joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032d30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x68], ebp
test rdx, rdx
je 0x140032ecd
cmp byte [rdx], bpl
je 0x140032ecd
cmp r8d, 0x19
jne 0x140032dce
lea r8, [rsp + 0x78]
xor ecx, ecx
call fcn.1400330b0
mov rbx, rax
test rax, rax
je 0x140032ecd
mov r8d, dword [rsp + 0x78]
mov rdx, rax
add r8d, r8d
cmp qword [rdi + 8], rbp
je 0x140032d97
mov rcx, rdi
call fcn.140032680
mov dword [rsp + 0x68], eax
jmp 0x140032daa
mov rcx, qword [rdi]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1400f8d28]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movsxd rax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp r8d, 2
jne 0x140032e7e
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], bpl
jne 0x140032de0
mov rcx, qword [0x1400f8d28]
mov qword [rsp + 0x78], r8
lea r8, [r8*4]
xor edx, edx
mov qword [rsp + 0x30], r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140032ecd
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov r8, rbx
mov rcx, rax
call fcn.14003e240
mov r8d, dword [rsp + 0x30]
mov rdx, rsi
cmp qword [rdi + 8], rbp
je 0x140032e47
mov rcx, rdi
call fcn.140032680
mov dword [rsp + 0x68], eax
jmp 0x140032e5a
mov rcx, qword [rdi]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1400f8d28]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movsxd rax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
or r8, 0xffffffffffffffff
cmp qword [rcx + 8], rbp
je 0x140032eb1
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], bpl
jne 0x140032e90
call fcn.140032680
mov dword [rsp + 0x68], eax
cdqe
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
inc r8
cmp byte [rdx + r8], bpl
jne 0x140032eb1
mov rcx, qword [rcx]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140032f70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rbx, rdx
mov rsi, rcx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x50], 0
je 0x140032fa5
mov r8d, 1
call fcn.140032550
mov dword [rsp + 0x50], eax
jmp 0x140032fc6
mov rcx, qword [rcx]
lea r9, [rsp + 0x50]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x50]
cmp eax, 1
je 0x140032fd8
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
movzx ecx, byte [rsp + 0x40]
test cl, cl
js 0x140032ff7
mov byte [rbx], cl
mov byte [rbx + 1], 0
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
movzx eax, cl
mov qword [rsp + 0x48], rdi
and al, 0xe0
cmp al, 0xc0
jne 0x14003300c
mov edi, 2
jmp 0x14003302a
movzx eax, cl
and al, 0xf0
cmp al, 0xe0
jne 0x14003301c
mov edi, 3
jmp 0x14003302a
movzx eax, cl
and al, 0xf8
cmp al, 0xf0
jne 0x140033095
mov edi, 4
mov byte [rbx], cl
cmp qword [rsi + 8], 0
lea rdx, [rbx + 1]
je 0x14003304a
lea eax, [rdi - 1]
mov rcx, rsi
movsxd r8, eax
call fcn.140032550
mov rcx, rax
jmp 0x140033069
mov rcx, qword [rsi]
lea r8d, [rdi - 1]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x50]
lea eax, [rdi - 1]
cmp ecx, eax
je 0x140033082
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
movsxd rax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rdi, qword [rsp + 0x48]
mov word [rbx], 0x3f
mov rbx, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x30
pop rsi
ret

Function at 0x1400342c8
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x20
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x1400342ea
call qword [sym.imp.USER32.DLL_EmptyClipboard]
mov ebx, eax
call qword [sym.imp.USER32.DLL_CloseClipboard]
movsxd rax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400342f4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x14003438a
lea rsi, [0x14009c307]
test rdi, rdi
cmovne rsi, rdi
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov ecx, 0x2002
inc eax
movsxd rbp, eax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140034384
call qword [sym.imp.USER32.DLL_EmptyClipboard]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140034384
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [rbx + 1]
mov rdx, rdi
call qword [sym.imp.USER32.DLL_SetClipboardData]
mov rbx, rax
call qword [sym.imp.USER32.DLL_CloseClipboard]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003480c
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400fb0a0], eax
add rsp, 0x28
ret

Function at 0x140034870
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x1400348e5
mov eax, dword [rcx + 0xf4]
mov dword [rcx + 0x108], eax
mov eax, dword [rcx + 0xf8]
mov dword [rcx + 0x10c], eax
call qword [rcx + 0xb0]
mov rdi, rax
test rax, rax
jne 0x1400348e5
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x1400348bd
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [0x1400f8d28]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1400fb0a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1400fb0b0], 0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400349f8
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x1400fb0b0]
test rbx, rbx
je 0x140034a51
mov rcx, rbx
call qword [rbx + 0xb8]
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x140034a29
mov edx, 1
mov rcx, rbx
call rax
mov rcx, qword [0x1400f8d28]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1400fb0a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1400fb0b0], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140036114
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1400f8d28]
mov edx, 8
mov r8d, 0x1c0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400fb0a0]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [0x1400fb0b0], rbx
and dword [rbx + 0x11c], 0
or eax, 0xffffffff
mov dword [rbx + 0x118], 0xffffff
mov dword [rbx + 0xe8], 1
mov dword [rbx + 0x120], eax
mov dword [rbx + 0x124], eax
lea rax, [0x140034d10]
mov qword [rbx], rax
lea rax, [0x140034d40]
mov dword [rbx + 0xec], 7
mov qword [rbx + 8], rax
lea rax, [0x140035e58]
mov qword [rbx + 0x10], rax
lea rax, [0x140034de8]
mov qword [rbx + 0x18], rax
lea rax, [0x1400354c0]
mov qword [rbx + 0x20], rax
lea rax, [0x140035450]
mov qword [rbx + 0x28], rax
lea rax, [0x140035498]
mov qword [rbx + 0x30], rax
lea rax, [0x1400354ac]
mov qword [rbx + 0x38], rax
lea rax, [fcn.140035534]
mov qword [rbx + 0x40], rax
lea rax, [0x140035058]
mov qword [rbx + 0x48], rax
lea rax, [fcn.140035070]
mov qword [rbx + 0x50], rax
lea rax, [0x140034ef4]
mov qword [rbx + 0x58], rax
lea rax, [0x1400353b8]
mov qword [rbx + 0x60], rax
lea rax, [0x1400352d4]
mov qword [rbx + 0x68], rax
lea rax, [0x1400355d0]
mov qword [rbx + 0x70], rax
lea rax, [0x140035714]
mov qword [rbx + 0x78], rax
lea rax, [0x140035800]
mov qword [rbx + 0x80], rax
lea rax, [0x1400358b8]
mov qword [rbx + 0x88], rax
lea rax, [0x140035a08]
mov qword [rbx + 0x90], rax
lea rax, [0x140035a88]
mov qword [rbx + 0x98], rax
lea rax, [0x140035b7c]
mov qword [rbx + 0xa0], rax
lea rax, [0x140035d68]
mov qword [rbx + 0xa8], rax
lea rax, [0x140035ee0]
mov qword [rbx + 0xb0], rax
lea rax, [0x140035fc8]
mov qword [rbx + 0xb8], rax
lea rax, [0x140036064]
mov qword [rbx + 0xc0], rax
lea rax, [0x1400360b8]
mov qword [rbx + 0xc8], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140060880
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r8, rcx
test rcx, rcx
je 0x14006094b
mov rdx, qword [rcx]
xor r9d, r9d
mov qword [rsp], rdi
mov eax, r9d
mov r10d, r9d
lea rdi, [0x14009d120]
mov byte [rdx + 0x16], al
mov rdx, qword [rcx]
mov byte [rdx + 0x17], al
mov rdx, qword [rcx]
mov byte [rdx + 0x18], al
mov rdx, qword [rcx]
mov byte [rdx + 0x19], al
movsxd r11, dword [rcx + 8]
test r11, r11
jle 0x1400608f5
mov qword [rsp + 0x10], rbx
mov rbx, qword [rcx]
nop dword [rax]
movzx edx, byte [rbx + r10]
mov ecx, eax
inc r10
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
mov eax, dword [rdi + rdx*4]
shl ecx, 8
xor eax, ecx
cmp r10, r11
jl 0x1400608d0
mov rbx, qword [rsp + 0x10]
movsxd r10, dword [r8 + 0x18]
test r10, r10
jle 0x140060922
mov r11, qword [r8 + 0x10]
movzx edx, byte [r11 + r9]
mov ecx, eax
inc r9
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
mov eax, dword [rdi + rdx*4]
shl ecx, 8
xor eax, ecx
cmp r9, r10
jl 0x140060902
mov rcx, qword [r8]
mov rdi, qword [rsp]
mov edx, eax
mov byte [rcx + 0x16], al
mov rcx, qword [r8]
shr edx, 8
mov byte [rcx + 0x17], dl
mov rcx, qword [r8]
mov edx, eax
shr edx, 0x10
shr eax, 0x18
mov byte [rcx + 0x18], dl
mov rcx, qword [r8]
mov byte [rcx + 0x19], al
add rsp, 8
ret
Function at 0x140080c6c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x1400f8d28]
mov edx, 8
mov r8d, 0x250
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400fb0a0]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [0x1400fb0b0], rdi
and dword [rdi + 0x11c], 0
or eax, 0xffffffff
mov edx, ebx
mov rcx, rdi
mov dword [rdi + 0x118], 0xffffff
mov dword [rdi + 0xe8], 2
mov dword [rdi + 0xec], 0x3f
mov dword [rdi + 0x120], eax
mov dword [rdi + 0x124], eax
call fcn.1400843c0
mov rbx, qword [rsp + 0x30]
lea rax, [0x140081cf4]
mov qword [rdi + 0xb0], rax
lea rax, [0x140081d58]
mov qword [rdi + 0xb8], rax
lea rax, [fcn.1400815d0]
mov qword [rdi + 0x20], rax
lea rax, [0x140081478]
mov qword [rdi + 0x60], rax
lea rax, [0x140081dfc]
mov qword [rdi + 0xc8], rax
lea rax, [0x140081da4]
mov qword [rdi + 0xc0], rax
lea rax, [0x140081104]
mov qword [rdi + 0x68], rax
lea rax, [0x1400810a8]
mov qword [rdi + 0x48], rax
lea rax, [0x1400810d4]
mov qword [rdi + 0x50], rax
lea rax, [0x140080f58]
mov qword [rdi + 0x58], rax
lea rax, [0x140081924]
mov qword [rdi + 0x88], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400889e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r10d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov ebx, r8d
mov r12, rdx
mov r11, rcx
test r10d, r10d
je 0x140088aaf
mov eax, dword [rsp + 0x50]
mov ecx, ebx
mov ebp, ebx
shl eax, 2
imul ecx, dword [rsp + 0x58]
movsxd r13, eax
mov eax, esi
imul eax, r9d
mov r9d, dword [rsp + 0x48]
neg ebp
movsxd rdi, eax
mov qword [rsp + 0x28], rdi
mov eax, dword [r11 + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [r11 + 0x150]
add rdx, rdi
cmp dword [rsp + 0x60], 0
jle 0x140088a94
mov edi, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 4]
xor byte [rdx], al
add rdx, rsi
dec rdi
jne 0x140088a70
mov rdi, qword [rsp + 0x28]
dec r10d
inc r9d
cmp dword [r11 + 0x174], 0
jne 0x140088aa8
add ecx, ebp
jmp 0x140088aaa
add ecx, ebx
test r10d, r10d
jne 0x140088a44
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140089850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r11d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov edi, r8d
mov r12, rdx
mov rbx, rcx
test r11d, r11d
je 0x140089919
mov eax, dword [rsp + 0x50]
mov ecx, r8d
mov ebp, r8d
lea r10d, [rax + rax*2]
mov eax, esi
imul ecx, dword [rsp + 0x58]
movsxd r13, r10d
imul eax, r9d
mov r9d, dword [rsp + 0x48]
movsxd r10, eax
mov qword [rsp + 0x28], r10
neg ebp
mov eax, dword [rbx + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [rbx + 0x150]
add rdx, r10
cmp dword [rsp + 0x60], 0
jle 0x1400898ff
mov r10d, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 3]
xor byte [rdx], al
add rdx, rsi
dec r10
jne 0x1400898db
mov r10, qword [rsp + 0x28]
dec r11d
inc r9d
cmp dword [rbx + 0x174], 0
jne 0x140089912
add ecx, ebp
jmp 0x140089914
add ecx, edi
test r11d, r11d
jne 0x1400898af
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180004684
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov edi, 0xc0000001
test rcx, rcx
je 0x18000471d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
je 0x18000471d
mov edx, ebp
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x18000471d
mov r8d, ebp
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp ebp, eax
je 0x1800046ed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
test rbx, rbx
je 0x18000471d
movzx eax, word [rbx]
cmp eax, 0x21
je 0x180004709
cmp eax, 0x2a
je 0x180004714
mov rcx, rbx
call fcn.180004734
jmp 0x180004712
lea rcx, [rbx + 2]
call fcn.180004a80
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x180004a80
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rdx, [rsp + 0x68]
xor r14d, r14d
mov ebp, r14d
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, r14d
mov r12, rax
test rax, rax
je 0x180004b5a
cmp dword [rsp + 0x68], r14d
jle 0x180004b5a
movzx edi, r14w
lea rsi, [0x180039530]
lea r15d, [r14 + 1]
cmp di, 0x13
jae 0x180004b2d
mov rcx, qword [r12]
movzx r13d, di
shl r13, 5
mov rdx, qword [r13 + rsi + 0x10]
call fcn.180028f08
mov ebx, r14d
test eax, eax
sete bl
test ebx, ebx
je 0x180004b25
mov rax, qword [r13 + rsi]
test rax, rax
je 0x180004b16
mov ecx, dword [rsp + 0x68]
lea rdx, [r12 + 8]
dec ecx
call rax
mov ebp, eax
jmp 0x180004b25
mov ecx, dword [r13 + rsi + 8]
xor r8d, r8d
xor edx, edx
call fcn.18000e2e4
add di, r15w
test ebx, ebx
je 0x180004ad3
mov rsi, qword [rsp + 0x60]
test ebx, ebx
jne 0x180004b5a
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov rdx, rsi
not rcx
sub rcx, r15
lea r8d, [rcx + rcx + 2]
mov ecx, 0x22c003
call fcn.18000e2e4
mov eax, ebp
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800055c0
Capabilities:
Encode data using base64 via winapi
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov ebp, r8d
cmp dword [0x18004b794], ebx
mov r13, rdx
mov r12, rcx
mov esi, ebx
mov dword [rax + 0x20], ebx
je 0x18000568a
lea rax, [rax + 0x20]
lea r8d, [rbx + 1]
mov edx, ebp
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x1800056ee
mov edx, dword [rsp + 0x78]
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1800056ee
lea rax, [rsp + 0x78]
lea r8d, [rbx + 1]
mov r9, rdi
mov edx, ebp
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov esi, eax
test eax, eax
je 0x18000567f
mov rcx, r12
call fcn.180004a6c
cmp dword [rsp + 0x78], ebx
jbe 0x18000567a
mov rdx, rdi
movzx ecx, word [rdx]
call fcn.180004a6c
inc ebx
add rdx, 2
cmp ebx, dword [rsp + 0x78]
jb 0x180005666
call fcn.180004a6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800056ee
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x1800056ee
cmp rax, 0xffffffffffffffff
je 0x1800056ee
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, r13
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800056e5
cmp ebp, dword [rsp + 0x78]
jne 0x1800056e5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov eax, esi
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x1800069dc
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via systemfunction032

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
lea rax, [rbp + 0x1f]
xor edi, edi
mov rsi, r9
lea r14d, [rdi + 0x10]
mov r13, r8
mov qword [rbp - 0x49], r9
mov dword [rbp - 0x51], r14d
mov dword [rbp - 0x4d], r14d
mov dword [rbp - 0x61], r14d
mov dword [rbp - 0x5d], r14d
mov qword [rbp - 0x59], rax
call fcn.180004a6c
and qword [rsp + 0x28], rdi
lea rax, [rbp - 0x69]
lea r9, [0x18003b9fc]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call fcn.1800107e4
test eax, eax
je 0x180006baa
mov rbx, qword [rbp - 0x69]
movzx ecx, word [rbx]
mov edx, ecx
sub edx, 2
je 0x180006b01
dec edx
jne 0x180006b9a
mov ecx, dword [rbx + 0x68]
cmp ecx, 2
jne 0x180006b9a
mov r12d, dword [rbx + 0x74]
lea r9d, [rdi + 0x18]
lea rcx, [rbp - 0x69]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180006ac8
lea rax, [rbp - 0x69]
lea r8, [rbx + 0x88]
lea rdx, [rbx + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x7f]
mov r9d, r12d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x41]
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.1800114cc
jmp 0x180006ad7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180004a6c
xor eax, eax
test eax, eax
je 0x180006b9f
cmp dword [rbp + 0x7f], r14d
mov rcx, qword [rbp - 0x41]
sete dil
test edi, edi
je 0x180006af6
movups xmm0, xmmword [rcx]
movdqu xmmword [rsi], xmm0
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180006b9f
mov ecx, dword [rbx + 0x68]
cmp ecx, 1
jne 0x180006b9a
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Init]
lea rdx, [rbx + 0x70]
lea rcx, [rbp - 0x39]
mov r8d, r14d
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rdx, str.______qwertyUIOPAzxcvbnmQQQQQQQQQQQQ____
lea rcx, [rbp - 0x39]
mov r8d, 0x2f
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x39]
mov r8d, r14d
mov rdx, r13
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rdx, str.0123456789012345678901234567890123456789
lea rcx, [rbp - 0x39]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x39]
call qword [sym.imp.cryptdll.dll_MD5Final]
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x51]
movups xmm5, xmmword [rbx + 0x80]
movdqu xmmword [rsi], xmm5
call qword [sym.imp.ADVAPI32.dll_SystemFunction032]
test eax, eax
setns dil
test edi, edi
jne 0x180006b9f
call fcn.180004a6c
jmp 0x180006b9f
call fcn.180004a6c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180006baf
call fcn.180004a6c
test edi, edi
je 0x180006bc1
xor r8d, r8d
mov edx, r14d
mov rcx, rsi
call fcn.18000e590
call fcn.180004a6c
lea r11, [rsp + 0xe0]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x180008e7c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov ebx, edx
mov r8d, ecx
cmp ecx, 6
jae 0x180008ea5
lea rcx, [0x18004a370]
mov rcx, qword [rcx + r8*8]
jmp 0x180008eac
lea rcx, str.unknown
call fcn.180004a6c
xor esi, esi
test r8d, r8d
je 0x180009015
dec r8d
je 0x180009002
dec r8d
je 0x180008fc2
dec r8d
je 0x180008f7c
dec r8d
je 0x180008f04
dec r8d
je 0x180008efa
lea r8d, [rsi + 1]
mov edx, r9d
mov rcx, rdi
call fcn.18000e590
call fcn.180004a6c
jmp 0x1800090eb
call fcn.180004a6c
xor r8d, r8d
jmp 0x180008ee5
mov edx, dword [rdi + 0x10]
movzx ecx, word [rdi + 0xc]
mov r8d, dword [rdi + 0x14]
add rdx, rdi
shr rcx, 1
call fcn.180004a6c
movzx r8d, word [rdi + 4]
lea rdx, [rdi + 0x18]
lea r9, str.Credentials
mov rcx, rdi
call fcn.180009194
movzx r8d, word [rdi + 6]
lea r9, str.ServiceCredentials
mov rdx, rax
mov rcx, rdi
call fcn.180009194
movzx r8d, word [rdi + 8]
lea r9, str.OldCredentials
mov rdx, rax
mov rcx, rdi
call fcn.180009194
movzx r8d, word [rdi + 0xa]
lea r9, str.OlderCredentials
mov rdx, rax
mov rcx, rdi
call fcn.180009194
jmp 0x1800090eb
mov edx, dword [rdi + 0xc]
movzx ecx, word [rdi + 8]
add rdx, rdi
shr rcx, 1
call fcn.180004a6c
movzx r8d, word [rdi + 4]
lea rdx, [rdi + 0x10]
lea r9, str.Credentials
mov rcx, rdi
call fcn.1800090fc
movzx r8d, word [rdi + 6]
lea r9, str.OldCredentials
mov rdx, rax
mov rcx, rdi
call fcn.1800090fc
jmp 0x1800090eb
cmp byte [rdi + 3], sil
jbe 0x1800090eb
lea ebx, [rsi + 1]
mov ecx, ebx
call fcn.180004a6c
xor r8d, r8d
mov ecx, esi
inc rcx
lea edx, [r8 + 0x10]
shl rcx, 4
add rcx, rdi
call fcn.18000e590
call fcn.180004a6c
movzx eax, byte [rdi + 3]
mov esi, ebx
cmp ebx, eax
jb 0x180008fcc
jmp 0x1800090eb
mov ecx, r9d
mov rdx, rdi
shr rcx, 1
call fcn.180004a6c
jmp 0x1800090eb
call fcn.180004a6c
cmp byte [rdi + 0x20], sil
je 0x18000902f
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 0x10]
call fcn.18000e590
call fcn.180004a6c
cmp byte [rdi + 0x21], sil
je 0x18000904a
xor r8d, r8d
lea rcx, [rdi + 0x10]
lea edx, [r8 + 0x10]
call fcn.18000e590
call fcn.180004a6c
cmp dword [rdi + 0x24], esi
je 0x1800090eb
cmp word [rdi + 0x44], si
je 0x18000907a
lea rcx, [rdi + 0x4c]
lea r9, str.NTLM
mov r8d, ebx
mov edx, 0x10
mov dword [rsp + 0x20], esi
call fcn.180012394
cmp word [rdi + 0x64], si
je 0x18000909f
movzx edx, word [rdi + 0x64]
lea rcx, [rdi + 0x6c]
lea r9, str.ntlm
mov r8d, ebx
mov dword [rsp + 0x20], 1
call fcn.180012394
cmp word [rdi + 0x2c], si
je 0x1800090c1
lea rcx, [rdi + 0x34]
lea r9, str.LM
mov r8d, ebx
mov edx, 0x10
mov dword [rsp + 0x20], esi
call fcn.180012394
cmp word [rdi + 0x5c], si
je 0x1800090eb
movzx eax, word [rdi + 0x64]
movzx edx, word [rdi + 0x5c]
lea r9, str.lm
lea rcx, [rax + rdi + 0x6c]
mov r8d, ebx
mov dword [rsp + 0x20], 1
call fcn.180012394
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret