joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b9c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400ba4f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000b9e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000b9e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000b9e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000ba3d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x14000ba34
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000b9e0
add rax, 0x28
cmp rax, r9
jne 0x14000ba20
xor eax, eax
ret

Function at 0x14000ba40
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400ba4f0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000ba5f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000ba68
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000ba5f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000bb00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400ba4f0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000bb1f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000bb28
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140017320
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
mov qword [rsp + 0x20], rax
movabs rax, 0x7520676e696e6165
mov qword [rsp + 0x28], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x30], rax
movabs rax, 0x20726f6620737965
mov qword [rsp + 0x38], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x87], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x14001742a
lea rcx, [rsp + 0x20]
mov eax, 0x28
jmp 0x140017402
add rax, 1
cmp rax, 0x6b
je 0x14001741f
cmp byte [rcx + rax], 0
jne 0x1400173f8
cmp eax, 0x6a
movsxd rdx, eax
je 0x14001741f
add eax, 1
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
lea rcx, [rsp + 0x20]
mov eax, 0x28
mov edx, 0x27
jmp 0x140017413
Function at 0x1400177a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x1400e0d20], 1
je 0x140017818
lea rdi, [0x1400e0d20]
mov rcx, rdi
call fcn.1400170a0
lea rbp, [rax + 8]
mov rbx, rax
mov rcx, rbp
call fcn.1400169b0
mov esi, dword [0x1400e0d20]
test esi, esi
jne 0x140017828
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x1400b2158], eax
je 0x1400b1656
mov dword [0x1400e0d20], 1
mov rcx, rbp
call fcn.140016ca0
test rbx, rbx
je 0x140017818
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140017440
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp esi, 1
je 0x1400177f8
mov ecx, 2
call qword [fcn.140014de0]
mov r9d, esi
mov r8, rdi
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x1400177f8
call sub.msvcrt.dll_abort
nop

Function at 0x140017850
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
call fcn.140017550
cmp qword [0x1400e3048], 0
mov rbx, rax
je 0x140017968
test rax, rax
je 0x140017968
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.140016fa0
cmp eax, 1
je 0x140017976
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rsi, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, rsi
mov dword [rsp + 0x28], 0
lea r9, [rbx + 0x28]
mov rcx, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je fcn.1400b165c
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x1400b2158]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14001797c
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.140017320
nop
jmp fcn.1400b165c

Function at 0x140017990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400179b0
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.140017850
Function at 0x140018120
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, dword [rcx]
test rdx, rdx
mov rbx, rcx
mov rsi, rdx
je 0x140018248
cmp eax, 1
je 0x14001817b
call fcn.1400170a0
lea rbp, [rax + 8]
mov rdi, rax
mov rcx, rbp
call fcn.1400169b0
mov r12d, dword [rbx]
test r12d, r12d
je 0x140018190
cmp r12d, 1
jne 0x140018220
mov rcx, rbp
call fcn.140016ca0
test rdi, rdi
je 0x14001817b
mov rcx, rdi
call fcn.140017440
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rax, [0x140017520]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call r12
test rax, rax
je 0x140018288
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call r12
test rax, rax
je 0x140018270
lea rdx, [rsp + 0x20]
mov qword [rax + 0x18], rdx
lock or qword [rsp], 0
call rsi
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call r12
test rax, rax
je 0x140018260
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
mov dword [rbx], 1
jmp 0x140018166
mov ecx, 2
call qword [fcn.140014de0]
mov r9d, r12d
mov r8, rbx
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x140018166
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140017850
test rax, rax
jne 0x140018209
jmp 0x1400b1675
call fcn.140017850
test rax, rax
jne 0x1400181e5
jmp 0x1400b168e
call fcn.140017850
test rax, rax
jne 0x1400181bf
jmp 0x1400b1684
mov rax, qword [rsp + 0x30]
mov qword [0], rax
ud2
mov rax, qword [pe_dos_header]
ud2
lea rax, [rsp + 0x20]
mov qword [0], rax
ud2

Function at 0x140018510
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018588
lea rbp, [rbx + 0x68]
xor r12d, r12d
mov rcx, rbp
call fcn.140016fb0
cmp esi, dword [rbx + 0x48]
jae 0x140018563
mov rax, qword [rbx + 0x58]
cmp byte [rax + rsi], 0
je 0x140018563
mov rax, qword [rbx + 0x50]
mov r12, qword [rax + rsi*8]
mov rcx, rbp
call fcn.140016ff0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140017850
mov rbx, rax
jmp 0x14001853d
Function at 0x1400185a0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x1400186b0
lea r14, [rbx + 0x68]
mov rcx, r14
call fcn.140016fb0
cmp esi, dword [rbx + 0x48]
jae 0x140018630
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r14
mov byte [rax + rsi], 1
call fcn.140016ff0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rbx + 0x50]
lea r15d, [rsi + 1]
movsxd r13, r15d
lea rdx, [r13*8]
call sub.msvcrt.dll_realloc
test rax, rax
mov rdi, rax
je 0x1400186bd
mov rcx, qword [rbx + 0x58]
mov rdx, r13
movq xmm6, rdi
call sub.msvcrt.dll_realloc
movq xmm0, rax
test rax, rax
mov r13, rax
punpcklqdq xmm6, xmm0
je 0x1400186bd
mov eax, dword [rbx + 0x48]
mov edx, r15d
lea rcx, [rdi + rax*8]
sub edx, eax
lea r8, [rdx*8]
xor edx, edx
call sub.msvcrt.dll_memset
mov edx, dword [rbx + 0x48]
mov r8d, r15d
lea rcx, [r13 + rdx]
sub r8d, edx
xor edx, edx
call sub.msvcrt.dll_memset
movaps xmmword [rbx + 0x50], xmm6
mov dword [rbx + 0x48], r15d
jmp 0x1400185f4
call fcn.140017850
mov rbx, rax
jmp 0x1400185df
mov rcx, r14
call fcn.140016ff0
mov eax, 0xc
jmp 0x140018612

Function at 0x140018740
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018768
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.140017850
test rax, rax
jne 0x14001875a
add rsp, 0x28
ret

Function at 0x1400187d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400187f8
add rax, 0x18
add rsp, 0x28
ret
call fcn.140017850
test rax, rax
jne 0x1400187ea
jmp 0x1400187ee

Function at 0x140018910
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400e0d28]
test eax, eax
jne 0x140018928
xor eax, eax
add rsp, 0x28
ret
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018958
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x14001891e
test byte [rax + 0x40], 3
je 0x14001891e
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x140018920
call fcn.140017850
test rax, rax
jne 0x14001893e
jmp 0x14001891e
Function at 0x140018970
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400189b0
test ebx, ebx
jle 0x1400189a0
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.140017850
test rax, rax
jne 0x14001898d
add rsp, 0x20
pop rbx
ret

Function at 0x140018aa0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018b18
test byte [rbx + 0x40], 0xc
jne 0x140018acf
mov eax, dword [0x1400e0d28]
test eax, eax
jne 0x140018ae0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.1400169b0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140018b03
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140018b03
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140018b2c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140016ca0
call fcn.140017850
test rax, rax
mov rbx, rax
jne 0x140018abf
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140018b4a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140016ca0
call fcn.1400189c0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140018bd0
call fcn.140016770
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140018c08
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018c60
test esi, esi
je 0x140018be6
call fcn.140018aa0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140018c40
mov edx, edi
call fcn.140016820
call fcn.140018aa0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018c50
call fcn.140018aa0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140018aa0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x140018ba5
call fcn.140017850
mov rbx, rax
jmp 0x140018ba5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140018bbe
call fcn.140017850
jmp 0x140018be6
call fcn.140017850
mov rbx, rax
jmp 0x140018ba1
Function at 0x140018b60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018b18
test byte [rbx + 0x40], 0xc
jne 0x140018acf
mov eax, dword [0x1400e0d28]
test eax, eax
jne 0x140018ae0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.1400169b0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140018b03
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140018b03
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140018b2c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140016ca0
call fcn.140017850
test rax, rax
mov rbx, rax
jne 0x140018abf
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140018b4a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140016ca0
call fcn.1400189c0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140018bd0
call fcn.140016770
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140018c08
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018c60
test esi, esi
je 0x140018be6
call fcn.140018aa0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140018c40
mov edx, edi
call fcn.140016820
call fcn.140018aa0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018c50
call fcn.140018aa0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140018aa0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x140018ba5
call fcn.140017850
mov rbx, rax
jmp 0x140018ba5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140018bbe
call fcn.140017850
jmp 0x140018be6
call fcn.140017850
mov rbx, rax
jmp 0x140018ba1

Function at 0x140018c70
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.1400177a0
mov ecx, dword [0x1400b2158]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018ce0
test esi, esi
je 0x140018cc0
call fcn.140018aa0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140018cf0
mov edx, esi
call fcn.140016820
call fcn.140018aa0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140018aa0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140018aa0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140017850
mov rbx, rax
jmp 0x140018c91
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140018caa
Function at 0x140077330
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140077357
call rbp
cmp dword [rax], 4
jne 0x140077374
mov rcx, rdi
call fcn.140077160
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
movsxd r12, eax
je 0x140077350
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400b0a20
Capabilities:
Execute command

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea r14, [0x1400b504e]
lea r15, [0x140026860]
lea rbp, [0x1400b5032]
call fcn.14000acf0
lea rdi, [rsp + 0x2c]
call sub.msvcrt.dll_rand
mov r12, qword [0x1400b9f20]
movsxd rbx, eax
cdq
imul rbx, rbx, 0x288df0cb
mov rcx, r12
sar rbx, 0x24
sub ebx, edx
imul edx, ebx, 0x65
sub eax, edx
lea rdx, section..rdata
mov ebx, eax
call fcn.1400adcf0
mov edx, ebx
mov rcx, rax
call fcn.140071020
mov rcx, rax
call fcn.140001460
cmp ebx, dword [rsp + 0x2c]
mov rsi, qword [0x1400b9ef0]
jne 0x1400b0acb
jmp 0x1400b0b30
movsx edx, byte [r13 + 0x43]
mov rcx, r12
call fcn.14006ef70
mov rcx, rax
call fcn.14006f160
cmp dword [rsp + 0x2c], ebx
je 0x1400b0b30
mov rdx, rdi
mov rcx, rsi
call fcn.14006ec10
cmp dword [rsp + 0x2c], ebx
mov r8d, 0x1b
mov rdx, r14
jge 0x1400b0ae8
mov rdx, rbp
mov rcx, r12
call fcn.1400aa570
mov rax, qword [r12]
mov rax, qword [rax - 0x18]
mov r13, qword [rax + r12 + 0xf0]
test r13, r13
je 0x1400b0b66
cmp byte [r13 + 0x38], 0
jne 0x1400b0ab0
mov rcx, r13
call fcn.140026560
mov rax, qword [r13]
mov edx, 0xa
mov rax, qword [rax + 0x30]
cmp rax, r15
je 0x1400b0ab5
mov rcx, r13
call rax
movsx edx, al
jmp 0x1400b0ab5
lea rdx, [0x1400b5014]
mov rcx, r12
call fcn.1400adcf0
mov rcx, rax
call fcn.140001460
lea rcx, str.pause
call sub.msvcrt.dll_system
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400b0d70
nop
nop dword [rax]
sub rsp, 0x28
lea rcx, [0x1400e0030]
call fcn.1400a6650
lea rcx, [0x140001450]
add rsp, 0x28
jmp fcn.140001410
Function at 0x1407d21ca
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 0x18]
setno dil
cmovne rdi, qword [rsp + 0x28]
setge byte [rsp + 0x28]
and al, 0x28
mov r15, rdi
mov r15, qword [rsp + 8]
or word [rsp + 0x28], 0x6352
sub rdi, rdi
test qword [rsp + 0x28], 0xb7f7480
mov rdi, qword [rsp + 0x10]
mov word [rsp + 0x28], 0x4eb1
je 0x140439a6f
call fcn.14038f317
sub bl, dl
mov dword [rbx + 0x5f], ecx
push rsp
sbb eax, 0x340f4b8a
pop rcx
fimul dword [rcx + 0x1d545f4b]
mov cl, byte [rbx + 0xf]
xor al, 0x59
mov dword [rbx - 0x2e], ecx
pop rdx
mov cl, byte [r11 + 0xb]
jo 0x1407d2211
jg 0x1407d21dc
invalid
Function at 0x180005cf0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180078068]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rdx
mov qword [rsp + 0x30], rdx
mov rsi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
xor edi, edi
mov dword [rsp + 0x28], edi
call fcn.180002f40
mov dword [rsp + 0x28], 1
mov ebp, edi
mov r15d, edi
mov rcx, r14
call fcn.180009ae0
mov r14, rax
test rax, rax
je 0x180005ef0
mov ebx, edi
jmp 0x180005d65
mov r15d, dword [rsp + 0x2c]
dec r14
movsxd rdx, r15d
mov rcx, qword [rsp + 0x30]
call fcn.180003cf0
movzx ecx, byte [rax]
mov byte [rsp + rbx + 0x20], cl
inc ebp
inc rbx
inc r15d
mov dword [rsp + 0x2c], r15d
movzx r13d, byte [rsp + 0x22]
movzx r15d, byte [rsp + 0x21]
movzx r12d, byte [rsp + 0x20]
cmp rbx, 3
jne 0x180005e1a
movzx eax, r12b
shr al, 2
mov byte [rsp + 0x24], al
movzx ecx, r12b
and cl, bl
shl cl, 4
movzx eax, r15b
shr al, 4
add cl, al
mov byte [rsp + 0x25], cl
movzx ecx, r15b
and cl, 0xf
shl cl, 2
movzx eax, r13b
shr al, 6
add cl, al
mov byte [rsp + 0x26], cl
movzx eax, r13b
and al, 0x3f
mov byte [rsp + 0x27], al
mov rbx, rdi
nop word [rax + rax]
movzx edx, byte [rsp + rbx + 0x24]
lea rcx, [0x1800789f8]
call fcn.180003cf0
movzx edx, byte [rax]
mov rcx, rsi
call fcn.180004030
inc rbx
cmp rbx, 4
jl 0x180005df0
mov ebp, edi
mov rbx, rdi
test r14, r14
jne 0x180005d60
test ebp, ebp
je 0x180005ef0
movsxd rax, ebp
cmp rax, 3
jge 0x180005e5a
jae 0x180005f22
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 3
jl 0x180005e34
movzx r13d, byte [rsp + 0x22]
movzx r15d, byte [rsp + 0x21]
movzx r12d, byte [rsp + 0x20]
movzx eax, r12b
shr al, 2
mov byte [rsp + 0x24], al
and r12b, 3
shl r12b, 4
movzx eax, r15b
shr al, 4
add r12b, al
mov byte [rsp + 0x25], r12b
and r15b, 0xf
shl r15b, 2
movzx eax, r13b
shr al, 6
add r15b, al
mov byte [rsp + 0x26], r15b
and r13b, 0x3f
mov byte [rsp + 0x27], r13b
lea eax, [rbp + 1]
movsxd rbx, eax
test eax, eax
jle 0x180005ed4
nop word [rax + rax]
movzx edx, byte [rsp + rdi + 0x24]
lea rcx, [0x1800789f8]
call fcn.180003cf0
movzx edx, byte [rax]
mov rcx, rsi
call fcn.180004030
inc rdi
cmp rdi, rbx
jl 0x180005eb0
cmp ebp, 3
jge 0x180005ef0
mov ebx, 3
sub ebx, ebp
mov dl, 0x3d
mov rcx, rsi
call fcn.180004030
sub rbx, 1
jne 0x180005ee0
mov rcx, qword [rsp + 0x30]
call fcn.180003900
mov rax, rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18005b110
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18005ae08
int3

Function at 0x1800072b0
Capabilities:
Encode data using base64

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r14, rcx
movsxd rbx, r8d
lea rcx, [0x18005fde0]
mov r15, rdx
jmp fcn.1800d0020
Function at 0x180008c30
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov ebx, 1
xor ebp, ebp
mov rcx, r14
call fcn.180009ae0
xor edx, edx
mov rcx, r14
lea edi, [rax - 6]
call fcn.180003cf0
mov rcx, rax
mov dword [rsp + 0x20], edi
mov r9d, ebx
lea rdx, [0x18005fd6c]
mov r8d, 6
call fcn.180006fd0
movsxd rbx, eax
test eax, eax
jle 0x180008cec
mov rcx, r14
call fcn.180009ae0
sub rax, 0xa
cmp rbx, rax
jae 0x180008cd6
inc ebp
nop dword [rax]
movsxd rsi, ebx
mov rcx, r14
inc ebx
movsxd rdx, ebx
call fcn.180003cf0
mov edx, 0xff
xor ecx, ecx
mov rdi, rax
call fcn.180009370
lea rdx, [rsi + 2]
mov byte [rdi], al
mov rcx, r14
call fcn.180005a70
cmp byte [rax], 0xcc
je 0x180008ca0
test ebx, ebx
jle 0x180008cec
mov rcx, r14
call fcn.180009ae0
mov rcx, rax
mov eax, ebx
cmp rax, rcx
jb 0x180008c52
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret