joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ac60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x46add7
movzx edx, byte [rax]
test edx, edx
jne 0x46ac94
nop dword [rax]
test r8b, r8b
jne 0x46ac94
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x46aca7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x46ad97
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x46ad85
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x46ad77
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x46acfd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x46ad40
mov eax, 1
cmp rax, rbx
ja 0x46ad2b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x46ad6f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x46ad33
mov rcx, r11
mov eax, r12d
jmp 0x46ad02
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x46adcd
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x46ad90
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46acad
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3

Function at 0x46c5a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c64f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00639570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers
Function at 0x46faa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00639329], 0
je 0x46faae
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x46fac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00639329], 0
je 0x46fad5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x46fae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00639329], 0
je 0x46fb15
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00639a00]
aesenc xmm0, xmmword [0x00639a10]
aesenc xmm0, xmmword [0x00639a20]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x46fb20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00639329], 0
je 0x46fb56
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00639a00]
aesenc xmm0, xmmword [0x00639a10]
aesenc xmm0, xmmword [0x00639a20]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x471200
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x00639570]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x47129b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret
Function at 0x4714c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x00639570]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x471557
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret

Function at 0x471920
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x471954
mov rcx, 0x28
jmp 0x47195f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00639570], rcx
pop rbp
ret

Function at 0x47c1c0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47c8ff
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x47c1ed
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x47c471
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x47c49d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005421e0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004e8ac0]
lea rbx, [0x0053ff30]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x47c4c2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x47c4f7
lea rdi, [0x004e8b40]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x47c1e3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x47c4db
jmp 0x47c4b0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash
Function at 0x47caa0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x47cab7
inc rax
cmp rax, 4
jge 0x47cacf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x47cab4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x47cae0
inc rax
cmp rax, 4
jge 0x47caee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x47cb17
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x47cafb
jmp 0x47cadd
Function at 0x4826e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4827aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00639570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48278f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004e8bc0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x48277e
mov edi, 1
lea rsi, [0x004e8bc0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00540098]
lea rsi, [0x0053f940]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x49a220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a2cc
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00639570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x49a293
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call sym.runtime.stringtoslicebyte
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x49a2a6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x49a2b9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x49a2a3
mov byte [rax + rcx], dl
jmp 0x49a2a3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call sym.runtime.slicebytetostring
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp sym.internal_filepathlite.replaceStringByte
Function at 0x4bbec0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bbffe
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x005eb900]
call sym.internal_godebug._Setting_.Value
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
lea rcx, [sym.net.goDebugNetDNS.func1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00639570]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4bbfc2
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4bbff8
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
nop dword [rax]
cmp rbx, rcx
jb 0x4bbfed
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAlen
nop
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.net.goDebugNetDNS
Function at 0x140001820
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400079a0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400079a0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x140001890
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x14000c0c4]
mov r12, rcx
test ebx, ebx
jle 0x1400019c0
mov rax, qword [0x14000c0c8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x1400018dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001963
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x1400018c0
mov rcx, r12
call fcn.140002230
mov rsi, rax
test rax, rax
je 0x1400019e2
mov rax, qword [0x14000c0c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.140002360
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x14000c0c8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400019c7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000195c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001970
add dword [0x14000c0c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x14000c0c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000195c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001820
nop dword [rax]
xor ebx, ebx
jmp 0x1400018e7
mov rax, qword [0x14000c0c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001820
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140001820
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001ea0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x14000c120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000c100]
test rbx, rbx
je 0x140001ef4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140001eeb
test r12, r12
je 0x140001eeb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001ed0
lea rcx, [0x14000c120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002230
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400098c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002250
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002258
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002250
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400022a5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000229c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002250
add rax, 0x28
cmp rax, r9
jne 0x140002288
xor eax, eax
ret

Function at 0x1400022b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400098c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400022d0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400022d8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400022d0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x140002360
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400098c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002380
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002388
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140007c20
Capabilities:
Encode data using base64 via winapi

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
lea rsi, [0x1400090b0]
lea rbp, str.x_02x
call fcn.140001600
lea rdi, [rsp + 0x40]
mov ecx, 0x27
lea r12, [rsp + 0x40]
rep movsq qword [rdi], qword [rsi]
lea rcx, str.original:_n
mov dword [rsp + 0x3c], 0
mov rbx, r12
movzx eax, word [rsi]
mov rsi, r12
mov word [rdi], ax
lea rdi, [rsp + 0x179]
call fcn.140007bd0
nop dword [rax]
movzx edx, byte [rsi]
mov rcx, rbp
add rsi, 1
call fcn.140007bd0
cmp rsi, rdi
jne 0x140007c80
lea rcx, [0x140009012]
lea rsi, str.x_02x
call fcn.140007bd0
mov r9d, 0x11
mov edx, 0x139
mov rcx, r12
lea r8, str.mysupersecretkey
call fcn.140007b80
lea rcx, str.xored:_n
call fcn.140007bd0
nop dword [rax]
movzx edx, byte [rbx]
mov rcx, rsi
add rbx, 1
call fcn.140007bd0
cmp rbx, rdi
jne 0x140007cd0
lea rcx, [0x140009012]
lea rsi, [rsp + 0x3c]
call fcn.140007bd0
xor r9d, r9d
mov edx, 0x139
mov rcx, r12
mov r8d, 0x40000001
mov qword [rsp + 0x20], rsi
mov rbx, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rbx
mov ecx, dword [rsp + 0x3c]
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x140007d7d
mov qword [rsp + 0x20], rsi
mov r9, rax
mov edx, 0x139
mov rcx, r12
mov r8d, 0x40000001
call rbx
test eax, eax
je 0x140007d6a
mov rdx, r13
lea rcx, str.base64_encoded_shellcode:_n_s_n
call fcn.140007bd0
mov rcx, r13
call sub.msvcrt.dll_free
xor eax, eax
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.error:_failed_to_base64_encode_shellcode._n
call fcn.140007bd0
mov eax, 1
jmp 0x140007d5a
lea rcx, str.error:_failed_to_allocate_memory_for_base64_encoded_shellcode._n
call fcn.140007bd0
mov eax, 1
jmp 0x140007d5a
Function at 0x140003b00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rax, qword [0x140044038]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov dil, dl
movzx ebx, cl
call fcn.140011088
test al, al
je 0x140003c98
lea rdx, str.RarExtPackage.msix
lea rcx, [rbp - 0x19]
call fcn.140001b9c
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000ab00
nop
lea rcx, [rbp - 0x19]
call fcn.140002050
lea rcx, [rbp + 7]
call fcn.1400085e0
test al, al
je 0x140003c8f
lea rdx, str.RarExtInstaller.exe
lea rcx, [rbp - 0x19]
call fcn.140001b9c
nop
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.14000ab00
nop
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.140006a24
nop
lea rcx, [rbp + 0x27]
call fcn.140002050
nop
lea rcx, [rbp - 0x19]
call fcn.140002050
lea rcx, [rbp + 7]
call fcn.1400085e0
test al, al
je 0x140003c8f
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1400164a0
mov dword [rsp + 0x20], 0x70
test bl, bl
jne 0x140003be2
or dword [rsp + 0x24], 0x40
lea rcx, [rbp + 7]
call fcn.1400018c0
mov qword [rbp - 0x71], rax
lea rax, str._install__extall
lea rcx, str._install
test dil, dil
cmovne rcx, rax
lea rax, str._Uninstall
test bl, bl
cmovne rax, rcx
mov qword [rbp - 0x69], rax
mov dword [rbp - 0x59], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140003c48
test bl, bl
jne 0x140003c48
mov edx, 0x4e20
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.NewContextMenu
lea rcx, [rbp + 0x27]
call fcn.140001b9c
nop
lea rdx, str.Setup
lea rcx, [rbp - 0x19]
call fcn.140001b9c
nop
mov r8d, ebx
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
call fcn.140010440
nop
lea rcx, [rbp - 0x19]
call fcn.140002050
nop
lea rcx, [rbp + 0x27]
call fcn.140002050
nop
lea rcx, [rbp + 7]
call fcn.140002050
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400143d0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x1400061b4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140044038]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
lea rax, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov ebx, eax
lea rax, str.unknown_folder
test ebx, ebx
cmovne rdx, rax
call fcn.1400011f8
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400143d0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret

Function at 0x140006230
Capabilities:
Get common file path

Disassembly:
mov edx, 0x10
jmp fcn.1400061b4