joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff786ffb640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x7ff786ffb760
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x7ff786ffb760
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x7ff786ffb800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x7ff786ffb8a0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x7ff786ffb8a0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret
Function at 0x7ff786ffb920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x7ff786ffb960
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x7ff786ffb960
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x7ff786ffbd60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x7ff786ffbe60
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x7ff786ffbe60
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x7ff786ffbf00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x7ff786ffbfa0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x7ff786ffbfa0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x7ff786ffc020
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x7ff786ffc060
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x7ff786ffc060
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x7ff786ffcad0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.7ff786ffcb40
shl edx, 4
test eax, eax
jne 0x7ff786ffcb36
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x7ff786ffcafb
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x7ff786ffdc00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x7ff786ffdd20
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x7ff786ffdc60
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x7ff786ffdc60
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x7ff786ffdc60
Function at 0x7ff78702fcc0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x7ff78702fcf5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x7ff78702fcd0
and r10, 0xf
je 0x7ff78702fd25
mov r9d, 0x10
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x7ff78702fd00
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x7ff78702fd19
mov rax, r8
repz ret

Function at 0x7ff78702fd30
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x7ff78702fd6d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x7ff78702fd40
pxor xmm1, xmm1
and r10, 0xf
je 0x7ff78702fda3
mov r9d, 0x10
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x7ff78702fd7b
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x7ff78702fd97
mov rax, r8
repz ret
Function at 0x7ff78711d0c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x50
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x7ff78711d163
mov byte [rax], 0xc3
mov edx, dword [rsp + 0x24]
lea r9, [rsp + 0x60]
mov r8d, 0x140
mov rcx, rax
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x7ff78711d163
call rbx
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.kernel32.dll_VirtualFree]
mov eax, 1
add rsp, 0x50
pop rbx
ret
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x7ff78711d170
Capabilities:
Check for debugger via api

Disassembly:
push rbp
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
jne 0x7ff78711d279
mov dword [rbp + 0x400], eax
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x400]
call qword [sym.imp.kernel32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x400], 0
jne 0x7ff78711d2c7
call fcn.7ff78711d090
test eax, eax
jne 0x7ff78711d314
call fcn.7ff78711d0c0
test eax, eax
jne 0x7ff78711d361
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call sub.ntdll.dll_memset
mov dword [rsp + 0x50], 0x100010
call qword [sym.imp.kernel32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetThreadContext]
test eax, eax
je 0x7ff78711d223
cmp qword [rsp + 0x68], 0
jne 0x7ff78711d22c
cmp qword [rsp + 0x70], 0
jne 0x7ff78711d22c
cmp qword [rsp + 0x78], 0
jne 0x7ff78711d22c
cmp qword [rbp - 0x80], 0
jne 0x7ff78711d22c
add rsp, 0x4f0
pop rbp
ret
mov cl, 0x18
mov byte [rbp + 0x400], 0x28
movzx edx, cl
mov al, 0x1d
xor dl, 0x28
mov r8b, 0x1c
mov byte [rbp + 0x403], dl
xor r9d, r9d
xor al, 0x28
mov byte [rbp + 0x405], r9b
xor cl, 0x28
mov byte [rbp + 0x401], al
xor r8b, 0x28
mov byte [rbp + 0x402], cl
lea rdx, [rbp + 0x401]
mov byte [rbp + 0x404], r8b
call fcn.7ff78711d3b0
int3
mov cl, 0x1b
mov byte [rbp + 0x400], 0x2b
movzx edx, cl
movzx r8d, cl
xor dl, 0x2b
mov al, 0x1e
mov byte [rbp + 0x403], dl
xor r9d, r9d
xor al, 0x2b
mov byte [rbp + 0x405], r9b
xor cl, 0x2b
mov byte [rbp + 0x401], al
xor r8b, 0x2b
mov byte [rbp + 0x402], cl
lea rdx, [rbp + 0x401]
mov byte [rbp + 0x404], r8b
call fcn.7ff78711d3b0
int3
mov cl, 4
mov byte [rbp + 0x400], 0x34
movzx edx, cl
mov al, 1
xor dl, 0x34
mov r8b, 5
mov byte [rbp + 0x403], dl
xor r9d, r9d
xor al, 0x34
mov byte [rbp + 0x405], r9b
xor cl, 0x34
mov byte [rbp + 0x401], al
xor r8b, 0x34
mov byte [rbp + 0x402], cl
lea rdx, [rbp + 0x401]
mov byte [rbp + 0x404], r8b
call fcn.7ff78711d3b0
int3
mov cl, 0xe
mov byte [rbp + 0x400], 0x3e
movzx edx, cl
mov al, 0xb
xor dl, 0x3e
mov r8b, 0xc
mov byte [rbp + 0x403], dl
xor r9d, r9d
xor al, 0x3e
mov byte [rbp + 0x405], r9b
xor cl, 0x3e
mov byte [rbp + 0x401], al
xor r8b, 0x3e
mov byte [rbp + 0x402], cl
lea rdx, [rbp + 0x401]
mov byte [rbp + 0x404], r8b
call fcn.7ff78711d3b0
int3
mov cl, 0x66
mov byte [rbp + 0x400], 0x56
movzx edx, cl
mov al, 0x63
xor dl, 0x56
mov r8b, 0x65
mov byte [rbp + 0x403], dl
xor r9d, r9d
xor al, 0x56
mov byte [rbp + 0x405], r9b
xor cl, 0x56
mov byte [rbp + 0x401], al
xor r8b, 0x56
mov byte [rbp + 0x402], cl
lea rdx, [rbp + 0x401]
mov byte [rbp + 0x404], r8b
call fcn.7ff78711d3b0
int3
Function at 0x7ff78711d5f0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea r9, [rdx + 2]
mov rdi, rdx
mov rbx, rcx
movabs rbp, 0xaaaaaaaaaaaaaaab
mov rax, rbp
mov rsi, r8
mul r9
shr rdx, 1
shl rdx, 2
mov rcx, rdx
mov qword [r8], rdx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r10, rax
test rax, rax
je 0x7ff78711d740
xor eax, eax
lea r11, [0x7ff786ff0000]
test rdi, rdi
je 0x7ff78711d702
mov r9, r10
movsxd rcx, eax
cmp rcx, rdi
jae 0x7ff78711d667
movzx edx, byte [rbx]
inc eax
inc rbx
jmp 0x7ff78711d669
xor edx, edx
movsxd rcx, eax
cmp rcx, rdi
jae 0x7ff78711d67c
movzx r8d, byte [rbx]
inc eax
inc rbx
jmp 0x7ff78711d67f
xor r8d, r8d
movsxd rcx, eax
cmp rcx, rdi
jae 0x7ff78711d691
movzx ecx, byte [rbx]
inc eax
inc rbx
jmp 0x7ff78711d693
xor ecx, ecx
shl rdx, 8
add rdx, r8
shl rdx, 8
add rdx, rcx
mov rcx, rdx
shr rcx, 0x12
movzx ecx, byte [rcx + r11 + 0x443050]
mov byte [r9], cl
mov rcx, rdx
shr rcx, 0xc
and ecx, 0x3f
movzx ecx, byte [rcx + r11 + 0x443050]
mov byte [r9 + 1], cl
mov rcx, rdx
shr rcx, 6
and edx, 0x3f
and ecx, 0x3f
movzx ecx, byte [rcx + r11 + 0x443050]
mov byte [r9 + 2], cl
movzx ecx, byte [rdx + r11 + 0x443050]
mov byte [r9 + 3], cl
add r9, 4
movsxd rcx, eax
cmp rcx, rdi
jb 0x7ff78711d655
mov rax, rbp
mul rdi
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rdi, rax
movsxd rdx, dword [r11 + rdi*4 + 0x443038]
test rdx, rdx
jle 0x7ff78711d73d
mov rcx, qword [rsi]
dec rcx
add rcx, r10
nop dword [rax + rax]
mov byte [rcx], 0x3d
lea rcx, [rcx - 1]
sub rdx, 1
jne 0x7ff78711d730
mov rax, r10
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff787126330
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x180
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x7ff787126352
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.7ff787125e40
nop
mov rcx, rax
call fcn.7ff78712d5b0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.7ff787129950
test bl, bl
jne 0x7ff78712637d
xor al, al
jmp 0x7ff7871264f4
lea rcx, [rsp + 0x30]
call fcn.7ff787125f40
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.7ff787129330
nop
call qword [sym.imp.ucrtbase.dll_rand]
movsxd rcx, eax
movabs rax, 0x1c926b9d39431d5f
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x23d6df
sub rcx, rax
add ecx, 0x120b5
movsxd rsi, ecx
mov rcx, rsi
call fcn.7ff78718e958
mov rdi, rax
xor ebx, ebx
test rsi, rsi
je 0x7ff787126423
nop dword [rax]
call qword [sym.imp.ucrtbase.dll_rand]
mov r9d, eax
mov eax, 0x80808081
imul r9d
add edx, r9d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r9d, ecx
mov byte [rdi + rbx], r9b
inc rbx
cmp rbx, rsi
jb 0x7ff7871263f0
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcp140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.msvcp140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
lea rcx, [rsp + 0x78]
call fcn.7ff787129750
test rax, rax
jne 0x7ff787126471
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.msvcp140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rdi
call fcn.7ff78718e8e8
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.ucrtbase.dll__wremove]
nop
test eax, eax
sete bl
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [0x7ff78744a0c8]
mov qword [rsp + rcx + 0x70], rax
mov rcx, qword [rsp + 0x70]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0xa8]
mov dword [rsp + rdx + 0x6c], r8d
lea rcx, [rsp + 0x78]
call fcn.7ff787129280
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcp140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x118]
call qword [sym.imp.msvcp140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x30]
call fcn.7ff787129950
movzx eax, bl
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x7ff787127de0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1060
call sub.kernel32.dll___chkstk
sub rsp, rax
mov r12, r8
mov rbp, rdx
mov r13, rcx
test r8, r8
je 0x7ff787127ee6
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov r9d, 0x18
lea rax, [rsp + 0x10b0]
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov edx, 0x30394004
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x48], 0x1000
mov dword [rsp + 0x10b0], 0
call qword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
je 0x7ff787127ee6
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rdi + rbp], 0
jne 0x7ff787127e80
movsxd rax, dword [rsp + 0x9c]
lea rcx, [rsp + 0x60]
add rcx, rax
xor esi, esi
movzx eax, word [rcx + 0x14]
lea r15, [rcx + 0x18]
movzx r14d, word [rcx + 6]
add r15, rax
test r14d, r14d
je 0x7ff787127ee6
lea rcx, [rsi + rsi*4]
mov r8, rdi
lea rbx, [r15 + rcx*8]
mov rdx, rbp
mov rcx, rbx
call sub.vcruntime140.dll_memcmp
test eax, eax
jne 0x7ff787127edf
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x7ff787127ed1
cmp rdi, rax
je 0x7ff787127f03
inc esi
cmp esi, r14d
jb 0x7ff787127eb0
xor eax, eax
mov rbx, qword [rsp + 0x10a0]
add rsp, 0x1060
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x7ff787127ee6
mov ebp, dword [rbx + 8]
lea rdi, [rsp + 0x60]
add rdi, rax
je 0x7ff787127ee6
test ebp, ebp
je 0x7ff787127ee6
lea rax, [rsp + 0x60]
sub rdi, rax
add rdi, r12
je 0x7ff787127ee6
cmp rbp, 0x40000000
ja 0x7ff787127ee6
mov ecx, ebp
call fcn.7ff78718e958
xor r14d, r14d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x40]
mov rbx, rax
mov dword [rsp + 0x4c], r14d
lea rax, [rsp + 0x10b0]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x30], rax
lea r9d, [r14 + 0x18]
mov dword [rsp + 0x28], r14d
mov edx, 0x30394004
mov rcx, r13
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x10b0], r14d
call qword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
je 0x7ff787127fba
mov r9, qword [rsp + 0x10c0]
mov edx, ebp
mov r8, qword [rsp + 0x10b8]
mov rcx, rbx
call fcn.7ff78712dbe0
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x7ff787127fc2
call fcn.7ff78718e8e8
mov rax, r14
jmp 0x7ff787127ee8
call fcn.7ff78718e8e8
sub rsi, rbx
lea rax, [rsi + rdi]
jmp 0x7ff787127ee8