joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460de0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x460e99
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00460ee0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046b580
xorps xmm15, xmm15
mov r14, qword [0x01bfb078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00460de0
Function at 0x46d7c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x01bfba60]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x01bfaca6], 0
je 0x46d7f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x01bfbe60]
aesenc xmm0, xmmword [0x01bfbe70]
aesenc xmm0, xmmword [0x01bfbe80]
movq rax, xmm0
ret
jmp 0x40af20

Function at 0x470100
Capabilities:
Reference http user-agent string

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, 2
lea rbx, [0x0109e863]
mov ecx, 0x1c
nop
call fcn.00459ea0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xorps xmm15, xmm15
mov r14, qword [0x01bfb078]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x43d260
Function at 0x48a8e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48ab59
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov edx, dword [rax]
xor ecx, ecx
xor ebx, ebx
xor esi, esi
xor edi, edi
jmp 0x48a90c
mov rax, r8
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x1e], sil
mov byte [rsp + 0x1d], bl
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x20], edx
mov r8d, edx
and edx, 5
mov dword [rsp + 0x2c], edx
cmp edx, 1
je 0x48a937
xor r9d, r9d
jmp 0x48a964
mov rax, rcx
call fcn.00467d20
mov rcx, qword [rsp + 0x38]
mov edx, dword [rsp + 0x2c]
movzx ebx, byte [rsp + 0x1d]
movzx esi, byte [rsp + 0x1e]
mov rdi, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x20]
mov r9d, eax
mov rax, qword [rsp + 0x50]
test r9b, r9b
jne 0x48aa95
mov r9d, r8d
or r8d, 1
test r9d, 4
mov r10d, r9d
cmove r9d, r8d
lea r8d, [r9 + 8]
test edx, edx
cmovne r9d, r8d
test bl, bl
je 0x48a9a0
bt r10d, 0
jae 0x48a9a0
or r9d, 4
nop dword [rax + rax]
test sil, sil
je 0x48a9f0
bt r9d, 1
jb 0x48a9ec
mov dword [rsp + 0x24], r9d
lea rax, [0x010a3926]
mov ebx, 0x1e
nop dword [rax]
call fcn.00467900
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov edx, dword [rsp + 0x2c]
movzx ebx, byte [rsp + 0x1d]
movzx esi, byte [rsp + 0x1e]
mov rdi, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x24]
mov r10d, dword [rsp + 0x20]
and r9d, 0xfffffffd
mov r8, rax
mov eax, r10d
lock cmpxchg dword [r8], r9d
sete r9b
nop
test r9b, r9b
jne 0x48aa0d
mov edx, dword [r8]
jmp 0x48a909
test edx, edx
je 0x48ab4f
test rdi, rdi
jne 0x48aa2f
call fcn.00468d00
mov rcx, qword [rsp + 0x30]
test rcx, rcx
mov r8, qword [rsp + 0x50]
mov rdi, rax
mov qword [rsp + 0x30], rdi
setne bl
lea rax, [r8 + 4]
mov ecx, 1
call fcn.004686a0
movzx edx, byte [rsp + 0x1d]
test dl, dl
je 0x48aa5a
mov rcx, qword [rsp + 0x30]
mov eax, 1
jmp 0x48aa70
call fcn.00468d00
mov rcx, qword [rsp + 0x30]
sub rax, rcx
cmp rax, 0xf4240
setg al
mov rdx, qword [rsp + 0x50]
mov esi, dword [rdx]
bt esi, 2
jb 0x48aafb
mov r8, rdx
mov edx, esi
xor ecx, ecx
mov ebx, eax
mov esi, 1
mov rdi, qword [rsp + 0x30]
jmp 0x48a909
test sil, sil
jne 0x48aacb
bt r8d, 1
nop
jb 0x48aacb
mov edx, r8d
sar r8d, 3
test r8d, r8d
je 0x48aacb
mov r8d, edx
or edx, 2
mov r9, rax
mov eax, r8d
lock cmpxchg dword [r9], edx
sete dl
test dl, dl
je 0x48aacb
mov esi, 1
mov byte [rsp + 0x1e], sil
call fcn.00467da0
mov rcx, qword [rsp + 0x38]
inc rcx
mov rax, qword [rsp + 0x50]
mov edx, dword [rax]
mov r8, rax
movzx ebx, byte [rsp + 0x1d]
movzx esi, byte [rsp + 0x1e]
mov rdi, qword [rsp + 0x30]
jmp 0x48a909
mov byte [rsp + 0x1f], al
mov dword [rsp + 0x28], esi
test esi, 3
jne 0x48ab14
mov ecx, esi
sar esi, 3
test esi, esi
jne 0x48ab33
lea rax, [0x010a3926]
mov ebx, 0x1e
call fcn.00467900
movzx eax, byte [rsp + 0x1f]
mov ecx, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
test al, al
je 0x48ab46
sar ecx, 3
cmp ecx, 1
je 0x48ab46
mov eax, 0xfffffff9
jmp 0x48ab4b
mov eax, 0xfffffff5
lock xadd dword [rdx], eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
nop
call fcn.0046b6c0
mov rax, qword [rsp + 8]
jmp fcn.0048a8e0
Function at 0x48abe0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48aca2
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
lea edx, [rbx + 1]
bt edx, 0
nop
jb 0x48ac25
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
lea rax, [0x010a3944]
mov ebx, 0x1e
call fcn.00467940
mov rax, qword [rsp + 0x28]
mov ebx, dword [rsp + 0x30]
bt ebx, 2
jae 0x48ac54
test byte [rax], al
add rax, 4
mov ebx, 1
mov ecx, 1
nop dword [rax + rax]
call fcn.00468640
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov ebx, dword [rcx]
mov rax, rcx
mov edx, ebx
sar ebx, 3
test ebx, ebx
je 0x48ac98
nop dword [rax]
test edx, 7
jne 0x48ac98
lea esi, [rdx - 8]
or esi, 2
mov rcx, rax
mov eax, edx
lock cmpxchg dword [rcx], esi
sete dl
test dl, dl
je 0x48ac4f
lea rax, [rcx + 4]
xor ebx, ebx
mov ecx, 1
call fcn.00468640
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
jmp fcn.0048abe0
Function at 0x4965c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4966f5
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop
cmp rcx, 0x12
ja 0x496640
cmp rcx, 0x11
jne 0x49660f
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x4965fe
lea rax, [0x0144d348]
jmp 0x496602
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x12
jne 0x4966bf
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x49662e
lea rax, [0x0144d348]
jmp 0x496632
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x15
jne 0x496669
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x496658
lea rax, [0x0144d348]
jmp 0x49665c
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x16
jne 0x496693
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x496682
lea rax, [0x0144d348]
nop
jmp 0x496686
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
cmp rcx, 0x17
jne 0x4966bf
mov rcx, qword [rax + 0x30]
nop dword [rax]
test rcx, rcx
je 0x4966ae
lea rax, [0x0144d348]
jmp 0x4966b2
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
nop
call fcn.00495640
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x010a3692]
call fcn.00453080
nop
call fcn.0040bea0
mov rbx, rax
lea rax, [0x00eec920]
call fcn.00439660
nop
mov qword [rsp + 8], rax
call fcn.0046b6c0
mov rax, qword [rsp + 8]
jmp fcn.004965c0

Function at 0x496ce0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x496da9
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx esi, byte [rax + 0x17]
and esi, 0x1f
nop
cmp rsi, 0x13
jne 0x496d76
movzx esi, byte [rax + 0x14]
test sil, 1
je 0x496d17
mov ecx, 0x48
jmp 0x496d1c
mov ecx, 0x38
movzx edx, word [rax + 0x30]
test dx, dx
jne 0x496d2b
xor edx, edx
xor esi, esi
jmp 0x496d38
lea rsi, [rax + rcx]
cmp rdx, 0x100000
ja 0x496d6c
cmp rbx, rdx
jae 0x496d61
mov rcx, qword [rsi + rbx*8]
test rcx, rcx
je 0x496d4f
lea rax, [0x0144d348]
jmp 0x496d53
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov rax, rbx
mov rcx, rdx
call fcn.0046dd20
mov ebx, 0x100000
call fcn.0046de20
call fcn.00495640
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x010a127c]
call fcn.00453080
call fcn.0040bea0
mov rbx, rax
lea rax, [0x00eec920]
call fcn.00439660
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00496ce0
Function at 0x496de0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x496e5c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx ecx, byte [rax + 0x17]
and ecx, 0x1f
nop dword [rax + rax]
cmp rcx, 0x15
jne 0x496e29
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x496e18
lea rax, [0x0144d348]
jmp 0x496e1c
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00495640
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x010a1299]
call fcn.00453080
call fcn.0040bea0
mov rbx, rax
lea rax, [0x00eec920]
call fcn.00439660
nop
mov qword [rsp + 8], rax
call fcn.0046b6c0
mov rax, qword [rsp + 8]
jmp fcn.00496de0

Function at 0x4970c0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4971ad
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movzx edx, byte [rax + 0x17]
and edx, 0x1f
nop
cmp rdx, 0x13
jne 0x49717a
movzx edx, byte [rax + 0x14]
test dl, 1
je 0x4970fa
mov ecx, 0x48
jmp 0x4970ff
mov ecx, 0x38
movzx edx, word [rax + 0x32]
and edx, 0x7fff
test dx, dx
jne 0x497114
xor edx, edx
xor esi, esi
jmp 0x497140
movzx esi, word [rax + 0x30]
add edx, esi
lea rdi, [rax + rcx]
movzx ecx, dx
cmp rsi, rcx
ja 0x497173
sub rcx, rsi
mov rdx, rcx
neg rcx
shl rsi, 3
sar rcx, 0x3f
and rsi, rcx
add rsi, rdi
nop dword [rax]
cmp rbx, rdx
jae 0x497168
mov rcx, qword [rsi + rbx*8]
test rcx, rcx
je 0x497157
lea rax, [0x0144d348]
jmp 0x49715b
xor eax, eax
xor ecx, ecx
mov rbx, rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rax, rbx
mov rcx, rdx
call fcn.0046dd20
mov eax, esi
call fcn.0046dea0
call fcn.00495640
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x010a36ce]
call fcn.00453080
call fcn.0040bea0
mov rbx, rax
lea rax, [0x00eec920]
call fcn.00439660
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004970c0
Function at 0x49b900
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ba08
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
movzx r9d, byte [rsi + 0x17]
test r9b, 0x40
jne 0x49b9f4
mov r9, qword [rsi + 0x20]
test byte [r9], al
mov rdx, qword [rsi + 8]
shr rdx, 3
mov rsi, qword [rsi]
lea rcx, [rdx + 7]
shr rcx, 3
cmp rcx, 0x40000000
ja 0x49b9e7
shr rsi, 3
xor r10d, r10d
jmp 0x49b964
lea r10, [r12 + 1]
mov rcx, r13
cmp r10, rdx
jae 0x49b994
mov r11, r10
shr r10, 3
cmp r10, rcx
jae 0x49b9df
movzx r10d, byte [r9 + r10]
mov r12, r11
and r11d, 7
mov r13, rcx
mov rcx, r11
shr r10b, cl
test r10b, 1
je 0x49b95c
xor ecx, ecx
jmp 0x49b9b5
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, r10
movzx r10d, byte [rax + r11]
and r15d, 7
bts r10d, r15d
mov byte [rax + r11], r10b
inc rcx
cmp r8, rcx
jbe 0x49b95c
mov r10, rcx
imul rcx, rsi
lea r11, [rcx + rdi]
add r11, r12
mov r15, r11
shr r11, 3
cmp rbx, r11
ja 0x49b99e
mov rax, r11
mov rcx, rbx
call fcn.0046dd40
mov rax, r10
call fcn.0046dd40
mov rdx, rcx
mov ebx, 0x40000000
call fcn.0046de40
lea rax, [0x00eec920]
lea rbx, [0x01433fa0]
call fcn.00439660
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.0049b900
Function at 0x4a9860
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a99e6
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rdx, rcx
and ecx, 0x1f
mov qword [rsp + 0x18], rcx
cmp rcx, 0x15
ja 0x4a9905
cmp rcx, 0x12
je 0x4a9946
nop dword [rax]
cmp rcx, 0x13
jne 0x4a98f5
bt edx, 9
jb 0x4a98e4
nop
cmp qword [rax], 8
jne 0x4a99d2
cmp qword [rax + 8], 0
nop dword [rax]
je 0x4a99d2
bt edx, 7
jae 0x4a98cf
mov rbx, qword [rbx]
test rbx, rbx
je 0x4a98d7
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x004b0f60]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x15
je 0x4a9946
nop dword [rax + rax]
jmp 0x4a9989
cmp rcx, 0x16
jne 0x4a9937
cmp qword [rax + 8], 0
jne 0x4a9946
mov rax, qword [rbx]
mov qword [rsp + 0x10], rax
call fcn.00466900
nop
test al, al
je 0x4a99bf
mov rax, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp rcx, 0x17
je 0x4a9969
nop dword [rax]
cmp rcx, 0x1a
jne 0x4a9989
cmp qword [rax], 8
jne 0x4a9976
cmp qword [rax + 8], 0
je 0x4a9976
bt edx, 7
jae 0x4a995c
mov rbx, qword [rbx]
mov rax, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [rbx]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x00eec920]
lea rbx, [0x01433e00]
call fcn.00439660
lea rax, [0x00f8de80]
call fcn.0040e840
mov qword [rax + 8], 0x15
lea rcx, [0x01092625]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00f24ae0]
call fcn.00439660
lea rax, [0x00eec920]
lea rbx, [0x01433d30]
call fcn.00439660
lea rax, [0x00eec920]
lea rbx, [0x01433e00]
call fcn.00439660
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004a9860
Function at 0x4acdc0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4acf46
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov rdx, qword [rax + 0x98]
mov rax, rbx
call rdx
nop dword [rax + rax]
cmp rax, 0x17
jne 0x4acf2d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jl 0x4acf1a
mov rdx, qword [rsp + 0x48]
nop dword [rax]
test rdx, rdx
jl 0x4acf07
cmp rcx, rdx
jg 0x4acef4
lea rax, [0x00fb5920]
call fcn.0040e840
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 0x48]
mov rax, qword [rsp + 0x38]
call rdx
mov rcx, qword [0x0144d350]
lea rdx, [0x0144d348]
cmp rax, rdx
jne 0x4acee5
mov rax, rbx
mov rbx, qword [rsp + 0x48]
call fcn.00466060
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x18]
mov qword [rbx + 8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 0x10], rcx
cmp dword [0x01bfb600], 0
jne 0x4ace98
mov qword [rbx], rax
jmp 0x4acea5
mov rdi, rbx
nop dword [rax + rax]
call fcn.0046d880
mov rdx, qword [0x0144d350]
mov rax, qword [rsp + 0x30]
lea rsi, [0x0144d348]
cmp rax, rsi
jne 0x4aced1
mov rax, qword [rsp + 0x38]
mov ecx, 0x97
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, rdx
lea rcx, [0x0103e1c0]
nop dword [rax + rax]
call fcn.0040bb40
mov rbx, rcx
lea rcx, [0x0103e1c0]
call fcn.0040bb40
lea rax, [0x00eec920]
lea rbx, [0x01433e90]
call fcn.00439660
lea rax, [0x00eec920]
lea rbx, [0x01433e80]
call fcn.00439660
lea rax, [0x00eec920]
lea rbx, [0x01433e60]
call fcn.00439660
lea rax, [0x00eec920]
lea rbx, [0x01433e50]
nop dword [rax + rax]
call fcn.00439660
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046b6c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004acdc0
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140012df0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011262
Capabilities:
Resolve dns

Disassembly:
jmp 0x140011860
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400210a5]
call fcn.140011361
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 8], rax
mov dword [rbp + 0x24], 0
jmp 0x140011898
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp qword [rbp + 8], 0
je 0x1400118bd
movsxd rax, dword [rbp + 0x24]
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
mov rdx, qword [rcx + rax*8]
lea rcx, [0x140019c24]
call fcn.14001118b
jmp 0x140011890
xor eax, eax
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001126c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014140
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014160
xor al, al
jmp 0x1400141e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014173
xor al, al
jmp 0x1400141e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001419d
xor al, al
jmp 0x1400141e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400141b1
xor al, al
jmp 0x1400141e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400141c3
xor al, al
jmp 0x1400141e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400141df
xor al, al
jmp 0x1400141e1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400061a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14030b0c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
mov rsi, qword [rdx + 0x10]
lea rcx, [rsi + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
xor r8d, r8d
mov rcx, rdi
call fcn.14000f220
mov r8, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140006202
mov r8, qword [rdi]
xor edx, edx
lea r10, [rsi - 2]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r10, r10
je 0x1400062de
nop dword [rax + rax]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000622d
mov rax, qword [rbx]
movzx eax, byte [rax + rdx]
shr rax, 2
movzx eax, byte [rax + r11]
mov byte [r8], al
cmp qword [rbx + 0x18], 0xf
jbe 0x14000624d
mov rax, qword [rbx]
lea r9, [rdx + rax]
jmp 0x140006254
lea r9, [rbx + rdx]
mov rax, rbx
movzx ecx, byte [rax + rdx + 1]
shr rcx, 4
movsx rax, byte [r9]
and eax, 3
shl rax, 4
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [r8 + 1], al
cmp qword [rbx + 0x18], 0xf
jbe 0x140006284
mov rax, qword [rbx]
lea r9, [rax + 1]
jmp 0x14000628b
lea r9, [rbx + 1]
mov rax, rbx
add r9, rdx
movzx ecx, byte [rax + rdx + 2]
shr rcx, 6
movsx rax, byte [r9]
and eax, 0xf
shl rax, 2
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [r8 + 2], al
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400062bb
mov rax, qword [rbx]
movsx rax, byte [rax + rdx + 2]
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r8 + 3], al
add r8, 4
add rdx, 3
cmp rdx, r10
jb 0x140006220
cmp rdx, rsi
jae 0x140006394
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400062f4
mov rax, qword [rbx]
movzx eax, byte [rax + rdx]
shr rax, 2
movzx eax, byte [rax + r11]
mov byte [r8], al
lea rax, [rsi - 1]
cmp rdx, rax
jne 0x140006336
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000631a
mov rax, qword [rbx]
movsx rax, byte [rax + rdx]
and eax, 3
add rax, rax
movzx eax, byte [r11 + rax*8]
mov byte [r8 + 1], al
mov al, 0x3d
add r8, 2
jmp 0x14000638c
cmp qword [rbx + 0x18], 0xf
jbe 0x140006346
mov rax, qword [rbx]
lea r9, [rdx + rax]
jmp 0x14000634d
lea r9, [rdx + rbx]
mov rax, rbx
movzx ecx, byte [rax + rdx + 1]
shr rcx, 4
movsx rax, byte [r9]
and eax, 3
shl rax, 4
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [r8 + 1], al
add r8, 2
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000637e
mov rax, qword [rbx]
movsx rax, byte [rax + rdx + 1]
and eax, 0xf
movzx eax, byte [r11 + rax*4]
mov byte [r8], al
mov byte [r8 + 1], 0x3d
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400063ca
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400063c5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400063fd
mov rcx, r8
call fcn.1400e81f4
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400e7f50
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3