joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023f5d1
Capabilities:
Encode data using base64

Disassembly:
xor bp, r9w
adc rsi, rbx
movzx r9w, byte [rdi + rcx*4 - 0xe00c]
mov cl, byte [rdi + rdx + 0x6ddce0]
movzx ebx, dl
lea rbp, [r8 - 0x2dcf8e62]
add ax, word [rsp + rbp - 0x7f5f1c39]
lea rdi, [rdi + rbp - 0x7f5f1c38]
push rbp
jbe 0x1401538f0
shr r9b, cl
sub ax, ax
mov word [rbx + rdi - 0x22], r9w
jb 0x1401f1e07
mov qword [rsp + rdx + 0x6ddcde], rsi
ret 0x10
lea ebx, [rbx + r8*2 - 0x7623993c]
shl ebp, 0x84
dec qword [rsp + r8 - 0x1a3f37fc]
neg ebx
dec r9w
shr qword [rsp + r8 - 0x1a3f37fc], 0xee
lea ebx, [rbx + r8*2 - 0x1c7e2ee6]
xor r8d, 0xb7119298
ror byte [rsp + rbp - 0x76], 0x63
lea rbp, [rbp*4 + 0x738110a1]
ror ebx, 1
add qword [rsp + rcx - 0x37fb], r10
mov qword [rsp + rbp - 0x738112a1], rcx
lea r10, [rdx - 0x1164d7fb]
xor dword [rsp + rcx*2 - 0x6ffe], ebx
mov r10, qword [rsp + rcx*2 - 0x6ffe]
or dx, r8w
mov qword [rsp + rcx - 0x37fb], r9
imul qword [rsp + rbp - 0x7381129e]
movsxd rbx, ebx
or bp, ax
jne 0x1401eb538

Function at 0x14024cb6f
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rbp - 0x6cdc9f00], rdi
ret 8
lea rsi, [rsi + rax*2 + 0xc]
not rdx
btr r10w, 0x10
mov r9d, r10d
adc r10b, 0x2a
not rcx
or rdx, rcx
push r9
mov qword [rsi + rax*8 + 0x10], rdx
mov ecx, 0x6d082b81
call fcn.140230620
lea rcx, [rdx + rdx*8 + 0x7501be18]
lea rbp, [rax + rbp - 5]
and eax, eax
mov ecx, dword [rbp + rax - 1]
movzx esi, dil
xor ecx, r10d
mov ebx, eax
cqo
shl al, 0x41
sbb ecx, ebx
bts esi, 0xa
shl esi, 0x10
push rsi
neg ecx
add esi, 0x56a435be
call fcn.14014bb01
mov ecx, 0x4a1281b2
shr cl, 0x84
mov dx, word [r8 + rcx - 0x4a12810b]
movsx r9d, cx
push rcx
lea r8, [r8 + rcx - 0x4a128109]
lea r10, [r10 + rcx - 0x4a12810c]
movzx ebx, byte [r10 + rcx - 0x4a12810b]
movsx r11d, r9w
sub byte [rsp + rcx - 0x4a128104], r9b
jns 0x14015c476
xor bl, dil
ror bl, 1
movsx eax, r11b
inc bl
jmp 0x1402a3123

Function at 0x140252c91
Capabilities:
Encode data using base64

Disassembly:
sub cx, 0x799b
not cx
call fcn.1400eeef1
Function at 0x1402627b9
Capabilities:
Encode data using base64

Disassembly:
neg bpl
sub r8w, dx
sbb bpl, 0x1c
mov eax, 0xc831041e
ror bpl, 1
inc r11w
imul rax, rcx
neg r8w
not bpl
not dword [rsp + r11*4 - 0x1bc61]
mov qword [rsp + r11*4 - 0x1bc6c], r11
dec bpl
xor bl, bpl
xor r11w, si
lea rbp, [rsp + rbp + 0x10]
mov r11d, dword [rbp + r11*8 - 0x7f2b0]
not dword [rsp + rsi + 0x6ebe]
mov ebp, dword [rsp + rsi + 0x6eb9]
mul cx
lea r10, [r10 + rsi*8 + 0x37594]
mul esi
ror qword [rsp + rdx - 0x388b03bc], 0x73
or qword [rsp + rdx*2 - 0x71160788], rax
mov dword [r10 + rdx - 0x388b03c4], r11d
pop rcx
lea rdx, [rdx*2 - 0x7ddb8441]
and word [rsp + rdx*2 + 0x198af973], ax
pop rax
jae fcn.1401c1b7c
mov qword [rsp + rax*4 - 0x4868008c], r11
movsx r11d, dl
bt r8, r9
xor dword [rsp + rax - 0x121a0023], ecx
imul r9w
div rax
neg edx
pop r11
movsxd rcx, ecx
lea r10, [r9 + rbx*2 - 0x559048]
sub r10, r10
add r10d, ebx
adc rdi, rcx
mov rbx, qword [rbp + r8*2 - 0x55665e66]
shl r9w, 0xe4
rol r8, 0x3a
ror ax, 0xc1
lea rbp, [r9 + rbp - 0xc33f1c8]
btr r9, 0x2d
cdq
push rbx
popfq
movsx ecx, r8w
shl rax, cl
adc rdx, rdi
jmp rdx

Function at 0x140284f83
Capabilities:
Encode data using base64

Disassembly:
jb 0x1401a54ac
ror r11d, 1
call fcn.1401793dd

Function at 0x140288d9e
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
lea rax, [rsp + rax - 0x6d2258aa]
mov qword [rsp], 0x2c113a0a
push 0xffffffffa3006fbb
call fcn.140188019
mov rsi, qword [r8]
push 0x4380072b
mov rdx, qword [r8 + 8]
xor qword [rsp], 0xfffffffffaa5fdb3
call fcn.1401fcf10

Function at 0x140290d34
Capabilities:
Encode data using base64

Disassembly:
call fcn.1400c8df4
xor dword [rsp + rbp - 0x4385c145], ecx
pop rbx
dec r8
call fcn.1401cff45

Function at 0x14029624c
Capabilities:
Encode data using base64

Disassembly:
not r9b
or byte [rsp + r10*4 - 0xf6aa], 0x33
adc ax, 0x2b9e
bswap ebx
xor r11b, r9b
push r10
pop r8
lea r8, [rdx + rdx + 0x2b376510]
lea r9, [rsp + r9 + 8]
dec edx
pop rax
mov qword [r9 + rax*2 - 0x7fab00], rcx
inc r10d
shl r10d, 0xeb
and al, 0x15
mov ebx, dword [rsi + rax*2 - 0x7faa00]
lea rsi, [rax + rsi - 0x3fd4fc]
xor ebx, r11d
cqo
shl al, 0xe4
lea r10, [rax + rax + 0x29240ab5]
inc ebx
movsx ecx, al
cdq
and dl, ah
neg ebx
movsx r9d, cl
not ebx
mul eax
neg ebx
sub rcx, 0xffffffffd2b882bc
push r11
push r10
xor dword [rsp + r10*2 - 0x53476962], ebx
jmp 0x140112697
mov qword [rsp + rax*8 - 0x1ed58], r8
jmp 0x1402890ed
Function at 0x1402a0326
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Parse pe header

Disassembly:
movsxd rdx, edx
and r11w, r9w
adc r10, rdx
not r8
xadd ecx, ebx
cwde
jae fcn.1401c9c2e
mov r8d, dword [rdi]
mov ecx, 0xab13faa6
movsx edx, cl
movsx eax, dx
add rdi, 4
shl al, cl
movsx r11d, dl
xor r8d, ebx
lea rsi, [rax*4 - 0x3f6520ca]
not r8d
add r11w, ax
xor rdx, 0x128c50af
lea rbp, [rdx*2 + 0x1e2b1d8f]
rol r8d, 1
jmp 0x140150543
neg bl
sub bl, 0x21
bt r11, r11
setb cl
xor dil, bl
lea rbx, [rsp + rbx + 8]
or r11d, dword [rdx + rbx]
mov qword [rsp + rax - 0x30], rdx
add rdx, qword [rsp + rdx]
lea rsi, [rsi + rax*4 - 0xc4]
sub ax, cx
mov dword [rax + rsi - 0xca30], r11d
or edx, dword [rax + rbp - 0xca30]
not byte [rsp + rax*2 - 0x1945b]
neg ax
lea rbp, [rbp + rax*2 - 0x6b9c]
js 0x1400fc84e
shr r8w, 0xa2
neg cx
xor edx, edi
movsx r11d, al
not edx
lea r8, [r11*8 + 0x63f26b3]
sar r9b, 0x84
sbb r11d, eax
xor edx, 0xb2bfa1af
inc word [rsp + rax - 0x35ce]
dec edx
not edx
shl qword [rsp + rax*4 - 0xd740], 0xa7
movsx ebx, word [rsp + rax*2 - 0x6ba0]
ror edx, 2
bswap r11
not r9d
or r8w, 0x3829
mov qword [rsp + rax*2 - 0x6ba0], rdi
xor dword [rsp + rax - 0x35d0], edx
xor ax, ax
pop rdi
shr r11d, 0xab
setb r11b
jbe 0x14027fb90
Function at 0x140001610
Capabilities:
Read file on windows

Disassembly:
test r8d, r8d
jle 0x14000167e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov ebx, r8d
mov dword [rsp + 0x50], ebp
mov rdi, rdx
mov rsi, rcx
nop dword [rax + rax]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbp
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000166a
mov eax, dword [rsp + 0x50]
sub ebx, eax
add rdi, rax
test ebx, ebx
jg 0x140001640
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140001680
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xor r14d, r14d
mov ebp, r14d
mov dword [rax + 0x20], r14d
call fcn.14001508f
call fcn.140015089
call sub.LIBEAY32.dll_Ordinal_233
call sub.LIBEAY32.dll_Ordinal_246
call fcn.140015089
call sub.LIBEAY32.dll_Ordinal_510
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x1400016e1
xor eax, eax
jmp 0x1400018ad
cmp dword [rsp + 0x30], ebp
jne 0x1400016da
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
mov ebx, 2
lea rdi, [rsp + 0xa0]
mov dword [rsp + 0xa8], r14d
nop word [rax + rax]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xa8]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001740
mov eax, dword [rsp + 0xa8]
sub ebx, eax
add rdi, rax
test ebx, ebx
jg 0x140001710
movzx ecx, word [rsp + 0xa0]
call fcn.140040fc0
mov rbx, rax
movzx r8d, word [rsp + 0xa0]
mov rdx, rax
mov rcx, rsi
call fcn.140001610
xor ecx, ecx
call fcn.140043210
mov rcx, rax
call fcn.140040ff4
mov rax, qword [0x140078938]
test rax, rax
jne 0x1400017a8
lea ecx, [rax + 0x10]
call fcn.14001eac8
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x14000179e
mov rcx, rax
call fcn.140007e50
jmp 0x1400017a1
mov rax, r14
mov qword [0x140078938], rax
movzx r8d, word [rsp + 0xa0]
mov rdx, rbx
mov rcx, rax
call fcn.140008630
test al, al
je 0x1400016da
mov rbx, qword [0x1400788e8]
test rbx, rbx
jne 0x1400017fe
mov ecx, Ordinal_641
call fcn.14001eac8
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x1400017f4
mov rcx, rax
call fcn.140002fc0
mov rbx, rax
jmp 0x1400017f7
mov rbx, r14
mov qword [0x1400788e8], rbx
call fcn.1400015d0
mov rcx, rax
call fcn.140007ff0
test al, al
je 0x140001819
mov rcx, rbx
call fcn.140004980
jmp 0x140001884
mov qword [rsp + 0xa8], rbx
lea rax, [fcn.140004980]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400012d0
mov rbx, rax
mov ebp, 1
mov dword [rsp + 0xa8], ebp
cmp dword [rax + 8], 0
jne 0x140001860
mov ecx, ebp
call fcn.14001cb10
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14001bd74
test eax, eax
je 0x14000187d
mov ecx, eax
call fcn.14001cad4
mov qword [rbx], r14
mov dword [rbx + 8], r14d
test bpl, 1
je 0x1400018a0
cmp dword [rsp + 0x60], 0
je 0x1400018a0
call fcn.14004100c
int3
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400018a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000a1f0
Capabilities:
Initialize winsock library

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1f0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400724c8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
movzx esi, r8b
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov qword [rcx], rdx
xor edi, edi
mov qword [rcx + 0x80], rdi
mov qword [rcx + 0x88], send
mov byte [rcx + 0x70], dil
add rcx, 0x98
lea edx, [rdi + 2]
call fcn.14001c28c
nop
lea rcx, [rbx + 0xe8]
call fcn.14001c630
nop
lea rcx, [rbx + 0x138]
lea edx, [rdi + 2]
call fcn.14001c28c
nop
mov qword [rbx + 0x240], rdi
cmp byte [0x140078940], dil
jne 0x14000a29d
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [0x140078940], 1
mov ecx, 0x1000
call fcn.140040fc0
mov qword [rbx + 0x20], rax
mov ecx, 0x1000
call fcn.140040fc0
mov qword [rbx + 0x10], rax
mov ecx, 0x1000
call fcn.140040fc0
mov qword [rbx + 0x18], rax
mov ecx, 0x120
call fcn.14001eac8
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14000a2f1
mov r9, qword [rbx + 0x18]
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
mov rcx, rax
call fcn.14000a3a0
jmp 0x14000a2f4
mov rax, rdi
mov qword [rbx + 0x248], rax
mov ecx, 0x28
call fcn.14001eac8
mov qword [rsp + 0x20], rax
test sil, sil
je 0x14000a326
test rax, rax
je 0x14000a321
mov rdx, rbx
mov rcx, rax
call fcn.140014660
jmp 0x14000a324
mov rax, rdi
jmp 0x14000a33b
test rax, rax
je 0x14000a338
mov rdx, rbx
mov rcx, rax
call fcn.140014630
jmp 0x14000a33b
mov rax, rdi
mov qword [rbx + 0x250], rax
mov qword [rbx + 0x130], rdi
mov edx, edi
xchg byte [rbx + 8], dl
mov edx, edi
xchg byte [rbx + 9], dl
xchg qword [rbx + 0x68], rdi
xor edx, edx
mov r8d, 0xc0
lea rcx, [rbx + 0x188]
call fcn.14003e370
nop
mov rax, rbx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.14001eba0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400147c0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
mov rcx, qword [rcx + 0x20]
mov r8d, dword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, qword [rdi + 0x18]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov qword [rdi + 0x18], 0
test ebx, ebx
je 0x140014815
mov rcx, qword [rdi + 8]
lea rdx, [0x140056750]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14000c870
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140014b10
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jne 0x140014b4d
mov rcx, qword [rdi + 8]
lea rdx, [0x140056758]
call fcn.14000c850
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ebx, 0xffffffff
jg 0x140014b64
mov rcx, qword [rdi + 8]
lea rdx, [0x140055078]
call fcn.14000c870
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140014bd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rsi, rdx
or rbx, 0xffffffffffffffff
mov rbp, rcx
inc rbx
cmp byte [rdx + rbx], dil
jne 0x140014bf0
test ebx, ebx
je 0x140014c24
nop dword [rax]
mov rcx, qword [rbp + 0x20]
mov r8d, ebx
movsxd rdx, edi
sub r8d, edi
add rdx, rsi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140014c3b
add edi, eax
cmp edi, ebx
jne 0x140014c00
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbp + 8]
lea rdx, [0x140055078]
call fcn.14000c870
xor al, al
jmp 0x140014c26
Function at 0x14001bc30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pshufd xmm0, xmmword [rcx], 0x55
mov r11, rsp
pshufd xmm1, xmmword [rcx], 0xff
lea rcx, str.cw
movd dword [rsp + 0x18], xmm0
movd dword [rsp + 0x10], xmm1
movzx eax, byte [r11 + 0x18]
movzx r8d, dl
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x18], al
movzx eax, byte [r11 + 0x19]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x19], al
movzx eax, byte [r11 + 0x1a]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x1a], al
movzx eax, byte [r11 + 0x1b]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x1b], al
movzx eax, byte [r11 + 0x10]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x10], al
movzx eax, byte [r11 + 0x11]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x11], al
movzx eax, byte [r11 + 0x12]
movzx eax, byte [rax + rcx]
mov byte [rsp + 0x12], al
movzx eax, byte [r11 + 0x13]
movzx eax, byte [rax + rcx]
mov ecx, dword [rsp + 0x18]
mov byte [rsp + 0x13], al
mov eax, ecx
mov r9d, dword [r11 + 0x10]
mov edx, r9d
ror edx, 8
ror eax, 8
xor edx, r8d
xor eax, r8d
movd xmm0, ecx
movd xmm1, r9d
punpckldq xmm0, xmm1
movd xmm2, edx
movd xmm3, eax
punpckldq xmm3, xmm2
punpckldq xmm0, xmm3
ret

Function at 0x14001f544
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140022874
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140022887
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140022ea4
lea rdx, [0x14006fee0]
lea rcx, [rsp + 0x20]
call fcn.14003e5d8
int3

Function at 0x14002d38c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140079724]
xor edx, edx
jmp fcn.140022874

Function at 0x14002dd4c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140079724]
jmp fcn.140022874

Function at 0x14003ee50
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x14005dbd8]
xor ecx, ecx
lea r8, [0x14005dbd0]
lea rdx, str.FlsAlloc
call fcn.14003ec78
mov rbx, rax
test rax, rax
je 0x14003ee90
mov rcx, rax
call fcn.14001f7e0
mov rcx, rdi
call rbx
jmp 0x14003ee96
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003eef8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x14005dbe8]
mov ecx, 2
lea r8, [0x14005dbe0]
lea rdx, str.FlsGetValue
call fcn.14003ec78
mov rdi, rax
test rax, rax
je 0x14003ef39
mov rcx, rax
call fcn.14001f7e0
mov ecx, ebx
call rdi
jmp 0x14003ef41
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003ef4c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x14005dbf0]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x14005dbe8]
call fcn.14003ec78
mov rsi, rax
test rax, rax
je 0x14003ef98
mov rcx, rax
call fcn.14001f7e0
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x14003efa3
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140043878
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14004364c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004364c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004364c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004364c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004364c
cmp dword [rcx + 0x84], 0xe
jbe 0x14004364c
cmp dword [rcx + 0xf8], esi
je 0x14004364c
mov ecx, r14d
call fcn.140043794
mov ecx, 2
call fcn.140044630
nop
cmp byte [0x1400799d0], 0
jne 0x140043716
mov r15d, 1
mov eax, r15d
xchg dword [0x1400799c0], eax
test ebx, ebx
jne 0x1400436bf
mov rdi, qword [0x1400724c8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400799c8]
cmp rcx, rax
je 0x1400436b6
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14001fc20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140079d88]
jmp 0x1400436cb
cmp ebx, r15d
jne 0x1400436d1
lea rcx, [0x140079da0]
call fcn.140045658
nop
test ebx, ebx
jne 0x1400436e8
lea rdx, [0x140052618]
lea rcx, [0x1400525f0]
call fcn.140045058
lea rdx, [0x140052628]
lea rcx, [0x140052620]
call fcn.140045058
movzx eax, byte [0x1400799d0]
test esi, esi
cmove eax, r15d
mov byte [0x1400799d0], al
jmp 0x140043716
mov ecx, 2
call fcn.140044684
test esi, esi
jne 0x14004372d
mov ecx, r14d
call fcn.140043748
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400435dc
Function at 0x1400895a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400895cd
xor al, al
jmp 0x14008972f
mov rax, qword [0x1400a86c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400a86c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400a86d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400a86d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400a86e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400a86e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400a86f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400a86f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400a8700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140089721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140089679
mov r11d, 2
jmp 0x14008969d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140089693
mov r11d, 1
jmp 0x14008969d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140089745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400896e2
mov byte [rcx + 2], reloc.SSLEAY32.dll_Ordinal_61
add rcx, 3
add r8, 3
jmp 0x1400896fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14008970a
mov byte [rcx], reloc.SSLEAY32.dll_Ordinal_61
inc rcx
inc r8
jmp 0x140089718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140089660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14008972a
Function at 0x1403524e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bts rbx, r9
and bx, 0x155a
mov qword [rsp + 0x10], rbp
sub bp, ax
mov qword [rsp + 0x18], rsi
sub bpl, 0x99
sete bpl
push rdi
sbb bpl, 0x49
cmp dh, 0xa3
sub rsp, 0x20
movzx rdi, di
adc bx, 0x7e7f
movzx edi, r12w
mov rbp, r8
inc di
xor bl, 0xf
mov rdi, rdx
clc
mov rbx, rcx
nop
sar dl, 0xbe
adc dh, 0x73
add dh, 0x5a
cmp dword [rbx + 0x44], 0
movzx edx, bx
movsx rdx, bx
mov rdx, rdi
jmp 0x140352550
jne 0x140352586
mov r8d, dword [rbx + 0xc]
btc ecx, r11d
or cl, r12b
mov rcx, qword [rbx + 0x30]
mov rax, rdi
sub r8d, dword [rbx + 0x40]
sub rax, rcx
test di, 0x4dd4
cmp rax, r8
jbe 0x140352586
lea rdx, [r8 + rcx]
cmovne r8w, r8w
mov r8, rbp
mov rcx, rbx
call fcn.14034f2fd
test eax, eax
jmp 0x140352598
jne 0x140352733
cmp dword [rbx + 0x44], eax
jmp 0x1403525a6
jne 0x1403525c5
mov eax, dword [rbx + 0xc]
jmp 0x1403525b4
cmp dword [rbx + 0x40], eax
jmp 0x1403525bc
jb 0x1403525c5
mov dword [rbx + 0x44], eax
mov r9d, dword [rbx + 0x5c]
test r15b, 0x22
test r9d, r9d
jmp 0x1403525d5
je 0x1403526f2
cmp r9d, 0x112
jae 0x1403526f2
mov rdx, qword [rbx + 0x30]
add sil, 0xea
add sil, bpl
mov r10, qword [rbx + 0x18]
mov rsi, qword [rbx + 0x38]
and cx, r15w
add r11w, r15w
bt cx, si
mov r11d, dword [rbx + 0x4c]
shl r8b, 0x5a
and cl, r9b
movzx cx, ch
mov rcx, rdi
or r8w, 0x77a2
bsr r8, rsi
mov r8d, r9d
cmc
cmp edx, r15d
sub rcx, rdx
cmp rcx, r9
jmp 0x140352635
cmovb r8d, ecx
cmp dword [rbx + 0x44], 0
jmp 0x140352642
jne 0x140352668
mov ecx, dword [rbx + 0xc]
mov eax, ecx
clc
test r15b, r8b
sub eax, dword [rbx + 0x40]
cmp eax, r8d
jmp 0x14035265c
ja 0x140352668
mov dword [rbx + 0x44], ecx
test ah, 0xac
add dword [rbx + 0x40], r8d
jmp 0x140352671
sub r9d, r8d
cmc
cmp r14d, 0x6ab56d8a
stc
mov dword [rbx + 0x5c], r9d
cmc
cmp cl, dh
test r8d, r8d
jmp 0x14035268c
je 0x1403526ed
nop
cmp spl, r8b
sub eax, eax
cmp rbx, 0x3ca502c4
cmp rdx, r11
jmp 0x1403526a7
cmovb rax, rsi
cmp r9w, r12w
cmp r8d, 0x17a75273
sub rax, r11
jmp 0x1403526c3
add rax, rdx
jmp 0x1403526cb
inc rdx
stc
add r8d, 0xffffffff
movzx eax, byte [rax + r10]
jmp 0x1403526dd
mov byte [rdx + r10 - 1], al
jmp 0x1403526e7
jne 0x140352696
mov qword [rbx + 0x30], rdx
clc
cmp qword [rbx + 0x30], rdi
jmp 0x1403526fb
jae 0x14035271d
cmp qword [rbx + 0x20], rbp
jmp 0x14035270a
jae 0x14035271d
cmp dword [rbx + 0x5c], 0x112
jb 0x14035253d
cmp dword [rbx + 0x5c], 0x112
jbe 0x140352731
mov dword [rbx + 0x5c], 0x112
xor eax, eax
mov rbx, qword [rsp + 0x30]
rcr sil, 0x54
bsr ebp, ecx
mov rbp, qword [rsp + 0x38]
sub esi, 0x54e82eb7
test r9b, r11b
add di, r9w
mov rsi, qword [rsp + 0x40]
cmc
add rsp, 0x20
mov dil, 0xc0
movzx di, r15b
setne dil
pop rdi
jmp 0x14035276d
ret
Function at 0x140358c15
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x1403572fa