joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401aff40
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1403151d8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x1401aff78
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1401affcf
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x1401affdc
xor edx, edx
xor eax, eax
jmp 0x1401b0006
cmp eax, 0x103
je 0x1401b0010
test eax, eax
js 0x1401affef
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1401b0006
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x140315240]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.1401a6dc0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14019e460
mov ecx, 7
int 0x29
ud2

Function at 0x1401b0060
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1403151d8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x1401b0098
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1401b00f6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x1401b0123
test eax, eax
js 0x1401b0102
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1401b0119
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x140315240]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.1401a6dc0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14019e460
mov ecx, 7
int 0x29
ud2
Function at 0x1401b0180
Capabilities:
Create udp socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov edi, edx
cmp word [rcx], 0
mov eax, 2
mov r14d, 0x17
cmove r14d, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, r14d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401b0261
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x1401b01e8
mov esi, eax
cmp eax, 0x2726
jne 0x1401b0254
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, r14d
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1401b024c
mov rsi, rax
xor ebx, ebx
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.DLL_SetHandleInformation]
test eax, eax
jne 0x1401b0261
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov ebx, 1
mov rsi, rdi
jmp 0x1401b0261
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov ebx, 1
mov rax, rbx
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1401b0d70
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x60], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x5c], ecx
mov r15d, 8
mov sil, 1
xorps xmm6, xmm6
lea r14, [rbp + 0x20]
mov r12, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
xor edi, edi
xor eax, eax
mov qword [rbp - 8], rax
nop word cs:[rax + rax]
Function at 0x1401b75b0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x140381f51]
mov ecx, 0x10
mov edx, 8
call fcn.14000bca0
test rax, rax
je 0x1401b768f
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1401b7740]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401b7681
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
loopne 0x1401b7681
mov dword [rbp - 0x10], eax
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1401dbc60
ud2

Function at 0x1401ba020
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x186], ax
mov rax, qword [0x140382088]
cmp rax, 3
jne 0x1401ba152
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
ja 0x1401ba178
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
inc rdi
lea rcx, [rbp + 0x158]
mov rdx, rbx
mov r8, rdi
call fcn.1401c6720
cmp qword [rbp + 0x158], 0
je 0x1401ba0c1
lea rax, [0x1403144d8]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401ba143
mov rcx, qword [rbp + 0x160]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x178], 0
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x178]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401ba124
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401ba13c
mov rax, qword [rbp + 0x178]
movzx ecx, word [rbp + 0x186]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rbx, rdx
call fcn.1401dae00
mov rdx, rbx
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
jbe 0x1401ba077
lea r9, [rbp + 0x170]
mov rcx, rsi
mov r8, rdi
call fcn.1401dae70
jmp 0x1401ba143
Function at 0x1401ba2c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
mov dword [rbp + 0x34], 0x80
lea rdx, [rbp - 0x60]
lea r8, [rbp + 0x34]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1401ba36a
mov eax, dword [rbp + 0x34]
movzx ecx, word [rbp - 0x60]
cmp ecx, 2
je 0x1401ba37a
cmp ecx, 0x17
jne 0x1401ba398
cmp eax, 0x1b
jbe 0x1401ba3b2
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov edx, dword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x24], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rbp + 0x22]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rbp + 0x32]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
jmp 0x1401ba3a8
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x1401ba39f
cmp eax, 0xf
jbe 0x1401ba3ca
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
jmp 0x1401ba3a8
lea rax, [0x140315f70]
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb8
pop rsi
pop rbp
ret
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in6___
lea r8, [0x140315f48]
mov edx, 0x3a
call fcn.1401dbf40
lea rcx, [0x140315eb1]
lea r8, [0x140315ef0]
mov edx, 0x39
call fcn.1401dbf40
int3
Function at 0x1401ce270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x1401ce2fa
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1401ce2f0
cmp r11, r10
ja 0x1401ce376
cmp r10, rdx
ja 0x1401ce388
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x1401ce2f2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1401ce2d0
jmp 0x1401ce357
ja 0x1401ce2fa
mov r11, r10
cmp rax, r8
jne 0x1401ce297
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x1401ce35b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1401ce330
mov r8, r10
sub ecx, r9d
jns 0x1401ce34e
jmp 0x1401ce35d
cmp r10, rdx
je 0x1401ce36a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1401ce35d
xor al, 1
cmp r8, rdx
jne 0x1401ce310
jmp 0x1401ce35d
xor eax, eax
jmp 0x1401ce35d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, [0x14031a2b8]
call fcn.1401dbe40
lea r8, [0x14031a2d0]
mov rcx, r11
mov rdx, r10
call fcn.1401dc340
lea r8, [0x14031a2d0]
mov rcx, r10
call fcn.1401dc330
int3
Function at 0x1401d93f0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, [0x1402d4495]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test rax, rax
je 0x1401d9451
mov rdi, rax
lea rdx, [0x1402d44b6]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x1401d9451
mov rsi, rax
lea rdx, [0x1402d44c4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x1401d9451
mov rdi, rax
xor ebx, ebx
jmp 0x1401d94d7
lea rcx, [0x1402d4450]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
test rax, rax
je 0x1401d954f
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x1401d954f
mov rdi, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x1401d954f
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x1401d954f
mov rsi, rax
lea rcx, [rbp - 0x40]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x1401d954f
mov rdi, qword [rbp - 0x40]
movzx eax, byte [0x140381f51]
mov ecx, 0x18
mov edx, 8
call fcn.14000bca0
test rax, rax
je 0x1401d9581
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
xor eax, eax
lock cmpxchg qword [0x140381f98], rcx
je 0x1401d9543
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
je 0x1401d952c
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.14000bcb0
mov rcx, rsi
mov rax, rcx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rax, [0x1402d4538]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x30], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rdx, [0x1402d45c8]
lea rcx, [rbp - 0x40]
call fcn.1401dbe80
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov ecx, 8
mov edx, 0x18
call fcn.1401dbc60
ud2
Function at 0x1401dae70
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov r14, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.1401c21a0
mov rdx, qword [rbp - 0x28]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1401daef9
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401daf2c
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401daf40
lea rax, [0x1403144d8]
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x1401daf60
mov rcx, qword [rbp - 0x20]
mov r8d, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.14000bcb0
mov rcx, qword [r14]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x1401daf60
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.14000bcb0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140786160
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407862e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140786191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140786177
add dl, dl
jne 0x14078619e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407861fe
xor eax, eax
add dl, dl
jne 0x1407861ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407862b5
add dl, dl
jne 0x1407861be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407861cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407861d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407861e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407861f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140786186
mov eax, 1
add dl, dl
jne 0x14078620e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14078621b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140786203
sub eax, ebx
mov ebx, 1
jne 0x140786254
mov ecx, 1
add dl, dl
jne 0x140786236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140786243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078622b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140786186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140786270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14078627d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140786265
cmp eax, 0x7d00
jae 0x1407862a3
cmp eax, 0x500
jb 0x14078629e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140786186
cmp eax, 0x7f
ja 0x1407862a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140786186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407862da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140786186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x2e95790
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x2e9579d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x2e957ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x2e95795
lea eax, [rcx + 1]
jmp 0x2e957bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x2e957ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x2e957b4
sub eax, 3
jb 0x2e957ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x2e9583d
sar eax, 1
movsxd rbp, eax
jb 0x2e95824
jmp 0x2e957fc
add ebx, ebx
jne 0x2e957fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x2e95824
inc ecx
add ebx, ebx
jne 0x2e9580a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x2e95824
call r11
adc ecx, ecx
add ebx, ebx
jne 0x2e9581d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x2e9580c
add ecx, 2
jmp 0x2e95829
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.02e95752
jmp 0x2e9579d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2a6c000]
mov eax, dword [rdi]
or eax, eax
je 0x2e95899
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2a95000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x2e95849
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x2e95893
mov qword [rbx], rax
add rbx, 8
jmp 0x2e95869
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x2e958dd
cmp al, 0xef
ja 0x2e958c5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x2e958a5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x2e958b4
mov eax, dword [rdi]
add rdi, 4
jmp 0x2e958b4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x2e95931
sub rsp, 0xffffffffffffff80
jmp 0x465c20
Function at 0xb663e9
Capabilities:
Encode data using base64

Disassembly:
je 0xbf9650
movzx eax, byte [r9]
jmp 0xb82c7e
inc ecx
test r12w, 0x39f
cmp bh, 0x17
or edi, eax
jmp 0xb7917e
inc r9
test r14b, r8b
cmp ecx, 5
jmp 0x1712b51
xor cx, di
push 0x280ebe94
xor cx, 0x9c1c
shl dword [rsp + 0xa], 0x19
inc byte [rsp + 0xd]
dec cx
xor cx, 0x6a3f
call fcn.0171c1c3
mov ebx, 0xc8be451b
bt ebx, ebx
btc ebx, ebx
mov ebx, dword [r9 + riz]
mov eax, 0x94ab3209
adc al, al
mov eax, dword [r9 + riz + 4]
jnp 0x171c4e8
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
not r10w
btr r10w, di
rcl r8w, 0
mov qword [rsp + 0x10], rdx
shr eax, cl
add r10w, 0xab01
push rbx
setp ah
rol r8, 1
push rbp
movzx ebp, si
sbb bpl, 0x1b
sets r10b
push rdi
sar dil, cl
mov r8w, r14w
push r12
btr eax, ebx
bt rdi, r10
cbw
push r13
rcl bp, cl
adc bpl, bpl
xadd r8b, r12b
push r14
cmc
push r15
sub rsp, 0x30
rcl ax, cl
add dil, r13b
mov r15, qword [rcx + 0x10]
adc r8w, r9w
dec bp
mov rax, rcx
mov dil, r13b
mov ecx, dword [rcx + 8]
bsr di, r15w
sub ebx, ebx
sub r12w, 0x502b
btc r14d, edi
movzx r8w, bpl
mov r8, rdx
adc r14d, r14d
movsxd r14, edi
movsx rdx, ax
mov r12d, 1
movsxd r14, r14d
movzx edx, ax
mov edx, 1
mov edi, 1
cmp al, 0xbd
sub r11b, r11b
setge r14b
rcl r14b, cl
xor r10b, 0xb
shl edx, cl
neg bpl
rcl bpl, 0x89
add ch, 2
mov ecx, dword [rax + 4]
mov r14, rbx
shl edi, cl
setp cl
mov rcx, qword [rsp + 0xa0]
dec r10b
movsx r10d, r10w
dec edx
not r10b
dec edi
or r10b, 0xa6
test ax, 0xcead
setle bpl
mov ebp, ebx
mov r10d, r12d
mov dword [rsp + 0xc], edi
shl di, 0x15
mov rdi, 0x6a35f2b6
mov edi, dword [rax]
mov qword [r9], rbx
clc
mov qword [rcx], rbx
mov eax, dword [rax + 4]
bts cx, bx
mov dword [rsp + 0x10], edx
bts cx, r8w
movsx rcx, r10w
sub ecx, esi
lea ecx, [rdi + rax]
mov eax, 0x300
test r10b, 0x24
clc
mov dword [rsp + 8], edi
stc
shl eax, cl
test r14b, r13b
test eax, 0xa220d431
mov dword [rsp + 0x70], r12d
cmp cl, 0xa4
mov dword [rsp + 0x80], r12d
test dx, 0x191e
stc
add eax, 0x736
mov dword [rsp + 4], r12d
jmp 0x1719db2
shl edi, 8
jmp 0xb6b6b1
mov eax, r10d
btr r15d, esi
add rsp, 0x30
bswap r15w
movsx rdi, r8w
movsxd rbp, r10d
pop r15
bswap r12d
cmova rdi, r15
pop r14
mov bx, bx
movzx r12d, r11w
not dil
pop r13
bswap bx
movsx bx, r15b
mov dil, r13b
pop r12
setno bh
jmp 0x1724f22
jl 0x1719e0c
mov qword [rsp + 0x28], rsi
xor si, r10w
btr esi, r13d
nop
bsf esi, r11d
sal si, cl
movsx ax, spl
call fcn.00beabf7
adc r11, 2
not word [rsp + 2]
jmp 0xb7cfb3
je 0x1719de5
mov ecx, eax
mov eax, 0x400
not r13d
movsx r9, r8w
movsx r13w, r8b
mov rdi, r15
movzx eax, ax
movzx r13, bp
rep stosw word [rdi], ax
rcr dil, 0x36
xor cx, 0x769f
bsf ecx, r8d
mov r9, r8
lea r13, [r8 - 1]
xor cx, 0x670f
bts rdi, rbx
mov edi, ebx
bts cx, r11w
or r8d, 0xffffffff
mov ecx, ebx
test r12, rsp
cmp r10d, 0x28060c15
cmp r9, r13
jmp 0xb663e9
imul ebx
call 0x170a095
pop rdi
not ebx
mov bpl, 0x99
pop rbp
xchg rbx, rbx
movsxd rbx, r13d
pop rbx
ret

Function at 0xbf4ebc
Capabilities:
Encode data using base64

Disassembly:
jns 0x1727779
call fcn.00b67026
jle 0xbf4e82
and ch, byte [rdx]
test byte [rcx + rax - 0x6e35425f], 0x9b
invalid