joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create thread
Extract resource via kernel32 functions
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ecx, ecx
mov dword [rsp + 0x40], 0
mov edx, 0xc8
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, eax
mov r9d, 4
mov r8d, 0x3000
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rdi
lea rdx, str.shellcodePayload_addr
lea rcx, [0x14001d018]
mov rsi, rax
call fcn.140001120
mov r8, rsi
lea rdx, str.alloc_mem_addr
lea rcx, str.__20s_:_0x__016p_n
call fcn.140001120
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.140001bf0
lea r9, [rsp + 0x40]
mov r8d, 0x20
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str._nPress_Enter_to_Create_Thread__n
mov ebx, eax
call fcn.140001120
call fcn.140002d8c
test ebx, ebx
je 0x1400010fe
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400050ec
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140004f18
Function at 0x1400140e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140014103
mov dword [rsp + 0x20], 1
jmp 0x14001410b
mov dword [rsp + 0x20], 0
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140014120
Capabilities:
Query environment variable

Disassembly:
push rdi
mov eax, 0x2380
call fcn.1400267c0
sub rsp, rax
mov qword [rsp + 0x180], 0xfffffffffffffffe
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x2370], rax
mov eax, 8
imul rax, rax, 0
lea rcx, str.CWindowsUtil::ReplaceAccEnvironmentVariablePath
mov qword [rsp + rax + 0x4c8], rcx
mov word [rsp + 0x30], 4
mov word [rsp + 0x28], 1
lea rax, [rsp + 0x4c8]
mov qword [rsp + 0x20], rax
lea r9, [0x140028570]
mov r8d, 0x31
lea rdx, str.E:_agent_work2_sSourceIncludeWindowsUtil.h
lea rcx, [0x1400285f0]
call fcn.1400201f0

Function at 0x140015f00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, 0x2b
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add rsp, 0x28
ret

Function at 0x140016a60
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x730
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x720], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x140029af0]
mov qword [rsp + rax + 0xe0], rcx
mov word [rsp + 0x30], 3
mov word [rsp + 0x28], 1
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400298e8]
mov r8d, 0xc7
lea rdx, [0x140029b20]
lea rcx, [0x140029b60]
call fcn.1400201f0
lea rax, [rsp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
xor edx, edx
lea rcx, [rsp + 0x110]
call fcn.140016180
lea rax, [rsp + 0x320]
mov rdi, rax
xor eax, eax
mov ecx, 0x200
rep stosb byte [rdi], al
lea rax, [rsp + 0x320]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [0x1400299c8]
mov r8d, 0xff
mov edx, 0x100
lea rcx, [rsp + 0x320]
add byte [rax], al

Function at 0x14001b750
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
add rsp, 0x38
ret

Function at 0x14001b7a0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret
Function at 0x140020720
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xe0], 0
jne 0x140020793
mov word [rsp + 0x30], 1
mov word [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str.pbRandomData__NULL
mov r8d, 0x152
lea rdx, [0x140032ac8]
lea rcx, [0x140032af0]
call fcn.1400201f0
mov eax, 1
jmp 0x1400209a3
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 6
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x140020845
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x140032b40]
mov edx, 0xb
lea rcx, [rsp + 0x80]
call fcn.14001a9c0
mov eax, 8
imul rax, rax, 0
lea rcx, [rsp + 0x80]
mov qword [rsp + rax + 0x70], rcx
mov word [rsp + 0x30], 1
mov word [rsp + 0x28], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, str.::CryptAcquireContext_failed.__1
mov r8d, 0x160
lea rdx, [0x140032b98]
lea rcx, [0x140032bc0]
call fcn.1400201f0
cmp dword [rsp + 0x40], 0
je 0x14002097b
cmp qword [rsp + 0xd0], 0
je 0x1400208e6
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
inc qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
cmp word [rax + rcx*2], 0
jne 0x140020875
mov rax, qword [rsp + 0x50]
shl rax, 1
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0xd8], eax
jbe 0x1400208ae
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x48], eax
jmp 0x1400208b9
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0xd8]
mov r9d, eax
mov r8, qword [rsp + 0xd0]
mov edx, ecx
mov rcx, qword [rsp + 0xe0]
call fcn.140020460
mov r8, qword [rsp + 0xe0]
mov edx, dword [rsp + 0xd8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
jne 0x14002097b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [0x140032c10]
mov edx, 0xb
lea rcx, [rsp + 0x98]
call fcn.14001a9c0
mov eax, 8
imul rax, rax, 0
lea rcx, [rsp + 0x98]
mov qword [rsp + rax + 0x78], rcx
mov word [rsp + 0x30], 1
mov word [rsp + 0x28], 1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, str.::CryptGenRandom_failed.__1
mov r8d, 0x172
lea rdx, str.HashGenerator.cpp
lea rcx, [0x140032c80]
call fcn.1400201f0
cmp dword [rsp + 0x40], 0
je 0x14002098a
mov dword [rsp + 0x4c], 0
cmp qword [rsp + 0x68], 0
je 0x14002099f
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400257c0
add rsp, 0xc8
ret
Function at 0x140022dd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x40], 1
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
jne 0x140022e4f
mov word [rsp + 0x30], 1
mov word [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [0x140038e90]
mov r8d, 0x57c
lea rdx, [0x140038e18]
lea rcx, [0x140038eb0]
call fcn.1400201f0
mov eax, 6
jmp 0x140022f17
mov dword [rsp + 0x44], 3
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x140022ed0
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov r9d, dword [rsp + 0x40]
lea r8, [0x140038efc]
mov edx, 0xc
lea rcx, [rsp + 0x48]
call fcn.14001a9c0
mov eax, 6
jmp 0x140022f17
cmp dword [rsp + 0x44], 1
je 0x140022f15
mov word [rsp + 0x30], 2
mov word [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [0x140038f08]
mov r8d, 0x58a
lea rdx, [0x140038f30]
lea rcx, [0x140038f80]
call fcn.1400201f0
mov eax, 6
jmp 0x140022f17
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400257c0
add rsp, 0x70
pop rdi
ret

Function at 0x140023160
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x108
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x44], 0
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
Function at 0x140023970
Capabilities:
Query service status

Disassembly:
push rdi
sub rsp, 0x80
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0
mov r8d, 1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140023a2f
mov r8d, 4
lea rdx, str.AccLogService
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x34], eax
cmp qword [rsp + 0x38], 0
je 0x140023a24
cmp dword [rsp + 0x34], 0x424
je 0x140023a24
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rsp + 0x54], 4
jne 0x140023a3e
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400257c0
add rsp, 0x80
pop rdi
ret
Function at 0x140025a80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x24243ba3
jmp 0x14000969e
dec rcx
jmp 0x1400097f4
jne 0x14000969e
jmp 0x14000a3e6
jmp 0x14000a6e1
jmp 0x14000a74d
jmp 0x14000a7a6
jmp 0x14000a7e8
jmp 0x14000a826
jmp 0x14000a86c
jmp 0x14000a8f2
jmp 0x14000a939
jmp 0x14000a967
jmp 0x14000a9e5
jmp 0x14000aa0a
jmp 0x14000aa86
jmp 0x14000aa9d
jmp 0x14000aaf3
jmp 0x14000ab51
jmp 0x14000abca
jmp 0x14000ac0b
jmp 0x14000ac6b
jmp 0x14000acc8
jmp 0x14000acf2
xor rcx, rcx
mov rdx, 0x8487
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call 0x14000ad12
pop rsi
add rsi, 0xe67
mov rdi, rax
mov rcx, 0x8487
rep movsb byte [rdi], byte [rsi]
jmp rax
sub rsp, 0x28
call fcn.14002609c
add rsp, 0x28
xor rcx, rcx
jmp 0x140008885
invalid
Function at 0x1000f5f74
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebp, dword [rsp + 0xa0]
mov r15, r8
mov r13d, edx
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
cmp dword [rsp + 0xa0], 0xffffffff
je 0x1000f5fc9
cmp dword [rsp + 0xa0], 0
je 0x1000f5fc9
mov ebp, dword [rsp + 0xa0]
sub ebp, ebx
mov r9d, ebp
xor r8d, r8d
mov rdx, r15
mov ecx, r13d
mov dword [rsp + 0x20], 0x4ff
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp eax, r13d
jne 0x1000f6022
mov ebx, 1
jmp 0x1000f6007
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1000f5ff1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, r12d
cmp r12d, eax
jbe 0x1000f6034
dec ebx
cmp edi, r13d
je 0x1000f5fac
mov rcx, qword [0x100153eb8]
lea rax, [0x100153eb8]
cmp rcx, rax
je 0x1000f6072
test byte [rcx + 0x1c], 4
je 0x1000f6072
mov rcx, qword [rcx + 0x10]
lea r8, [0x10001dbe8]
mov edx, 0x54
mov r9, r14
mov dword [rsp + 0x20], ebx
call fcn.10003b678
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x140001000
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x48
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.What_do_you_want_to_do___n
call fcn.1400010f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.1._Find_the_CS2_Config_folder_location__n
call fcn.1400010f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.2._Find_CS2_Demo_location__n
call fcn.1400010f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rsp + 0x30]
xor ecx, ecx
cmp eax, 1
jne 0x14000108b
mov dword [rsp + 0x28], eax
lea r8, str.C:Program_Files__x86_Steam_steamappscommonCounter_Strike_Global_Offensivegamecsgocfg
xor r9d, r9d
mov qword [rsp + 0x20], rcx
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400010d4
cmp eax, 2
jne 0x1400010ba
mov dword [rsp + 0x28], 1
lea r8, str.C:Program_Files__x86_Steam_steamappscommonCounter_Strike_Global_Offensivegamecsgo
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1400010d4
mov r9d, 0x10
lea r8, str.Stupid_BITCH
lea rdx, str.YOU_ARE_SOMEHOW_RETARDED
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001350
add rsp, 0x48
ret

Function at 0x140001c18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c62
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c64
xor al, al
add rsp, 0x28
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add byte [rbp + 0x11], dh
add byte [rax], al
jne case.0x14000727a.1
add byte [rax], al
jne 0x14003f638
add byte [rax], al
jne 0x14003f63c
add byte [rax], al
jne 0x14003f640
add byte [rax], al
jne 0x14003f644
add byte [rax], al
jne 0x14003f648
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f64c
add byte [rbp + 0x11], dh
add byte [rax], al
jne case.0x14000727a.2
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f654
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f658
add byte [rbp + 0x11], dh
add bh, bh
invalid
invalid
invalid
invalid
invalid
invalid
inc dword [rax]
invalid
invalid
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6a0
add byte [rax], al
jne 0x14003f6a4
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6a8
add byte [rax], al
jne 0x14003f6ac
add byte [rax], al
jne case.0x140007391.0
add byte [rax], al
jne 0x14003f6b4
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6b8
invalid
add byte [rbp + 0x11], dh
adc dword [rax], eax
add byte [rax], al
jne 0x14003f6bc
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6c0
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6c4
invalid
add byte [rbp + 0x11], dh
adc dword [rax], eax
add byte [rax], al
jne 0x14003f6c8
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6cc
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6d0
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6d4
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6d8
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6dc
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6e0
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6e4
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6e8
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6ec
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6f0
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6f4
add byte [rbp + 0x11], dh
add byte [rax], al
jne 0x14003f6f8
add byte [rbp + 0x11], dh
add dword [rax], eax
ja 0x14003f6fc
add byte [rdi + 0x11], dh
add al, byte [rax]
je 0x14003f701
add byte [rdx + rdx + 4], dh
add al, 1
pop rbp
or eax, 0x4600249
add dword [rbp + 0xd], ebx
add spl, byte [r8 + 4]
add ah, byte [rax + 4]
mov byte [rax], 0x92
or edi, edi
add byte [rdx - 0x41fb00f7], dl
add al, 0xbe
invalid
sar dword [rbx], cl
jmp [rcx]
Function at 0xb52c0f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea r10, [r10*8 + 0x728ebf93]
pop r11
mov rbp, qword [rbp + riz - 8]
movzx r9d, r10w
mov qword [rbp + r9*2 - 0x1e676], rax
mov r11d, 0xae10738e
not r10b
not r10
mov r9, rbp
push r10
bswap r11
movzx ebp, r11b
mov rbp, qword [rsp + rbp*2 + 8]
mov r10, qword [rsp + 0x10]
pop r11
jmp 0x1695748
mov r11, qword [rsp + 0x10]
lea rsp, [rsp + 0x18]
jmp fcn.01685cbe

Function at 0xb55014
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg dx
rol dx, 1
jmp 0xb552a1

Function at 0xb55024
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sub rsp, 0x18
push 0xffffffffc432d42d
lea rsp, [rsp + 8]
call rax
mov r9d, 0x740e9e2a
mov rsp, qword [rbp + r9 - 0x740e9e3a]
mov r11d, 0x1ca6d6aa
call fcn.016777d3

Function at 0xb55878
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
xor ecx, 0x4f8dea06
dec r8
jmp 0x16775a4
movzx r9d, byte [rdx]
xor r9d, ecx
call fcn.01699bc9
lea ecx, [rcx - 0x7f]
adc r9, 8
add rax, rdx
invalid
invalid
pop r9
push 0x4a1bc435
jmp 0xb54c01
lea rsp, [rsp + 0x30]
jne 0xb5ab4d
jmp 0xb5b332

Function at 0xb55d9b
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0xb645e5
lea rsp, [rsp + 8]
jmp fcn.01685cbe

Function at 0xb56636
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0x28217bba
mov dword [r9], ecx
call fcn.0167656b
cmp r9d, edx

Function at 0xb58937
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec rsi
call fcn.0169dac7
xor al, 0xb5
not al
mov qword [rsp], 0xffffffffad929ca4
rol qword [rsp + 8], 0x77
push 0xffffffffc1911fa4
xor bpl, al
lea rax, [rsp + rax + 0x18]
jmp 0xb6139b
jmp 0xb6b96b
lea rsp, [rsp + 0x20]
jmp fcn.01685cbe
not qword [rsp + 0xb]
mov qword [rax], r8
push 0xffffffffe09eb086
jmp 0xb6a52b

Function at 0xb59730
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea rsp, [rsp + 0x18]
jmp fcn.01685cbe

Function at 0xb5996d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0xffffffffd21d3781
lea rsp, [rsp + 0x10]
jmp fcn.0166c840

Function at 0xb5b1b9
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov qword [r9], rdx
not word [rsp + 0x1c]
call fcn.00b6b8a1
mov dword [r9], ebx
push 0xffffffff9ca0ea8f
jmp 0x169b38d
ror dword [rsp + 0xb], 0x47
sbb r9, 8
push 0xffffffffaf8da98c
not word [rsp + 0x1d]
jmp 0xb5b1ac
xor bpl, dl
not word [rsp + 8]
jmp 0x168f73f
lea rsp, [rsp + 0x28]
jmp fcn.0166c840

Function at 0xb5c37d
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not ecx
mov dword [r9], ecx
jmp 0x17051ce
lea rsp, [rsp + 0x10]
jmp fcn.01685cbe
jmp 0xb6889f

Function at 0xb5c610
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
js 0x16824fa
lahf
invalid
lea rsp, [rsp + 0x38]
jno fcn.01685cbe