joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ed80
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r13d, 0x73
mov dword [rbp - 0x20], 0x26000a
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], r13w
mov dword [rbp - 0x1c], 0x2b0031
mov dword [rbp - 0x18], 0x3f0036
mov dword [rbp - 0x14], 0x33002d
mov dword [rbp - 0x10], 0x20003a
call fcn.140004fd0
mov rcx, rax
call 0x14000ed80
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x69
mov dword [rbp - 0x20], 0x26000a
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2b0031
mov dword [rbp - 0x18], 0x3f0036
mov dword [rbp - 0x14], 0x40005c
call fcn.1400022a0
mov rcx, rax
call 0x14000ed80
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x17002f
mov dword [rbp - 0x1c], 0x90007
mov dword [rbp - 0x18], 0x73001f
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x14000ed80
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000ede2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.1400091b0
test al, al
jne 0x14000edf4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000edb0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x1400137c0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112a3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014b10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014b30
xor al, al
jmp 0x140014bb1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014b43
xor al, al
jmp 0x140014bb1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014b6d
xor al, al
jmp 0x140014bb1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014b81
xor al, al
jmp 0x140014bb1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014b93
xor al, al
jmp 0x140014bb1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014baf
xor al, al
jmp 0x140014bb1
mov al, 1
add rsp, 0x38
ret
Function at 0x180001310
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
movups xmm0, xmmword [0x1800020a8]
mov eax, dword [0x1800020b8]
xor esi, esi
cmp word [0x1800020ba], si
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], eax
je 0x180001371
mov edi, esi
lea r8, [rsp + 0x20]
mov eax, 0x51eb851f
mul edi
mov eax, 1
shr edx, 4
sub ax, dx
movzx eax, ax
imul edx, eax, 0x32
add dx, di
inc edi
xor word [r8], dx
lea r8, [r8 + 2]
cmp edi, 0xa
jl 0x180001347
lea rcx, [rsp + 0x20]
call fcn.180001154
mov rbx, rax
lea rdi, [rsp + 0x20]
movzx eax, si
mov ecx, 0xa
rep stosw word [rdi], ax
mov rcx, rbx
mov edx, 0xde642d6
call section..text
mov edx, 0xa914b951
mov qword [section..data], rax
mov rcx, rbx
call section..text
mov edx, 0x4b6665ec
mov qword [0x180003008], rax
mov rcx, rbx
call section..text
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov qword [0x180003010], rax
add rsp, 0x40
pop rdi
ret

Function at 0x180001454
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp dword [0x1800020a0], 0x539
jle 0x1800014ae
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_IsWellKnownSid]
add rsp, 0x28
ret
Function at 0x180001d24
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movups xmm0, xmmword [str.GPYZ]
xor r13d, r13d
cmp word [0x1800021da], r13w
movups xmmword [rax - 0x48], xmm0
mov eax, dword [0x1800021d8]
mov dword [rsp + 0x30], eax
je 0x180001d93
mov edi, r13d
lea r8, [rsp + 0x20]
mov eax, 0x4ec4ec4f
mul edi
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x34
movzx eax, di
inc edi
sub ax, cx
add ax, 0x32
xor word [r8], ax
lea r8, [r8 + 2]
cmp edi, 0xa
jl 0x180001d6a
lea rcx, [rsp + 0x20]
call fcn.180001154
mov rsi, rax
lea rdi, [rsp + 0x20]
movzx eax, r13w
lea r9, [0x180003020]
mov ecx, 0xa
mov ebx, r13d
rep stosw word [rdi], ax
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
add rcx, rsi
mov r15d, dword [rcx + 0x1c]
mov r14d, dword [rcx + 0x20]
add r15, rsi
mov r12d, dword [rcx + 0x24]
add r14, rsi
mov ebp, dword [rcx + 0x18]
add r12, rsi
lea eax, [rbp - 1]
mov ecx, 0x775a
mov ebp, eax
mov r8d, eax
mov eax, dword [r14 + rax*4]
add rax, rsi
cmp word [rax], cx
jne 0x180001e46
mov ecx, 4
jmp 0x180001e09
imul ecx, ecx, 0x21
inc rax
add ecx, edx
movsx edx, byte [rax]
test edx, edx
jne 0x180001e01
mov edi, ebx
add rdi, rdi
mov dword [r9 + rdi*8 + 8], ecx
movzx eax, word [r12 + r8*2]
mov ecx, dword [r15 + rax*4]
mov dword [r9 + rdi*8 + 0xc], ecx
add rcx, rsi
call fcn.180001c18
inc ebx
lea r9, [0x180003020]
mov qword [r9 + rdi*8 + 0x10], rax
cmp ebx, 0x1f4
je 0x180001e4a
test ebp, ebp
jne 0x180001de1
lea eax, [rbx - 1]
mov dword [0x180003020], ebx
mov edi, r13d
test eax, eax
je 0x180001ee3
mov eax, ebx
mov edx, r13d
sub eax, edi
cmp eax, 1
je 0x180001ed6
lea rbp, [0x180003020]
lea r10d, [rdx + 1]
mov r9d, edx
add r9, r9
mov r8d, r10d
add r8, r8
mov esi, dword [rbp + r9*8 + 0xc]
mov r11d, dword [rbp + r8*8 + 0xc]
cmp esi, r11d
jbe 0x180001ec8
mov eax, dword [rbp + r8*8 + 8]
mov edx, dword [rbp + r9*8 + 8]
mov rcx, qword [rbp + r9*8 + 0x10]
mov dword [rbp + r9*8 + 8], eax
mov rax, qword [rbp + r8*8 + 0x10]
mov qword [rbp + r9*8 + 0x10], rax
mov dword [rbp + r9*8 + 0xc], r11d
mov dword [rbp + r8*8 + 8], edx
mov dword [rbp + r8*8 + 0xc], esi
mov qword [rbp + r8*8 + 0x10], rcx
mov ebx, dword [0x180003020]
mov ecx, ebx
mov edx, r10d
sub ecx, edi
dec ecx
cmp r10d, ecx
jb 0x180001e71
inc edi
lea ecx, [rbx - 1]
cmp edi, ecx
jb 0x180001e5e
lea r11, [rsp + 0x40]
mov eax, 1
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140008710
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140008738
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000875e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140008760
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400087b9
test ecx, ecx
jle 0x140008799
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400087b9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400087b9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x1400087e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140008811
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14000882f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000884b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000884d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008889
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000891e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400088c4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400088fe
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000891e
cmp rbx, rax
ja 0x1400088d0
test rbx, rbx
je 0x14000891e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140008d70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140008d94
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140008dcb
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jae 0x140008dcb
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140008ef4
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140008e0e
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140008e39
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140008ef9
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x140008ef4
cmp eax, 1
jle 0x140008eae
cmp eax, 3
jne 0x140008ef4
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140008ef9
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x140008edf
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140008ef4
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov eax, edi
jne 0x140008ef9
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140009480
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140009549
cmp byte [rcx + 0x71], 0
je 0x140009549
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000953c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400094f8
sub eax, 1
je 0x1400094fc
cmp eax, 2
jne 0x14000953c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14000952a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000953c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x140009560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x80], 0
lea rbx, [rcx + 0x71]
mov rdi, rcx
je 0x14000963a
cmp qword [rcx + 0x68], 0
je 0x1400095dc
cmp byte [rbx], 0
je 0x1400095dc
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x1400095a9
xor al, al
jmp 0x1400095de
mov rcx, qword [rdi + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400095fd
sub eax, 1
je 0x140009600
cmp eax, 2
jne 0x1400095a5
mov byte [rbx], 0
mov al, 1
mov rcx, qword [rdi + 0x80]
xor esi, esi
test al, al
mov ebp, esi
cmovne rbp, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
cmovne rbp, rsi
jmp 0x14000963e
mov byte [rbx], 0
mov rsi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rsi, rax
je 0x140009632
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400095a5
cmp byte [rbx], 0
sete al
jmp 0x1400095de
xor esi, esi
mov ebp, esi
mov rcx, rdi
mov byte [rdi + 0x7c], 0
mov byte [rbx], 0
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov rbx, qword [rsp + 0x68]
mov rax, rbp
mov rbp, qword [rsp + 0x70]
mov qword [rdi + 0x80], rsi
mov rcx, qword [0x14001dbc8]
mov qword [rdi + 0x68], rsi
mov rsi, qword [rsp + 0x78]
mov qword [rdi + 0x74], rcx
add rsp, 0x50
pop rdi
ret
Function at 0x14000d09c
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r15
xor ebx, ebx
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov r10, r8
mov r11, rdx
mov rdi, rcx
mov r9, rcx
cmp r8, 3
jb 0x14000d13c
lea esi, [rbx + 3]
movzx ecx, byte [r11]
add rbx, 3
movzx edx, byte [r11 + 2]
mov eax, ecx
movzx r8d, byte [r11 + 1]
and ecx, 3
shr rax, 2
add r11, 3
shl ecx, 4
add rsi, 3
mov al, byte [rax + r15]
mov byte [r9], al
mov eax, r8d
shr rax, 4
and r8d, 0xf
or rcx, rax
shl r8d, 2
mov al, byte [rcx + r15]
mov byte [r9 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
mov ecx, r8d
or rcx, rax
mov al, byte [rcx + r15]
mov byte [r9 + 2], al
mov al, byte [rdx + r15]
mov byte [r9 + 3], al
add r9, 4
cmp rsi, r10
jbe 0x14000d0cd
lea rax, [rbx + 2]
cmp rax, r10
ja 0x14000d187
movzx ecx, byte [r11]
movzx edx, byte [r11 + 1]
mov eax, ecx
shr rax, 2
and ecx, 3
shl ecx, 4
mov al, byte [rax + r15]
mov byte [r9], al
mov eax, edx
shr rax, 4
and edx, 0xf
or rcx, rax
shl edx, 2
mov al, byte [rcx + r15]
mov byte [r9 + 1], al
mov al, byte [rdx + r15]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
jmp 0x14000d1b6
lea rax, [rbx + 1]
cmp rax, r10
ja 0x14000d1ba
movzx ecx, byte [r11]
mov eax, ecx
and ecx, 3
shr rax, 2
shl ecx, 4
mov al, byte [rax + r15]
mov byte [r9], al
mov cl, byte [rcx + r15]
mov byte [r9 + 1], cl
mov word [r9 + 2], 0x3d3d
add r9, 4
mov rbx, qword [rsp + 8]
sub r9d, edi
mov rsi, qword [rsp + 0x10]
mov eax, r9d
mov rdi, qword [rsp + 0x18]
mov r15, qword [rsp + 0x20]
ret
Function at 0x14000d1dc
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
xor ebx, ebx
lea r13, [0x14001d050]
mov rdi, r8
mov r11, rdx
mov rsi, rcx
mov r10, rcx
mov ebp, ebx
cmp r8, 4
jb 0x14000d2cb
lea r15d, [rbx + 4]
movzx r14d, byte [r11]
cmp r14b, 0x7f
ja 0x14000d360
movzx eax, byte [r11 + 1]
cmp al, 0x7f
ja 0x14000d360
cmp byte [r11 + 2], 0x7f
ja 0x14000d360
cmp byte [r11 + 3], 0x7f
ja 0x14000d360
cmp r14b, 0x3d
je 0x14000d2cb
cmp al, 0x3d
je 0x14000d2cb
cmp byte [r11 + 2], 0x3d
je 0x14000d2cb
cmp byte [r11 + 3], 0x3d
je 0x14000d2cb
movzx r8d, byte [rax + r13]
add rbp, 4
movzx eax, byte [r11 + 2]
mov ebx, r8d
mov cl, byte [r14 + r13]
add r15, 4
shl cl, 2
mov r9b, byte [rax + r13]
movzx eax, byte [r11 + 3]
add r11, 4
mov dl, byte [rax + r13]
mov eax, r8d
shr eax, 4
and dl, 0x3f
and al, 3
shl r8b, 4
or cl, al
mov al, r9b
shr al, 2
mov byte [r10], cl
and al, 0xf
shl r9b, 6
or al, r8b
or r9b, dl
mov byte [r10 + 1], al
mov byte [r10 + 2], r9b
add r10, 3
cmp r15, rdi
jbe 0x14000d21a
lea rax, [rbp + 3]
cmp rax, rdi
ja 0x14000d328
cmp byte [r11], 0x3d
je 0x14000d309
cmp byte [r11 + 1], 0x3d
je 0x14000d309
movzx eax, byte [r11 + 1]
movzx ebx, byte [rax + r13]
movzx eax, byte [r11]
mov cl, byte [rax + r13]
mov eax, ebx
shr eax, 4
and al, 3
shl cl, 2
or cl, al
mov byte [r10], cl
inc r10
add r11, 2
cmp byte [r11 + 2], 0x3d
je 0x14000d360
movzx eax, byte [r11]
shl bl, 4
mov cl, byte [rax + r13]
shr cl, 2
and cl, 0xf
or cl, bl
mov byte [r10], cl
jmp 0x14000d35d
lea rax, [rbp + 2]
cmp rax, rdi
ja 0x14000d360
cmp byte [r11], 0x3d
je 0x14000d360
cmp byte [r11 + 1], 0x3d
je 0x14000d360
movzx eax, byte [r11 + 1]
mov dl, byte [rax + r13]
movzx eax, byte [r11]
shr dl, 4
and dl, 3
mov cl, byte [rax + r13]
shl cl, 2
or dl, cl
mov byte [r10], dl
inc r10
mov rbx, qword [rsp + 0x20]
sub r10d, esi
mov rbp, qword [rsp + 0x28]
mov eax, r10d
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r13
ret

Function at 0x14000d890
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x48
xor ecx, ecx
mov edx, 0x4000
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
and qword [rsp + 0x30], 0
lea rcx, str.._ahcache
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov qword [0x14001d548], rax
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14001d540], rax
test rax, rax
je 0x14000d8f3
cmp rax, 0xffffffffffffffff
setne al
add rsp, 0x48
ret
Function at 0x14000f1a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x14001d148]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x49]
call sub.VCRUNTIME140.dll_memset
movzx eax, byte [rbx + 1]
lea r10, [rbp - 0x59]
movzx r9d, byte [rbx]
lea r11, [rbp - 0x51]
movzx ecx, byte [rbx + 4]
lea r14, [0x140015b50]
movzx r8d, byte [rbx + 8]
shl ecx, 8
shl r9d, 8
or r9d, eax
shl r8d, 8
movzx eax, byte [rbx + 2]
shl r9d, 8
or r9d, eax
movzx eax, byte [rbx + 3]
shl r9d, 8
or r9d, eax
movzx eax, byte [rbx + 5]
or ecx, eax
mov dword [rbp - 0x59], r9d
movzx eax, byte [rbx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
or r8d, eax
mov dword [rbp - 0x55], ecx
movzx eax, byte [rbx + 0xa]
movzx ecx, byte [rbx + 0xc]
shl ecx, 8
shl r8d, 8
or r8d, eax
movzx eax, byte [rbx + 0xb]
shl r8d, 8
or r8d, eax
movzx eax, byte [rbx + 0xd]
or ecx, eax
mov dword [rbp - 0x51], r8d
movzx eax, byte [rbx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xf]
shl ecx, 8
mov ebx, 0x20
or ecx, eax
lea rax, [rbp - 0x59]
sub rsi, rax
mov dword [rbp - 0x4d], ecx
mov edx, dword [r10 + rsi]
lea r9, [r11 + 4]
xor edx, dword [r11 - 4]
xor edx, r8d
xor edx, dword [r9]
mov eax, edx
shr rax, 0x18
movzx r8d, byte [rax + r14]
mov eax, edx
shr eax, 0x10
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + r14]
or r8d, eax
mov eax, edx
shr eax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + r14]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + r14]
or r8d, ecx
mov ecx, r8d
mov eax, r8d
ror ecx, 0xe
rol eax, 0xa
xor ecx, eax
mov eax, r8d
ror eax, 8
xor ecx, eax
mov eax, r8d
rol eax, 2
xor ecx, eax
xor ecx, r8d
mov r8d, dword [r9]
xor ecx, dword [r10]
lea r10, [r10 + 4]
mov dword [r11 + 8], ecx
lea r11, [r9]
sub rbx, 1
jne 0x14000f298
mov ecx, dword [rbp + 0x33]
mov eax, ecx
shr eax, 0x18
mov byte [rdi], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 2], al
mov byte [rdi + 3], cl
mov ecx, dword [rbp + 0x2f]
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 5], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 6], al
mov byte [rdi + 7], cl
mov ecx, dword [rbp + 0x2b]
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 9], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], cl
mov ecx, dword [rbp + 0x27]
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [rdi + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [rdi + 0xe], al
mov byte [rdi + 0xf], cl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140012700
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret