0x140019e40
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140019e77
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x140019e51
ret
Function at 0x140019ef0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140019f28
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x140019f01
ret

Function at 0x14001b4f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14001b542
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x1401de008]
jmp 0x14001b63d
lea rbx, [rbp - 0x20]
mov rcx, r9
mov rdx, rbx
call fcn.140011786
lea rdx, [0x1401c9100]
mov rcx, rbx
call fcn.1400159ee
mov rbx, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14001b582
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1401de008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rbp - 0x20]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [r14], xmm0
mov rax, qword [rbx]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, rbx
mov rdx, r14
call qword [0x1401de008]
mov al, byte [r14]
lea rbx, [rbp - 0x1f]
mov r14, rbx
test al, 1
je 0x14001b5cd
mov r14, qword [rbp - 0x10]
test al, 1
jne 0x14001b5e0
shr al, 1
movzx eax, al
add rax, rbx
cmp r14, rax
jne 0x14001b5f0
jmp 0x14001b630
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
add rax, rcx
cmp r14, rax
je 0x14001b635
test rdi, rdi
je 0x14001b626
mov al, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14001b60e
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x14001b628
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x1401de008]
cmp eax, 0xffffffff
jne 0x14001b628
xor edi, edi
inc r14
mov al, byte [rbp - 0x20]
jmp 0x14001b5cd
mov qword [rsi], rdi
jmp 0x14001b63d
mov qword [rsi], rdi
call fcn.140148278
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x14001ba10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14001ba64
movzx edx, word [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov word [rsp + 0x20], dx
mov rdx, rsi
mov r8, rdi
call qword [0x1401de008]
jmp 0x14001bb6d
lea rbx, [rbp - 0x20]
mov rcx, r9
mov rdx, rbx
call fcn.140011786
lea rdx, [0x1401c9110]
mov rcx, rbx
call fcn.1400159ee
mov rbx, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14001baa4
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1401de008]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rbp - 0x20]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [r14], xmm0
mov rax, qword [rbx]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, rbx
mov rdx, r14
call qword [0x1401de008]
mov al, byte [r14]
lea rbx, [rbp - 0x1e]
mov r14, rbx
test al, 1
je 0x14001baef
mov r14, qword [rbp - 0x10]
test al, 1
jne 0x14001bb05
mov ecx, eax
and cl, 0xfe
movzx ecx, cl
add rcx, rbx
cmp r14, rcx
jne 0x14001bb16
jmp 0x14001bb60
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
lea rdx, [rcx + rdx*2]
cmp r14, rdx
je 0x14001bb65
test rdi, rdi
je 0x14001bb36
movzx eax, word [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14001bb3a
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
jmp 0x14001bb4f
xor edi, edi
jmp 0x14001bb5a
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x1401de008]
cmp ax, 0xffff
jne 0x14001bb57
xor edi, edi
mov al, byte [rbp - 0x20]
add r14, 2
jmp 0x14001baef
mov qword [rsi], rdi
jmp 0x14001bb6d
mov qword [rsi], rdi
call fcn.140148278
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1400287b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
call fcn.14002c8ee
mov ebp, eax
test rdi, rdi
je 0x1400287eb
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x140028800
movzx eax, word [rax]
jmp 0x140028810
xor r15d, r15d
mov eax, 6
test bpl, bpl
jne 0x14002889a
xor edi, edi
jmp 0x140028828
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1401de008]
xor r15d, r15d
cmp ax, 0xffff
sete cl
cmove rdi, r15
mov eax, 6
cmp bpl, cl
je 0x14002889a
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14002883a
movzx ebp, word [rax]
jmp 0x140028849
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1401de008]
mov ebp, eax
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov dx, 4
mov r8d, ebp
call qword [0x1401de008]
test al, al
je 0x140028892
mov rax, qword [rbx]
mov rax, qword [rax + 0x68]
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call qword [0x1401de008]
mov ebp, eax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400288ae
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x1400288bb
xor r15d, r15d
mov eax, 4
or dword [rsi], eax
mov eax, r15d
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1401de008]
mov r12d, dword [rsp + 0x80]
movsx r15d, bpl
mov rcx, r14
call fcn.14002c8ee
mov ebp, eax
test rdi, rdi
je 0x1400288e5
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x1400288e9
movzx eax, word [rax]
jmp 0x1400288f9
mov al, 1
jmp 0x140028902
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1401de008]
cmp ax, 0xffff
sete al
jne 0x140028904
xor edi, edi
add r15d, 0xffffffd0
cmp bpl, al
je 0x1400289aa
cmp r12d, 2
jl 0x1400289aa
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14002892d
movzx ebp, word [rax]
jmp 0x14002893c
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1401de008]
mov ebp, eax
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov dx, 4
mov r8d, ebp
call qword [0x1401de008]
test al, al
je 0x14002889c
mov rax, qword [rbx]
mov rax, qword [rax + 0x68]
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call qword [0x1401de008]
mov ebp, eax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x140028989
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x140028996
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1401de008]
lea eax, [r15 + r15*4]
movsx ecx, bpl
lea r15d, [rcx + rax*2]
dec r12d
jmp 0x1400288c7
mov rcx, r14
call fcn.14002c8ee
mov ebx, eax
test rdi, rdi
je 0x1400289c8
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x1400289da
movzx eax, word [rax]
jmp 0x1400289ea
mov eax, 2
test bl, bl
jne 0x14002889a
jmp 0x14002889c
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1401de008]
cmp ax, 0xffff
sete al
xor bl, al
mov eax, 2
je 0x14002889a
jmp 0x14002889c
Function at 0x1400308e0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140030907
mov r15, r12
jmp 0x140030a48
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140030969
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r15, rbx
sub r15, rax
mov r14, r12
sub r14, rbx
je 0x140030955
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.14014b1c0
mov r12, qword [rsi + 8]
add r15, r14
mov qword [rsi + 0x10], r15
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x140030a48
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x140030a94
lea rcx, [r13*8]
call fcn.140148228
mov rcx, r13
and rcx, 0xfffffffffffffffc
mov rdx, r12
sub rdx, rbx
mov r8, r12
lea rcx, [rax + rcx*2]
mov r15, rcx
sub r8, rbx
je 0x1400309ec
sar rdx, 3
lea r15, [r8 + rcx]
shl rdx, 3
xor r8d, r8d
nop word cs:[rax + rax]
mov r9, rcx
add r9, r8
je 0x140030a68
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x1400309d0
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
nop
cmp r12, rbx
je 0x140030a37
add r12, 0xfffffffffffffff8
jne 0x140030a00
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str.E:_nw82_sdk_win64_node_webkit_srcoutst_nw...._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.140005c64
test r14, r14
je 0x140030a48
mov rcx, r14
call fcn.140148278
mov r15, qword [rsi + 0x10]
test r15, r15
je 0x140030a68
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str.E:_nw82_sdk_win64_node_webkit_srcoutst_nw...._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.140005c64
call fcn.140001c85
int3
Function at 0x140030aa0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401c6b58]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rbx, [rcx + 8]
lea rax, [0x14018b790]
mov qword [rcx], rax
lea rax, [0x14018b7a0]
mov qword [rcx + 8], rax
mov eax, dword [0x1401ca5a0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rcx, [rax + 8]
mov qword [rsi + 0x10], rcx
mov rcx, qword [rax + 8]
mov qword [rax + 8], rsi
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x20], rdx
xorps xmm0, xmm0
movups xmmword [rsi + 0x28], xmm0
mov eax, dword [rdx + 0x33c]
mov dword [rsi + 0x38], eax
lea r14, [rsp + 0x60]
mov rcx, r14
call fcn.140048b00
mov rcx, r14
mov rdx, rsi
call fcn.140048b40
call fcn.140037320
mov r14, rax
call fcn.1400484a0
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140030b5b
mov rcx, qword [rsp + 0x48]
add rcx, 8
call fcn.14000d59c
mov r9, qword [rsp + 0x48]
lea r8, str.ThreadLocalEventBuffer
mov rcx, r14
mov rdx, rbx
call fcn.1400374b0
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rsp + 0x44], eax
lea rbx, [rdi + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x140030b94
mov rcx, rbx
call sub.KERNEL32.dll_AcquireSRWLockExclusive
call fcn.1400484a0
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140030bb4
mov rcx, qword [rsp + 0x38]
add rcx, 8
call fcn.14000d59c
add rdi, 0x2e0
lea r8, [rsp + 0x44]
mov qword [rsp + 0x50], r8
lea rax, [rsp + 0x5f]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x14018634b]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140034b80
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rdx, qword [rax + 0x18]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x60], rdx
test rdx, rdx
je 0x140030c1e
mov rcx, qword [rsp + 0x60]
lock dec dword [rcx + 8]
jne 0x140030c1e
call fcn.140048480
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140148650
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret