joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a38ce
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400e9bd0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14026a187]
call fcn.1400a44e0
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400a38e2
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400ea190
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x14026a187]
call fcn.1400a44e0
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1401f1e00]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1400ea2d5
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1400ea229
mov dword [rbp + 0x160], 1
jmp 0x1400ea233
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1400ea2d0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1400ea2aa
cmp qword [rbp + 0x198], 2
jb 0x1400ea2aa
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ea2aa
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ea2aa
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400ea1f4
jmp 0x1400ea36f
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1400ea36f
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1400ea346
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ea346
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400ea346
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400ea2d5
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400a39e6
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401e7760
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401e7780
xor al, al
jmp 0x1401e7801
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1401e7793
xor al, al
jmp 0x1401e7801
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401e77bd
xor al, al
jmp 0x1401e7801
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401e77d1
xor al, al
jmp 0x1401e7801
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401e77e3
xor al, al
jmp 0x1401e7801
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401e77ff
xor al, al
jmp 0x1401e7801
mov al, 1
add rsp, 0x38
ret
Function at 0x1400a425b
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400ea070
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x14026a187]
call fcn.1400a44e0
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1401f1e00]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400ea0ef
mov dword [rbp + 0x120], 1
jmp 0x1400ea0f9
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400ea142
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1400ea0ba
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x140001f6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001fb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001fb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001fb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001fb6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001fb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001fb8
xor al, al
add rsp, 0x28
ret

Function at 0x14000616c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005f68
Function at 0x14000922c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000925c
xor eax, eax
jmp 0x14000931f
mov rbp, rbx
cmp word [rax], si
je 0x140009281
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140009268
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140009264
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000914c
movsxd r14, eax
test eax, eax
jne 0x1400092bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140009255
mov rcx, r14
call fcn.14000a108
mov rdi, rax
test rax, rax
jne 0x1400092d8
xor ecx, ecx
call fcn.1400077ac
jmp 0x1400092b4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000914c
test eax, eax
jne 0x140009309
mov rcx, rdi
call fcn.1400077ac
jmp 0x140009313
xor ecx, ecx
call fcn.1400077ac
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000c810
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000821c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000c89a
cmp byte [rbp - 0x21], r15b
je 0x14000c895
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000c8d0
call fcn.14000a918
test eax, eax
jne 0x14000c8bc
cmp byte [rbp - 0x21], r15b
je 0x14000c8b4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000c8d0
cmp byte [rbp - 0x21], r15b
je 0x14000c8cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400077fc
test eax, eax
jne 0x14000c970
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000821c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000c90f
cmp byte [rbp - 0x21], r15b
je 0x14000c944
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000c944
call fcn.14000a918
test eax, eax
jne 0x14000c930
cmp byte [rbp - 0x21], r15b
je 0x14000c929
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000c944
cmp byte [rbp - 0x21], r15b
je 0x14000c941
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400077fc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000c970
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000c973
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000c981
mov rcx, rdi
call fcn.1400077ac
cmp byte [rbp + 0x3f], r15b
je 0x14000c990
mov rcx, qword [rbp + 0x27]
call fcn.1400077ac
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000f7c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000f7e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000f7e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14066e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14066e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14066e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066e06f
add dl, dl
jne 0x14066e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066e0f6
xor eax, eax
add dl, dl
jne 0x14066e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066e1ad
add dl, dl
jne 0x14066e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14066e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14066e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14066e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14066e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14066e07e
mov eax, 1
add dl, dl
jne 0x14066e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14066e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066e0fb
sub eax, ebx
mov ebx, 1
jne 0x14066e14c
mov ecx, 1
add dl, dl
jne 0x14066e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14066e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14066e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14066e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066e15d
cmp eax, 0x7d00
jae 0x14066e19b
cmp eax, 0x500
jb 0x14066e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066e07e
cmp eax, 0x7f
ja 0x14066e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14066e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14066e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001a70
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
dec eax
mov eax, 0xcc4c97e9
xor rax, rax
cmp al, cl
cmp eax, ecx
cmp eax, ecx
dec eax
cmp rax, 0x1c
pushfq
cmp ecx, edx
popfq
cmc
mov rax, r8
mov rax, r8
jmp 0x140001aae
nop
add rax, 0xffffffffb7f15fed
dec rax
call fcn.140003b80
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
pushfq
cmp ecx, edx
popfq
push rax
pop rax
push r8
pop rax
cmp rax, 0xffffffffffffff9f
dec rax
call fcn.140001ae3

Function at 0x140003b90
Capabilities:
Enumerate process modules
Link many functions at runtime
Parse credit card information

Disassembly:
mov eax, 0x20d8
call fcn.140048560
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x80], rax
mov eax, 0xe17f0202
inc rax
push r8
pop rax
cmp rax, rcx
cmp cx, cx
cmp rax, 0x89c307c
cmp rax, rcx
cmp eax, ecx
inc eax
dec eax
dec eax
jmp 0x140003bd2
nop
push rax
pop rax
jmp 0x140003bda
nop
call fcn.140003b80
call fcn.140003be5

Function at 0x140006db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 8]
mov qword [rsp + 0x50], rax
cmp cx, cx
push r8
pop rax
cmp eax, ecx
pushfq
cmp ecx, edx
popfq
mov rax, rcx
cmp al, cl
xor eax, eax
call fcn.140006df4
Function at 0x14000a5d0
Capabilities:
Accept command line arguments
Create a process with modified i/o handles and window
Parse pe header
Read file on windows
Set current directory

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2b50
call fcn.140048560
sub rsp, rax
cmp cx, cx
mov rax, rcx
push rax
pop rax
call fcn.14000a5ff

Function at 0x140049120
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004916a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004916a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004916a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004916a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004916a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004916c
xor al, al
add rsp, 0x28
ret

Function at 0x14005d988
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14005d777
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005d777
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005d777
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005d777
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005d777
cmp dword [rcx + 0x84], 0xe
jbe 0x14005d777
cmp dword [rcx + 0xf8], 0
je 0x14005d777
mov ecx, ebx
call fcn.14005d8a8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14005d4f4
cmp dword [rbp + 0x20], 0
je 0x14005d7c4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14005d7cc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14005d710
Function at 0x180032540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x18003256d
xor al, al
jmp 0x1800326cf
mov rax, qword [0x1800526c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1800526c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1800526d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1800526d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1800526e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1800526e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1800526f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1800526f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x180052700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1800326c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x180032619
mov r11d, 2
jmp 0x18003263d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x180032633
mov r11d, 1
jmp 0x18003263d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1800326e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x180032682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x18003269a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1800326aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1800326b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x180032600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1800326ca
Function at 0x140002bb0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
mov rax, qword gs:[0x30]
xor r9d, r9d
mov edi, dword [0x140099318]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rbx, qword [rax + 0x30]
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r15d, dword [rcx + 0x1c]
mov esi, dword [rcx + 0x20]
add r15, rbx
mov r11d, dword [rcx + 0x24]
add rsi, rbx
mov ebp, dword [rcx + 0x14]
add r11, rbx
mov r12d, dword [rcx + 0x18]
test rbp, rbp
je 0x140002c82
mov qword [rsp + 0x20], r14
nop dword [rax]
mov eax, dword [r15 + r9*4]
test eax, eax
je 0x140002c6f
xor r8d, r8d
mov r14d, eax
test r12d, r12d
je 0x140002c6f
movzx eax, word [r11 + r8*2]
cmp rax, r9
jne 0x140002c67
mov edx, dword [rsi + r8*4]
xor eax, eax
add rdx, rbx
movzx ecx, byte [rdx]
test cl, cl
je 0x140002c63
nop dword [rax]
ror eax, 7
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x140002c50
cmp edi, eax
je 0x140002c79
inc r8
cmp r8, r12
jb 0x140002c33
inc r9
cmp r9, rbp
jb 0x140002c20
jmp 0x140002c7d
lea rax, [r14 + rbx]
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
pop r15
pop r12
pop rdi
ret
Function at 0x14001aca0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14001a780
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14001acdf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1400722f8]
jmp 0x14001ace9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140048160
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x180025c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov word [rsp + 0x2f], 0x64
mov dword [rsp + 0x26], 0x746e6572
mov word [rsp + 0x20], 0x6547
mov word [rsp + 0x23], 0x7543
mov dword [rsp + 0x2a], 0x65726854
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x25], 0x72
mov byte [rsp + 0x2e], 0x61
call fcn.180025bc0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180025c93
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001330
add rsp, 0x48
ret

Function at 0x180025cb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, r9
mov rbp, r8
mov esi, edx
xor ebx, ebx
call fcn.180025b00
mov rdi, rax
test rax, rax
je 0x180025718
lea rdx, [rsp + 0x20]
mov word [rsp + 0x2c], 0x7845
mov rcx, rax
mov byte [rsp + 0x2e], bl
mov dword [rsp + 0x27], 0x6f6f4874
mov dword [rsp + 0x23], 0x78654e6c
mov word [rsp + 0x21], 0x6c61
mov byte [rsp + 0x2b], 0x6b
mov byte [rsp + 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002570f
mov r9, r14
mov r8, rbp
mov edx, esi
xor ecx, ecx
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180001330
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
jmp 0x180025690

Function at 0x180025cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180038010]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp edx, 1
jne 0x180025da1
lea rdx, [rsp + 0x30]
call fcn.1800255e0
lea rcx, [rsp + 0x30]
call fcn.180001310
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x26], 0x75732074
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.180024e90
test rax, rax
jne 0x180025dd5
lea rdx, [sym.gphelper.dll_dlvhr4]
lea rcx, [0x180063818]
call fcn.180027130
test eax, eax
je 0x180025dd5
lea rdx, [sym.gphelper.dll_j5xuyc]
lea rcx, [0x180063800]
call fcn.180027130
test eax, eax
je 0x180025dd5
lea rdx, [sym.gphelper.dll_ktkw2r]
lea rcx, [0x180063810]
call fcn.180027130
test eax, eax
je 0x180025dd5
lea rdx, [sym.gphelper.dll_qo6tvs]
lea rcx, [0x180063808]
call fcn.180027130
jmp 0x180025dd5
test edx, edx
jne 0x180025dd5
lea rcx, [0x180063818]
call fcn.1800273c0
lea rcx, [0x180063800]
call fcn.1800273c0
lea rcx, [0x180063810]
call fcn.1800273c0
lea rcx, [0x180063808]
call fcn.1800273c0
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180001330
add rsp, 0x158
ret