joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400157c7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140035d00]
jne 0x14001244a
rol rcx, 0x10
test cx, 0xffff
jne 0x140012446
repz ret
ror rcx, 0x10
jmp 0x140015720
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14003b130]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14003b228]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400157a5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14003b130]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400157c7
mov rax, qword [rsp + 0x88]
mov qword [0x14003b228], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14003b1c8], rax
mov rax, qword [0x14003b228]
mov qword [0x14003b0a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14003b1b0], rax
mov dword [0x14003b090], 0xc0000409
mov dword [0x14003b094], 1
mov rax, qword [0x140035d00]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140035d08]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14003b128], eax
mov ecx, 1
call fcn.1400203e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002c5b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14003b128], 0
jne 0x14001584e
mov ecx, 1
call fcn.1400203e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1400163d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x14003b618]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.140015a30
test rax, rax
je 0x140016424
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x1400164b9
mov ecx, 2
call fcn.1400203e0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.140013020
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1400164a5
test ebx, ebx
jne 0x1400164a5
lea ecx, [rax + 2]
call fcn.1400203e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140016540
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x140035eb0]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x14001657e
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x140016560
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140016765
mov ecx, 3
call fcn.140020650
cmp eax, 1
je 0x14001671c
mov ecx, 3
call fcn.140020650
test eax, eax
jne 0x1400165b5
cmp dword [0x140035cf8], 1
je 0x14001671c
cmp edi, 0xfc
je 0x140016765
mov qword [rsp + 0x50], rbp
lea rbp, [0x14003b630]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.140014150
test eax, eax
je 0x1400165f9
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140016330
lea rdx, [0x14003b649]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x14003b74d], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140016649
lea r8, str._program_name_unknown_
lea rcx, [0x14003b649]
mov edx, 0x2fb
call fcn.140014150
test eax, eax
je 0x140016649
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140016330
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x14003b649]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x140016698
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x14003b944]
lea r9d, [rax + 3]
lea r8, [0x14002cbb4]
sub rdx, rcx
call fcn.140014ed0
test eax, eax
je 0x140016698
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140016330
lea r8, [0x14002cbb0]
mov edx, 0x314
mov rcx, rbp
call fcn.140014590
test eax, eax
je 0x1400166c4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140016330
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.140014590
test eax, eax
je 0x1400166f4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.140016330
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.1400203f0
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140016765
cmp rax, 0xffffffffffffffff
je 0x140016765
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140017070
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [0x14003ba68]
test eax, eax
jne 0x1400170c3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x1400170a3
mov dword [0x14003ba68], 1
jmp 0x1400170de
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1400170bd
mov dword [0x14003ba68], 2
jmp 0x1400171b9
mov eax, dword [0x14003ba68]
cmp eax, 1
jne 0x1400171b0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x140017203
cmp word [rdi], 0
mov qword [rsp + 0x50], rbp
mov rbx, rdi
mov qword [rsp + 0x58], r12
je 0x140017105
add rbx, 2
cmp word [rbx], 0
jne 0x1400170f1
add rbx, 2
cmp word [rbx], 0
jne 0x1400170f1
xor r12d, r12d
sub rbx, rdi
mov r8, rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
sar rbx, 1
lea r9d, [rbx + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
movsxd rbp, eax
je 0x1400171a3
mov rcx, rbp
call fcn.140016050
test rax, rax
mov rsi, rax
je 0x1400171a3
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9d, [rbx + 1]
mov r8, rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x14001717d
mov rcx, rsi
call fcn.1400127c0
mov rsi, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x140017189
cmp eax, 2
je 0x1400171b9
test eax, eax
jne 0x140017203
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rbx, rax
je 0x140017203
cmp byte [rax], 0
je 0x1400171e2
nop
add rax, 1
cmp byte [rax], 0
jne 0x1400171d0
add rax, 1
cmp byte [rax], 0
jne 0x1400171d0
sub eax, ebx
add eax, 1
movsxd rsi, eax
mov rcx, rsi
call fcn.140016050
test rax, rax
mov rdi, rax
jne 0x140017215
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400146f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x40
pop rdi
ret
Function at 0x1400203f0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140015940
xor ebx, ebx
cmp qword [0x14003be70], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x14002051c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x14002062f
lea rdx, [0x14002d770]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002062f
mov rcx, rax
call fcn.140015870
lea rdx, [0x14002d760]
mov rcx, rsi
mov qword [0x14003be70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140015870
lea rdx, [0x14002d748]
mov rcx, rsi
mov qword [0x14003be78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140015870
lea rcx, [rsp + 0x98]
mov qword [0x14003be80], rax
call fcn.1400139f0
test eax, eax
je 0x1400204cf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140016330
cmp dword [rsp + 0x98], 2
jne 0x14002051c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140015870
test rax, rax
mov qword [0x14003be90], rax
je 0x14002051c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140015870
mov qword [0x14003be88], rax
mov rcx, qword [0x14003be88]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x1400205c8
cmp qword [0x14003be90], rbp
je 0x1400205c8
call fcn.140015a30
mov rcx, qword [0x14003be90]
mov rsi, rax
call fcn.140015a30
test rsi, rsi
mov r12, rax
je 0x1400205c8
test rax, rax
je 0x1400205c8
call rsi
test rax, rax
je 0x140020593
lea rcx, [rsp + 0x34]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140020593
test byte [rsp + 0x40], 1
jne 0x1400205c8
lea rcx, [rsp + 0x30]
call fcn.140013a40
test eax, eax
je 0x1400205b5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140016330
cmp dword [rsp + 0x30], 4
jb 0x1400205c2
bts edi, 0x15
jmp 0x140020606
bts edi, 0x12
jmp 0x140020606
mov rcx, qword [0x14003be78]
cmp rcx, rbp
je 0x140020606
call fcn.140015a30
test rax, rax
je 0x140020606
call rax
test rax, rax
mov rbx, rax
je 0x140020606
mov rcx, qword [0x14003be80]
cmp rcx, rbp
je 0x140020606
call fcn.140015a30
test rax, rax
je 0x140020606
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14003be70]
call fcn.140015a30
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x14002062f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140020631
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x140024e80
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140035d00]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140024ec7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140012430
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.140015130
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140012430
add rsp, 0x38
ret

Function at 0x140028104
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140035d00]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.140013020
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.140013020
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x140028197
cmp dword [rsp + 0x24], 5
jb 0x1400281b1
jmp 0x1400281ad
cmp dword [rsp + 0x30], esi
jne 0x1400281b1
cmp dword [rsp + 0x24], 4
ja 0x1400281ad
jne 0x1400281b1
cmp dword [rsp + 0x28], 0
jbe 0x1400281b1
mov byte [rbx + 0x18], sil
lea rax, [0x14002e180]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.140027fc4
movzx ecx, byte [0x14003c0f0]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x14003c0f0], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140012430
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140008a10
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140008a52
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x140008a5a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140008a6b
jmp 0x140008a82
xor r10d, r10d
jmp 0x140008b0d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140008a82
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140008a99
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140008ab9
add r11, r8
jmp 0x140008bea
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140008b82
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140008b30
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140008ba0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140008bb2
jmp 0x140008bcc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140008bcc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140008be6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140009680
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov r13, rcx
mov r14, qword [rcx]
mov rsi, qword [rcx + 0x10]
test rsi, rsi
mov qword [rbp - 8], rcx
je 0x1400096f9
xor r12d, r12d
mov rax, rsi
shr rax, 0x3d
sete al
jne 0x140009843
lea r15, [rsi*4]
mov r12b, al
shl r12, 2
test r15, r15
je 0x140009703
movzx eax, byte [0x14018d171]
mov rcx, r15
mov rdx, r12
call fcn.1400053b0
mov rbx, rax
test rbx, rbx
jne 0x14000970f
jmp 0x14000984a
mov ebx, 4
xor r15d, r15d
jmp 0x14000970f
mov rbx, r12
test rbx, rbx
je 0x14000984a
mov rcx, rbx
mov rdx, r14
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
mov r8, qword [rdi + 0x30]
movzx ecx, byte [rdi + 0x158]
shr r8, cl
test r8, r8
je 0x1400097a0
xor eax, eax
jmp 0x140009748
inc rax
cmp rax, r8
je 0x1400097a0
mov rcx, qword [r13 + 0x18]
and ecx, 0x3f
mov r9, rax
shl r9, cl
cmp rax, rsi
je 0x14000981e
mov edx, dword [rbx + rax*4]
cmp edx, r9d
je 0x140009740
nop word cs:[rax + rax]
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, rsi
jae 0x14000980a
mov edx, dword [rbx + rdx*4]
cmp edx, r9d
jne 0x140009770
mov rdx, qword [r13 + 0x10]
cmp rax, rdx
jae 0x140009832
mov rcx, qword [r13]
mov dword [rcx + rax*4], r10d
jmp 0x140009740
lea r8, [r13 + 0x18]
mov rcx, rdi
mov rdx, r13
call fcn.140044580
test rsi, rsi
je 0x1400097c9
shl rsi, 2
mov r8d, 4
mov rcx, rbx
mov rdx, rsi
call fcn.1400053c0
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400097f8
mov rcx, qword [rax]
shl rdx, 2
mov r8d, 4
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.1400053c0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x1400fe738]
mov rcx, rdx
mov rdx, rsi
call fcn.1400fc7e0
jmp 0x140009855
lea r8, [0x1400fe720]
mov rcx, rsi
mov rdx, rsi
call fcn.1400fc7e0
jmp 0x140009855
lea r8, [0x1400fe750]
mov rcx, rax
call fcn.1400fc7e0
jmp 0x140009855
call fcn.1400eef40
jmp 0x140009855
mov rcx, r12
mov rdx, r15
call fcn.1400fc520
ud2
Function at 0x14001d090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
cmp edx, 0x1ff
jg 0x14001d13c
dec edx
cmp edx, 0x3f
ja case.0x14001d0c4.64
mov r9d, 0x3600
xor r10d, r10d
lea rax, [0x14001d264]
movsxd rdx, dword [rax + rdx*4]
add rdx, rax
jmp rdx
movzx eax, byte [rcx]
test rax, rax
je 0x14001d106
lea ecx, [rax - 1]
mov edx, 1
xor r9d, r9d
shld r9, rdx, cl
mov r10d, ecx
shr r10b, 7
movzx r10d, r10b
xor r11d, r11d
shl rdx, cl
test cl, 0x40
cmovne r9, rdx
cmovne rdx, r11
shl r10, 4
or qword [r8 + r10], rdx
or qword [r8 + r10 + 8], r9
mov r9d, 1
xor r10d, r10d
mov ecx, eax
shld r10, r9, cl
xor edx, edx
shl r9, cl
test al, 0x40
cmovne r10, r9
cmovne r9, rdx
shr rax, 3
and eax, 0xfffffff0
add r8, rax
or qword [r8], r9
or qword [r8 + 8], r10
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp edx, 0x1fff
jle 0x14001d15c
cmp edx, 0x7fff
jle case.0x14001d0c4.64
cmp edx, 0x8000
je case.0x14001d0c4.64
cmp edx, 0x20000
jmp case.0x14001d0c4.64
cmp edx, 0x7ff
xor edx, edx
mov r9d, 1
lea r10, [0x140100dc0]
xor r11d, r11d
jmp 0x14001d1be
xor edi, edi
mov ecx, eax
shld rdi, r9, cl
shr cl, 7
movzx ebx, cl
mov r14d, 1
mov ecx, eax
shl r14, cl
test al, 0x40
cmovne rdi, r14
cmovne r14, rdx
shl rbx, 4
or qword [r8 + rbx], r14
or qword [r8 + rbx + 8], rdi
movzx eax, si
cmp eax, 0xff
jae case.0x14001d0c4.1
mov ecx, r11d
movzx edi, r11w
cmp edi, 0x100
mov esi, 0xff
cmovae esi, edi
mov r11d, esi
inc r11d
mov ebx, ecx
nop dword [rax + rax]
cmp si, bx
je 0x14001d220
mov eax, ebx
lea ebx, [rax + 1]
movzx r14d, bl
cmp byte [rdi + r10], 0
sete bpl
cmp byte [r14 + r10], 0
setne r14b
xor r14b, bpl
jne 0x14001d1e0
mov esi, eax
mov r11d, ebx
test cl, cl
jne 0x14001d22c
jmp 0x14001d180
mov ax, 0xff
test cl, cl
je 0x14001d180
dec cl
xor edi, edi
shld rdi, r9, cl
mov ebx, ecx
shr bl, 7
movzx ebx, bl
mov r14d, 1
shl r14, cl
test cl, 0x40
cmovne rdi, r14
cmovne r14, rdx
shl rbx, 4
or qword [r8 + rbx], r14
or qword [r8 + rbx + 8], rdi
jmp 0x14001d180
ud2
Function at 0x140041fa0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x158]
and ecx, 0x3f
mov r14, rdi
shr r14, cl
test r14, r14
je 0x140042028
xor edi, edi
mov rax, r14
shr rax, 0x3d
sete al
jne 0x140042218
lea rbx, [r14*4]
mov dil, al
shl rdi, 2
test rbx, rbx
je 0x14004219a
movzx eax, byte [0x14018d171]
mov rcx, rbx
mov rdx, rdi
call fcn.1400053b0
test rax, rax
je 0x1400421a6
cmp r14, 8
jae 0x14004202f
xor edx, edx
jmp 0x140042080
mov eax, 4
jmp 0x14004209d
mov rdx, r14
and rdx, 0xfffffffffffffff8
movdqa xmm0, xmmword [0x1400fdcb0]
xor ecx, ecx
movdqa xmm1, xmmword [0x1400fdcc0]
movdqa xmm2, xmmword [str._b_b_b_b]
movdqa xmm3, xmm0
paddd xmm3, xmm1
movdqu xmmword [rax + rcx*4], xmm0
movdqu xmmword [rax + rcx*4 + 0x10], xmm3
add rcx, 8
paddd xmm0, xmm2
cmp rdx, rcx
jne 0x140042050
cmp r14, rdx
je 0x14004208f
nop word cs:[rax + rax]
mov dword [rax + rdx*4], edx
lea rcx, [rdx + 1]
mov rdx, rcx
cmp r14, rcx
jne 0x140042080
mov rdi, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x158]
and ecx, 0x3f
mov qword [rbp - 8], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0
shr rdi, cl
test rdi, rdi
je 0x1400421fa
lea rbx, [rbp - 0x30]
mov r14d, edi
dec r14d
mov rcx, qword [rsi + 0x158]
and ecx, 0x3f
mov r8, qword [rsi + 0x160]
mov r9, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x30]
lea r10, [rdi - 0x80000000]
nop
test rdi, rdi
je 0x140042167
dec rdi
cmp r10, 0xffffffff80000000
jbe 0x1400421c8
mov eax, edi
shl rax, cl
add rax, r8
cmp rax, rdx
jae 0x1400421b3
mov rax, qword [r9 + rax*8]
shr rax, 0x2a
cmp eax, 0x3ffffe
ja 0x1400420f0
mov byte [rbp + 7], 1
mov rcx, rbx
mov rdx, rsi
mov r8d, r14d
mov r9d, edi
call fcn.140009590
mov dword [rsi + 0x170], r14d
test r14d, r14d
jne 0x1400420cc
mov byte [rbp + 7], 1
lea rcx, [0x140104a63]
lea r8, [0x140104a98]
mov edx, 0x34
call fcn.1400fc630
jmp 0x140042216
movdqu xmm0, xmmword [rbp - 0x30]
movdqu xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmmword [rbp - 0x50], xmm0
mov byte [rbp + 7], 0
lea rcx, [rbp - 0x50]
mov rdx, rsi
call fcn.140009680
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rax, rdi
test rax, rax
jne 0x14004201e
mov rcx, rdi
mov rdx, rbx
call fcn.1400fc520
ud2
mov byte [rbp + 7], 1
lea r8, [0x140104e50]
mov rcx, rax
call fcn.1400fc7e0
jmp 0x140042216
mov qword [rbp - 0x50], rdi
mov byte [rbp + 7], 1
lea rax, [0x1401056a0]
mov qword [rsp + 0x20], rax
lea rcx, str.invalid_StateID_valueC:Userslightning.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcutilprimitives.rs_V
lea r9, fcn.140001850
lea r8, [rbp - 0x50]
mov edx, 0x15
call fcn.1400fcae0
jmp 0x140042216
mov byte [rbp + 7], 1
lea rcx, str.called__Option::unwrap____on_a__None__valueC:Userslightning.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfaonepass.rs
lea r8, [0x140104e80]
mov edx, 0x2b
call fcn.1400fc740
ud2
call fcn.1400eef40
ud2