joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803bb990
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rcx, [0x1805f2c0d]
call fcn.1802680d0
mov rax, qword [rsp + 0x30]
lea rcx, [0x18050f030]
mov qword [rax + 0x60], rcx
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x70], 9
mov rax, qword [rsp + 0x30]
lea rcx, [0x18050f830]
mov qword [rax + 0x68], rcx
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x74], 5
add rsp, 0x20
pop rdi
ret
Function at 0x1803c3cd0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
lea rcx, [0x1805f2c49]
call fcn.1802680d0
lea rax, [0x18050fb80]
add rsp, 0x20
pop rdi
ret

Function at 0x1803c3d00
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
lea rcx, [0x1805f2c49]
call fcn.1802680d0
mov dword [rsp + 0x20], 0x80000000
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x40]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x1803c3d5d
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x24]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov ecx, dword [rsp + 0x40]
and ecx, eax
mov eax, ecx
test eax, eax
jne 0x1803c3d5d
jmp 0x1803c3d97
mov eax, dword [rsp + 0x20]
shr eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x48]
and eax, 1
test eax, eax
je 0x1803c3d83
mov eax, dword [rsp + 0x48]
shr eax, 1
xor eax, 0xedb88320
mov dword [rsp + 0x28], eax
jmp 0x1803c3d8d
mov eax, dword [rsp + 0x48]
shr eax, 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x48], eax
jmp 0x1803c3d29
mov eax, dword [rsp + 0x24]
add rsp, 0x30
pop rdi
ret

Function at 0x1803c3e40
Capabilities:
Encrypt data using rc4 prga
Hash data with crc32

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
lea rcx, [0x1805f2c49]
call fcn.1802680d0
nop
mov dword [rsp + 0x20], 0
jmp 0x1803c3e6a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 4
jge 0x1803c3e94
mov eax, dword [rsp + 0x40]
shr eax, 8
mov ecx, dword [rsp + 0x40]
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x18050fb80]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x40], eax
jmp 0x1803c3e60
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1803c3eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
lea rcx, [0x1805f2c49]
call fcn.1802680d0
nop
mov dword [rsp + 0x20], 0
jmp 0x1803c3eda
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 4
jge 0x1803c3f07
mov eax, dword [rsp + 0x40]
shl eax, 8
mov ecx, dword [rsp + 0x40]
shr ecx, 0x18
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x18050ff80]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x40], eax
jmp 0x1803c3ed0
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1803d9310
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x30]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
lea rcx, [0x1805f34e2]
call fcn.1802680d0
cmp qword [0x1805a3dc8], 0
jne 0x1803d93b3
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0xf0000020
mov r9d, 1
lea r8, [0x18058f290]
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1803d93a7
mov dword [rsp + 0x20], 0xf0000028
mov r9d, 1
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1803d93a7
mov eax, 0xffffffff
jmp 0x1803d93e4
mov rax, qword [rsp + 0x38]
mov qword [0x1805a3dc8], rax
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
mov rcx, qword [0x1805a3dc8]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp eax, 1
jne 0x1803d93d8
mov dword [rsp + 0x44], 0
jmp 0x1803d93e0
mov dword [rsp + 0x44], 0xffffffff
mov eax, dword [rsp + 0x44]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180515f40]
call fcn.180267ea0
mov rax, rdi
add rsp, 0x50
pop rdi
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Link function at runtime on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r8, rdx
mov r15, rcx
mov r14d, dword [rdx + 0x90]
add r14, rcx
mov eax, 1
mov ecx, 0xc
cmp dword [rdx + 0xe8], 0
cmovne eax, ecx
mov edx, dword [rdx + rax*8 + 0x8c]
mov ecx, dword [r8 + rax*8 + 0x88]
add rcx, r15
lea r9, [rsp + 0x60]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop dword [rax + rax]
mov eax, dword [r14 + 0xc]
test eax, eax
je 0x1400010d5
lea rcx, [r15 + rax]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov edi, dword [r14 + 0x10]
add rdi, r15
mov qword [rsp + 0x28], rdi
mov eax, dword [r14]
test eax, eax
lea rbx, [r15 + rax]
jne 0x14000108f
mov rbx, rdi
mov qword [rsp + 0x20], rbx
mov rax, qword [rbx]
test rax, rax
je 0x1400010ca
mov rcx, rsi
jns 0x1400010a6
movzx edx, ax
jmp 0x1400010ad
lea rdx, [r15 + 2]
add rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi], rax
add rdi, 8
mov qword [rsp + 0x28], rdi
add rbx, 8
mov qword [rsp + 0x20], rbx
jmp 0x140001094
add r14, 0x14
mov qword [rsp + 0x30], r14
jmp 0x140001060
jmp 0x1400010d7
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x1400011a0
Capabilities:
Create thread

Disassembly:
push rbx
mov eax, 0x56630
call fcn.1400020f0
sub rsp, rax
lea rcx, [rsp + 0x30]
call fcn.140001380
lea rcx, [rsp + 0x30]
call fcn.140001250
mov rbx, rax
test rax, rax
jne 0x1400011d4
add rsp, 0x56630
pop rbx
ret
mov qword [rsp + 0x56648], rdi
mov rcx, rbx
movsxd rdi, dword [rax + 0x3c]
add rdi, rbx
mov rdx, rdi
call section..text
cmp dword [rdi + 0xb0], 0
je 0x14000120b
mov r8, rbx
sub r8, qword [rdi + 0x30]
je 0x14000120b
mov rdx, rdi
mov rcx, rbx
call fcn.1400010f0
mov r8d, dword [rdi + 0x28]
lea rax, [rsp + 0x56640]
mov qword [rsp + 0x28], rax
add r8, rbx
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [rsp + 0x56648]
mov eax, 1
add rsp, 0x56630
pop rbx
ret
Function at 0x140001250
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x40
mov r15, rcx
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov eax, 0x5a4d
cmp ax, word [rcx]
je 0x140001285
xor eax, eax
jmp 0x14000135c
movsxd rsi, dword [rcx + 0x3c]
add rsi, r15
cmp dword [rsi], 0x4550
je 0x14000129b
xor eax, eax
jmp 0x14000135c
mov eax, 0x8664
cmp ax, word [rsi + 4]
je 0x1400012ad
xor eax, eax
jmp 0x14000135c
cmp dword [rsi + 0xf8], 0
je 0x1400012bd
xor eax, eax
jmp 0x14000135c
lea rdi, [rsi + 0x108]
mov qword [rsp + 0x30], rdi
mov edx, dword [rsi + 0x50]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x14000130c
mov edx, dword [rsi + 0x50]
xor ecx, ecx
lea r9d, [rax + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
mov qword [rsp + 0x28], rax
test r14, r14
jne 0x140001315
xor eax, eax
jmp 0x14000135c
mov r8d, dword [rsi + 0x54]
mov rdx, r15
mov rcx, r14
call fcn.140002fd0
mov dword [rsp + 0x20], ebx
movzx eax, word [rsi + 6]
cmp ebx, eax
jge 0x140001352
mov r8d, dword [rdi + 0x10]
mov edx, dword [rdi + 0x14]
add rdx, r15
mov ecx, dword [rdi + 0xc]
add rcx, r14
call fcn.140002fd0
add rdi, 0x28
mov qword [rsp + 0x30], rdi
inc ebx
jmp 0x140001324
jmp 0x140001359
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret

Function at 0x140001f30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov r11d, edx
mov rbx, rcx
test r9d, r9d
jle 0x140001f6e
nop dword [rax]
nop word [rax + rax]
mov eax, r10d
lea r8, [r8 + 1]
cdq
inc r10d
idiv r11d
movsxd rax, edx
movzx ecx, byte [rax + rbx]
xor byte [r8 - 1], cl
cmp r10d, r9d
jl 0x140001f50
mov rbx, qword [rsp + 8]
ret
Function at 0x1400045b0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140004384
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004384
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004384
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004384
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004384
cmp dword [rcx + 0x84], 0xe
jbe 0x140004384
cmp dword [rcx + 0xf8], esi
je 0x140004384
mov ecx, r14d
call fcn.1400044cc
mov ecx, 2
call fcn.1400069fc
nop
cmp byte [0x14006c438], 0
jne 0x14000444e
mov r15d, 1
mov eax, r15d
xchg dword [0x14006c42c], eax
test ebx, ebx
jne 0x1400043f7
mov rdi, qword [0x14006b7f8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14006c430]
cmp rcx, rax
je 0x1400043ee
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140002724]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14006c448]
jmp 0x140004403
cmp ebx, r15d
jne 0x140004409
lea rcx, [0x14006c460]
call fcn.140004ac0
nop
test ebx, ebx
jne 0x140004420
lea rdx, [0x14000c2c0]
lea rcx, [0x14000c2a0]
call fcn.140004244
lea rdx, [0x14000c2d0]
lea rcx, [0x14000c2c8]
call fcn.140004244
movzx eax, byte [0x14006c438]
test esi, esi
cmove eax, r15d
mov byte [0x14006c438], al
jmp 0x14000444e
mov ecx, 2
call fcn.140006a50
test esi, esi
jne 0x140004465
mov ecx, r14d
call fcn.140004480
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140004314
Function at 0x140015f40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400160cb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1400a9488]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140033100
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x140015fa5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140015fb4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x140015fd3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140015fe3
cmp rbx, 0x1000
jae 0x140015fab
jmp 0x14001604d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140015ff5
xor edx, edx
jmp 0x140016044
mov rcx, qword [0x1400a9488]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140033100
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x140015fd9
jmp 0x140015fc8
call fcn.1400644a0
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.140036aa0
lea rax, [0x1400e135e]
mov ebx, 0x18
nop dword [rax]
call fcn.1400372e0
mov rax, qword [rsp + 0x38]
call fcn.140037040
lea rax, [0x1400e1877]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.1400372e0
mov rax, qword [rsp + 0x30]
call fcn.140037040
call fcn.140036cc0
call fcn.140036b00
lea rax, [0x1400e3abb]
mov ebx, 0x21
call fcn.140035060
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140060ec0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140015f40
Function at 0x140016100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140016326
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x1400a9480]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140033180
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140016173
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x140016182
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x1400161a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x1400161b5
cmp rbx, 0x1000
jae 0x140016179
nop
jmp 0x140016238
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x1400161cd
xor esi, esi
jmp 0x14001622a
mov rax, qword [0x1400a9480]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.140033180
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x1400161ab
jmp 0x140016196
call fcn.1400644a0
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x1400162c0
nop dword [rax + rax]
call fcn.140036aa0
lea rax, [0x1400e1890]
mov ebx, 0x19
call fcn.1400372e0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.140037040
lea rax, [0x1400e1877]
mov ebx, 0x19
call fcn.1400372e0
mov eax, dword [rsp + 0x34]
call fcn.140037040
nop
call fcn.140036cc0
call fcn.140036b00
lea rax, [0x1400dde45]
mov ebx, 0xd
call fcn.140035060
nop dword [rax + rax]
cmp eax, 0x5af
je 0x140016260
call fcn.140036aa0
lea rax, [0x1400e1890]
mov ebx, 0x19
call fcn.1400372e0
mov rax, qword [rsp + 0x38]
call fcn.140037040
lea rax, [0x1400e1877]
mov ebx, 0x19
call fcn.1400372e0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.140037040
call fcn.140036cc0
call fcn.140036b00
lea rax, [0x1400e339f]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.140035060
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140060ec0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140016100
Function at 0x140022360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140022466
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x1400223a3
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x14002245b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.1400230c0
test rax, rax
je 0x14002245b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x1400224a0]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.140060da0
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x140022449
xor eax, eax
jmp 0x140022453
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x140022391
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.140060ec0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.140022360
Function at 0x140033380
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x60], 0
mov rcx, qword [0x140205870]
mov rcx, qword gs:[rcx]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rcx + 0x3c0], 8
lea rdx, [rsp + 0x20]
mov qword [rcx + 0x3c8], rdx
mov rax, qword [rsp + 0x18]
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140032f20
mov qword [rsp + 0x60], rax
add rsp, 8
pop rbp
ret
Function at 0x14003ff80
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x140205610]
test rcx, rcx
jne 0x14003ffa4
xor ecx, ecx
xor edx, edx
jmp 0x14003ffb9
call fcn.140053720
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.14003ff20
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.1400398e0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x140040026
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x140040062
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x140040280]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.140060da0
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x1400400cb
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x140040200]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.140060da0
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.14003ff20
mov rcx, qword [rsp + 0x20]
mov al, byte [0x140181cf8]
test al, al
je 0x14004010b
lea rax, [0x1400e77d0]
mov qword [rsp], rax
call fcn.140060da0
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.14003ff20
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x140040158
lea rax, fcn.14003b140
mov qword [rsp], rax
call fcn.140060da0
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.14003ff20
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x140181ce8]
test al, al
je 0x1400401e4
lea rax, [0x1400e77c8]
mov qword [rsp], rax
call fcn.140060da0
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.14003ff20
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret
Function at 0x140044ce0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140044e2a
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x140044cf2
cmp edx, ecx
jne 0x140044e18
nop word [rax + rax]
test rsi, rsi
jne 0x140044e18
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x140044d54
nop
call fcn.140064960
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.140044c20
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x140044e13
mov rdx, qword [0x1401806c0]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
lea rdx, [rdx + rsi*4]
cmp ecx, 0x20
sbb esi, esi
and edi, esi
lock or dword [rdx], edi
mov rdx, qword [0x140181c50]
mov qword [rax + 8], rdx
mov rdx, rax
nop
mov qword [0x140181c50], rax
nop
mov esi, 1
lea rdi, [0x140181c58]
lock xadd dword [rdi], esi
mov rsi, qword [rdx + 0x1248]
shr rsi, 0x3d
test sil, sil
jne 0x140044e02
mov rax, qword [rsp + 0x10]
movabs rcx, 0x1fffffffffffffff
and rcx, rax
bts rcx, 0x3f
nop
nop
xchg qword [rdx + 0x1248], rcx
add rsp, 0x18
pop rbp
ret
lea rax, [0x1400e506e]
mov ebx, 0x28
call fcn.140035060
call fcn.140033ca0
lea rax, [0x1400e423c]
mov ebx, 0x23
call fcn.140035060
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140060ec0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140044ce0

Function at 0x140048920
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x140048968
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x140048968
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x140048978
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [0x1400a9430]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.140033100
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x140048a51
mov rcx, qword [rsp + 0x58]
mov rdx, qword [0x1400a9438]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.140033380
xorps xmm15, xmm15
mov r14, qword [0x140205870]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x140048a51
cmp qword [rcx + 8], rax
ja 0x140048973
mov eax, 1
add rsp, 0x70
pop rbp
ret