joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4391d0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rax, [rcx + 0x10]
mov rbx, rdx
mov qword [rdx + 8], rcx
mov dword [rdx + 0x10], 0xf
mov dword [rdx + 0x58], 8
test r9d, r9d
mov qword [rdx + 0x20], rax
mov rdx, qword [rcx + 0x18]
lea rax, [rbx + 0x20]
mov esi, r9d
mov qword [rbx + 0x28], rdx
mov qword [rdx], rax
mov qword [rcx + 0x18], rax
mov rax, qword [sym.imp.WS2_32.dll_WSARecv]
mov dword [rbx + 0x30], 0xffffffff
mov qword [rbx + 0x70], 0xffffffffffffffff
mov dword [rbx + 0x78], 0
mov dword [rbx + 0x7c], 0
mov qword [rbx + 0x198], rax
mov rax, qword [sym.imp.WS2_32.dll_WSARecvFrom]
mov qword [rbx + 0x60], 0
mov qword [rbx + 0x68], 0
mov dword [rbx + 0x88], 0x10
mov qword [rbx + 0xc0], 0
mov qword [rbx + 0x1a0], rax
mov qword [rbx + 0x80], rbx
jne 0x439280
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r8d, r8d
mov edx, 2
mov ecx, r9d
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x439314
cmp qword [rbx + 0x70], 0xffffffffffffffff
mov rbp, qword [rbx + 8]
mov dword [rsp + 0x2c], 1
jne 0x439340
lea r8, [rsp + 0x2c]
mov edx, 0x8004667e
mov rcx, rax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x439350
mov r9d, esi
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call fcn.00438d90
mov esi, eax
test esi, esi
je 0x439275
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
mov ecx, esi
mov qword [rax], rdx
mov rax, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
mov qword [rax + 8], rdx
call fcn.00416500
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x20]
mov qword [rdx], rcx
mov rcx, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
mov qword [rdx + 8], rcx
mov ecx, eax
call fcn.00416500
jmp 0x439277
mov esi, 0xfffff00e
jmp 0x4392e4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
jmp 0x4392e0
Function at 0x43b110
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov edi, dword [rsp + 0x160]
test r9, r9
mov rbx, rcx
mov r12, rdx
mov r13d, r8d
mov rsi, r9
je 0x43b156
lea rbp, [rsp + 0x70]
mov rcx, r9
mov rdx, rbp
call fcn.0043ecf0
test eax, eax
jne 0x43b204
mov rsi, rbp
cmp qword [rbx + 0x68], 0
jne 0x43b280
test byte [rbx + 0x59], 0x20
jne 0x43b1c2
cmp edi, 0x10
je 0x43b230
cmp edi, 0x1c
mov eax, 0xfffff019
jne 0x43b204
mov rbp, qword [0x00451830]
mov rcx, qword [rbx + 0x70]
mov dword [rsp + 0x68], 0
cmp rcx, 0xffffffffffffffff
je 0x43b290
cmp word [rbp], 0x17
je 0x43b240
mov r8d, edi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x43b304
or dword [rbx + 0x58], 0x2000
mov rdx, r12
mov rcx, qword [rbx + 0x70]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x6c]
mov qword [rsp + 0x28], rsi
mov r8d, r13d
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov edx, eax
mov eax, dword [rsp + 0x6c]
test edx, edx
jne 0x43b220
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.00416500
jmp 0x43b204
mov rbp, qword [0x00451820]
jmp 0x43b185
or dword [rbx + 0x58], 0x400000
cmp word [rbp], 0x17
jne 0x43b1a6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x68]
mov r8d, 0x1b
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
jmp 0x43b1a6
mov eax, 0xfffff008
jmp 0x43b204
movzx ecx, word [rbp]
xor r8d, r8d
mov edx, 2
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
mov r15, rax
je 0x43b304
movzx eax, word [rbp]
cmp qword [rbx + 0x70], 0xffffffffffffffff
mov r14, qword [rbx + 8]
mov dword [rsp + 0x6c], 1
mov word [rsp + 0x5e], ax
jne 0x43b322
lea r8, [rsp + 0x6c]
mov edx, 0x8004667e
mov rcx, r15
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x43b333
movzx r9d, word [rsp + 0x5e]
mov rcx, r14
mov r8, r15
mov rdx, rbx
call fcn.00438d90
mov r14d, eax
test r14d, r14d
jne 0x43b328
mov rcx, qword [rbx + 0x70]
jmp 0x43b19b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov r14d, eax
je 0x43b1c2
mov ecx, r14d
call fcn.00416500
jmp 0x43b204
mov r14d, 0xfffff00e
mov rcx, r15
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x43b315
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r14d, eax
jmp 0x43b2f6
Function at 0x43b9f0
Capabilities:
Enumerate processes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x150
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rsi, [rsp + 0x20]
xor edx, edx
mov ecx, 2
mov edi, eax
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x43ba3f
jmp 0x43ba50
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x43ba50
cmp edi, dword [rsp + 0x28]
jne 0x43ba30
mov esi, dword [rsp + 0x40]
jmp 0x43ba55
mov esi, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x150
pop rbx
pop rsi
pop rdi
ret
Function at 0x43cde0
Capabilities:
Get common file path
Get session user name

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
test rcx, rcx
mov rbx, rcx
je 0x43cf90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43cee2
lea rdi, [rsp + 0x34]
xor edx, edx
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x34], 0
mov rbp, qword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov r8, rdi
call rbp
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x7a
je 0x43ce70
call rsi
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.00416500
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, dword [rsp + 0x34]
add rcx, rcx
call fcn.004109f0
test rax, rax
mov r12, rax
je 0x43cfba
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call rbp
test eax, eax
je 0x43cf00
lea rbp, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], 0x101
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x43cf23
call rsi
mov rcx, r12
mov ebx, eax
call fcn.00410a10
cmp ebx, 0x7a
je 0x43cfb0
mov ecx, ebx
call fcn.00416500
jmp 0x43ce5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00416500
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call rsi
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call fcn.00410a10
mov ecx, ebx
call fcn.00416500
jmp 0x43ce5e
lea r8, [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, r12
mov qword [rbx + 0x18], 0
call fcn.0043c8d0
mov rcx, r12
mov dword [rsp + 0x2c], eax
call fcn.00410a10
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x43ce5e
mov qword [rbx], 0
mov r8, rbx
mov edx, 0xffffffff
mov rcx, rbp
call fcn.0043c8d0
test eax, eax
jne 0x43cf9a
mov qword [rbx + 0x10], 0
mov dword [rbx + 8], 0xffffffff
mov dword [rbx + 0xc], 0xffffffff
jmp 0x43ce5e
mov eax, 0xfffff019
jmp 0x43ce5e
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x2c], eax
call fcn.00410a10
mov eax, dword [rsp + 0x2c]
jmp 0x43ce5e
mov eax, 0xfffff027
jmp 0x43ce5e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff027
jmp 0x43ce5e
Function at 0x43d290
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
mov r14d, 0xfffff019
test rdx, rdx
mov qword [rsp + 0x4b8], rdx
mov r15, r8
sete dl
test r8, r8
sete al
or dl, al
jne 0x43d404
test rcx, rcx
je 0x43d404
cmp qword [r8], 0
je 0x43d404
lea r8, [rsp + 0x58]
mov edx, 0xffffffff
call fcn.0043cd00
test eax, eax
mov r14d, eax
jne 0x43d404
lea rbp, [rsp + 0x60]
mov ebx, 0x200
mov r13, qword [sym.imp.KERNEL32.dll_SetLastError]
mov r12, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, 0x200
mov rsi, rbp
jmp 0x43d348
cmp rsi, rbp
je 0x43d32d
mov rcx, rsi
call fcn.00410a10
lea edi, [rbx + 1]
lea rcx, [rdi + rdi]
mov rbx, rdi
call fcn.004109f0
test rax, rax
mov rsi, rax
je 0x43d420
xor ecx, ecx
call r13
mov r8d, ebx
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call r12
mov eax, eax
cmp rax, rdi
mov rbx, rax
jae 0x43d320
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
call fcn.00410a10
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], 0
test rax, rax
jne 0x43d395
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43d438
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rsi
mov ecx, 0xfde9
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rbx
test eax, eax
je 0x43d432
mov rdx, qword [r15]
mov eax, eax
cmp rax, rdx
jbe 0x43d444
mov qword [r15], rax
mov r14d, 0xfffff024
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x43d3f7
call fcn.00410a10
cmp rsi, rbp
je 0x43d404
mov rcx, rsi
call fcn.00410a10
mov eax, r14d
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x58]
mov r14d, 0xfffff027
test rcx, rcx
jne 0x43d3f2
jmp 0x43d3fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00416500
mov r14d, eax
jmp 0x43d3e8
mov rax, qword [rsp + 0x4b8]
mov dword [rsp + 0x28], edx
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov r8, rsi
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
je 0x43d432
sub eax, 1
mov qword [r15], rax
jmp 0x43d3e8

Function at 0x43df70
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x43df80
xor eax, eax
add rsp, 0x28
ret
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x43df79
mov eax, 0xfffff01a
jmp 0x43df7b
Function at 0x43dfa0
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rcx, [0x0044f410]
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rdi
test rax, rax
mov rsi, rax
je 0x43e172
lea rdx, str.RtlGetVersion
mov rcx, rax
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
lea rdx, str.RtlNtStatusToDosError
mov qword [0x006e3030], rax
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x006e3068], rax
je 0x43e15e
lea rdx, str.NtDeviceIoControlFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x006e3088], rax
je 0x43e15e
lea rdx, str.NtQueryInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x006e3048], rax
je 0x43e15e
lea rdx, str.NtSetInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x006e3060], rax
je 0x43e15e
lea rdx, str.NtQueryVolumeInformationFile
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x006e3070], rax
je 0x43e15e
lea rdx, str.NtQueryDirectoryFile
mov rcx, rsi
call rbx
cmp qword [0x006e3070], 0
mov qword [0x006e3078], rax
je 0x43e15e
lea rdx, str.NtQuerySystemInformation
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x006e3080], rax
je 0x43e15e
lea rdx, str.NtQueryInformationProcess
mov rcx, rsi
call rbx
test rax, rax
mov qword [0x006e3090], rax
je 0x43e15e
lea rcx, str.kernel32.dll
call rdi
test rax, rax
je 0x43e172
lea rdx, str.GetQueuedCompletionStatusEx
mov rcx, rax
call rbx
xor edx, edx
mov qword [0x006e3050], rax
mov r8d, 0x800
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
je 0x43e114
lea rdx, str.PowerRegisterSuspendResumeNotification
mov rcx, rax
call rbx
mov qword [0x006e3038], rax
lea rcx, str.user32.dll
call rdi
test rax, rax
je 0x43e135
lea rdx, str.SetWinEventHook
mov rcx, rax
call rbx
mov qword [0x006e3040], rax
lea rcx, str.ws2_32.dll
call rdi
test rax, rax
je 0x43e156
lea rdx, str.GetHostNameW
mov rcx, rax
call rbx
mov qword [0x006e3058], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetProcAddress
mov ecx, eax
call fcn.00416440
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetModuleHandleA
mov ecx, eax
call fcn.00416440
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x43e290
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x468
lea r8, [0x006e30b0]
lea rcx, str.0.0.0.0
xor edx, edx
call fcn.00413610
test eax, eax
jne 0x43e3f3
lea r8, [0x006e30c0]
lea rcx, [0x0044f5a8]
xor edx, edx
call fcn.00413660
test eax, eax
jne 0x43e3f3
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x43e3e9
lea rdx, [rsp + 0x40]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x43e3f8
xor r8d, r8d
mov dword [0x006e30dc], 1
mov edx, 1
mov ecx, 2
mov rsi, qword [sym.imp.WS2_32.dll_socket]
call rsi
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x43e377
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x274
lea r9, [rsp + 0x1e0]
mov r8d, 0x2005
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x43e36e
test byte [rsp + 0x1e2], 2
je 0x43e36e
mov dword [0x006e30dc], 0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
xor r8d, r8d
mov dword [0x006e30a0], 1
mov edx, 1
mov ecx, 0x17
call rsi
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x43e3e9
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0x274
lea r9, [rsp + 0x1e0]
mov r8d, 0x2005
mov edx, 0xffff
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x43e3df
test byte [rsp + 0x1e2], 2
je 0x43e3df
mov dword [0x006e30a0], 0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
nop
add rsp, 0x468
pop rbx
pop rsi
ret
call sub.msvcrt.dll_abort
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.00416440
nop
nop word [rax + rax]

Function at 0x441480
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rdx, rdx
mov rbp, rcx
mov rsi, rdx
mov rdi, r8
je 0x441552
mov rcx, rdx
call sub.msvcrt.dll_strlen
test rax, rax
je 0x441552
mov r8, rsi
add rax, rsi
xor edx, edx
nop dword [rax + rax]
movsx ecx, byte [r8]
add r8, 1
add ecx, edx
mov edx, ecx
shl edx, 0xa
add edx, ecx
mov ecx, edx
shr ecx, 6
xor edx, ecx
cmp rax, r8
jne 0x4414c0
lea eax, [rdx + rdx*8]
mov r15d, eax
shr r15d, 0xb
xor eax, r15d
mov r15d, eax
shl r15d, 0xf
add r15d, eax
mov r12, qword [rbp + 8]
test r12, r12
jle 0x44153e
mov r13, qword [rbp + 0x18]
xor ebx, ebx
jmp 0x44150e
add rbx, 1
cmp rbx, r12
je 0x44153e
mov rdx, qword [r13 + rbx*8]
lea r14, [rbx*8]
test rdx, rdx
je 0x441505
mov rax, qword [rbp + 0x20]
cmp dword [rax + rbx*4], r15d
jne 0x441505
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x441505
mov rax, qword [rbp + 0x10]
mov rdi, qword [rax + r14]
mov rax, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r15d, r15d
jmp 0x4414f4
Function at 0x441910
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rdx, rdx
mov rbp, rcx
mov qword [rsp + 0x78], rdx
je 0x441a1e
test rcx, rcx
je 0x441a1e
mov rcx, rdx
call sub.msvcrt.dll_strlen
test rax, rax
je 0x441a2f
mov r8, qword [rsp + 0x78]
xor edx, edx
add rax, r8
movsx ecx, byte [r8]
add r8, 1
add ecx, edx
mov edx, ecx
shl edx, 0xa
add edx, ecx
mov ecx, edx
shr ecx, 6
xor edx, ecx
cmp rax, r8
jne 0x441955
lea eax, [rdx + rdx*8]
mov r15d, eax
shr r15d, 0xb
xor eax, r15d
mov r15d, eax
shl r15d, 0xf
add r15d, eax
mov r12, qword [rbp + 8]
test r12, r12
jle 0x441a1e
mov r14, qword [rbp + 0x18]
xor ebx, ebx
jmp 0x4419a9
add rbx, 1
cmp rbx, r12
je 0x441a1e
mov rsi, qword [r14 + rbx*8]
lea r13, [rbx*8]
test rsi, rsi
je 0x4419a0
mov rax, qword [rbp + 0x20]
lea rdi, [rbx*4]
cmp dword [rax + rbx*4], r15d
jne 0x4419a0
mov rcx, qword [rsp + 0x78]
mov rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x4419a0
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x18]
mov qword [rax + r13], 0
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + r13]
test rcx, rcx
je 0x441a0f
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x10]
mov qword [rax + r13], 0
mov rax, qword [rbp + 0x20]
mov dword [rax + rdi], 0
sub dword [rbp], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r15d, r15d
jmp 0x441989
Function at 0x4469f0
Capabilities:
Encode data using base64

Disassembly:
push rbx
sub rsp, 0x10
movabs r11, 0xaaaaaaaaaaaaaaab
mov r10, rdx
lea rdx, [rdx + 2]
sub r9, 1
mov rax, rdx
mul r11
xor eax, eax
shr rdx, 1
shl rdx, 2
cmp rdx, r9
jbe 0x446aac
jmp 0x446ac4
movzx edx, byte [rcx]
movzx eax, byte [rcx + 1]
sub r10, 3
mov r9, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add rcx, 3
add r8, 4
shl edx, 8
add eax, edx
shl eax, 8
mov edx, eax
movzx eax, byte [rcx - 1]
add eax, edx
mov edx, eax
and edx, 0x3f
movzx edx, byte [r9 + rdx]
mov byte [r8 - 1], dl
mov edx, eax
mov r9, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
sar edx, 6
and edx, 0x3f
movzx edx, byte [r9 + rdx]
mov byte [r8 - 2], dl
mov edx, eax
mov r9, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
sar edx, 0xc
sar eax, 0x12
and edx, 0x3f
cdqe
movzx edx, byte [r9 + rdx]
mov byte [r8 - 3], dl
mov rdx, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, byte [rdx + rax]
mov byte [r8 - 4], al
cmp r10, 2
ja 0x446a30
test r10, r10
jne 0x446ad0
mov byte [r8], 0
mov eax, 1
add rsp, 0x10
pop rbx
ret
xor eax, eax
test r10d, r10d
lea r9, [rsp + 0xd]
mov word [rsp + 0xd], ax
mov byte [rsp + 0xf], 0
mov r11d, r10d
je 0x446afd
xor eax, eax
mov edx, eax
add eax, 1
movzx ebx, byte [rcx + rdx]
cmp eax, r11d
mov byte [r9 + rdx], bl
jb 0x446aeb
movzx eax, byte [rsp + 0xd]
mov rcx, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shl eax, 8
mov edx, eax
movzx eax, byte [rsp + 0xe]
add eax, edx
shl eax, 8
mov edx, eax
movzx eax, byte [rsp + 0xf]
add eax, edx
mov edx, eax
and edx, 0x3f
movzx edx, byte [rcx + rdx]
mov byte [r8 + 3], dl
mov edx, eax
mov rcx, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
sar edx, 6
and edx, 0x3f
movzx edx, byte [rcx + rdx]
mov byte [r8 + 2], dl
mov edx, eax
mov rcx, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
sar edx, 0xc
sar eax, 0x12
and edx, 0x3f
cdqe
cmp r10, 1
movzx edx, byte [rcx + rdx]
mov byte [r8 + 1], dl
mov rdx, qword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx eax, byte [rdx + rax]
mov byte [r8 + 3], 0x3d
mov byte [r8], al
je 0x446b83
add r8, 4
jmp 0x446abb
mov byte [r8 + 2], 0x3d
jmp 0x446b7a
Function at 0x446bf0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
movsx r9d, byte [rcx]
lea r10d, [r9 - 0x41]
lea r8d, [r9 - 0x41]
cmp r10b, 0x19
jbe 0x446c40
lea r10d, [r9 - 0x61]
lea r8d, [r9 - 0x47]
cmp r10b, 0x19
jbe 0x446c40
lea r10d, [r9 - 0x30]
lea r8d, [r9 + 4]
cmp r10b, 9
jbe 0x446c40
cmp r9b, 0x2b
mov r8d, 0x3e
je 0x446c40
xor r8d, r8d
cmp r9b, 0x2f
setne r8b
neg r8d
or r8d, 0x3f
movsx r9d, byte [rcx + 1]
mov dword [rsp], r8d
lea r10d, [r9 - 0x41]
lea r8d, [r9 - 0x41]
cmp r10b, 0x19
jbe 0x446c91
lea r10d, [r9 - 0x61]
lea r8d, [r9 - 0x47]
cmp r10b, 0x19
jbe 0x446c91
lea r10d, [r9 - 0x30]
lea r8d, [r9 + 4]
cmp r10b, 9
jbe 0x446c91
cmp r9b, 0x2b
mov r8d, 0x3e
je 0x446c91
xor r8d, r8d
cmp r9b, 0x2f
setne r8b
neg r8d
or r8d, 0x3f
movsx r9d, byte [rcx + 2]
mov dword [rsp + 4], r8d
lea r10d, [r9 - 0x41]
lea r8d, [r9 - 0x41]
cmp r10b, 0x19
jbe 0x446ce3
lea r10d, [r9 - 0x61]
lea r8d, [r9 - 0x47]
cmp r10b, 0x19
jbe 0x446ce3
lea r10d, [r9 - 0x30]
lea r8d, [r9 + 4]
cmp r10b, 9
jbe 0x446ce3
cmp r9b, 0x2b
mov r8d, 0x3e
je 0x446ce3
xor r8d, r8d
cmp r9b, 0x2f
setne r8b
neg r8d
or r8d, 0x3f
movsx eax, byte [rcx + 3]
mov dword [rsp + 8], r8d
lea r9d, [rax - 0x41]
mov r8d, eax
cmp r9b, 0x19
jbe 0x446e40
lea r9d, [rax - 0x61]
cmp r9b, 0x19
jbe 0x446d50
lea r9d, [rax - 0x30]
add eax, 4
cmp r9b, 9
jbe 0x446d53
cmp r8b, 0x2b
mov eax, 0x3e
je 0x446d53
xor eax, eax
cmp r8b, 0x2f
setne al
neg eax
or eax, 0x3f
test eax, eax
mov dword [rsp + 0xc], eax
jns 0x446d5b
cmp byte [rcx + 3], 0x3d
je 0x446e55
xor eax, eax
add rsp, 0x18
ret
sub eax, 0x47
test eax, eax
mov dword [rsp + 0xc], eax
js 0x446d35
mov eax, 3
mov ecx, 2
movsxd r8, ecx
mov r9d, dword [rsp + r8*4]
test r9d, r9d
js 0x446d3f
sub ecx, 1
cmp ecx, 0xffffffff
je 0x446d90
movsxd r8, ecx
mov r8d, dword [rsp + r8*4]
test r8d, r8d
js 0x446d3f
test ecx, ecx
je 0x446d90
xor ecx, ecx
jmp 0x446d65
mov ecx, dword [rsp]
shl ecx, 6
add ecx, dword [rsp + 4]
shl ecx, 6
add ecx, dword [rsp + 8]
shl ecx, 6
add ecx, dword [rsp + 0xc]
cmp eax, 2
jg 0x446dec
lea r8d, [rcx + 0xff]
test ecx, ecx
cmovns r8d, ecx
sar r8d, 8
cmp eax, 2
je 0x446e50
lea r8d, [rcx + 0xffff]
test ecx, ecx
cmovns r8d, ecx
sar r8d, 0x10
test eax, eax
jne 0x446e50
lea r8d, [rcx + 0xffffff]
test ecx, ecx
cmovs ecx, r8d
sar ecx, 0x18
lea r10d, [rax - 1]
cmp r10d, 0xffffffff
je 0x446d3f
movsxd r10, r10d
nop dword [rax]
mov r9d, ecx
sar r9d, 0x1f
shr r9d, 0x18
lea r8d, [rcx + r9]
movzx r8d, r8b
sub r8d, r9d
test ecx, ecx
mov byte [rdx + r10], r8b
lea r8d, [rcx + 0xff]
cmovs ecx, r8d
sub r10, 1
sar ecx, 8
cmp r10d, 0xffffffff
jne 0x446e00
add rsp, 0x18
ret
sub eax, 0x41
jmp 0x446d53
mov ecx, r8d
jmp 0x446dec
mov r9d, dword [rsp + 8]
mov dword [rsp + 0xc], 0
mov eax, 2
mov r8d, 2
test r9d, r9d
js 0x446e7b
lea ecx, [r8 - 1]
jmp 0x446d79
cmp byte [rcx + 2], 0x3d
jne 0x446d3f
mov r11d, dword [rsp + 4]
mov dword [rsp + 8], 0
mov eax, 1
mov r8d, 1
test r11d, r11d
jns 0x446e72
cmp byte [rcx + 1], 0x3d
jne 0x446d3f
mov r10d, dword [rsp]
xor eax, eax
mov dword [rsp + 4], 0
test r10d, r10d
jns 0x446d90
cmp byte [rcx], 0x3d
jne 0x446d3f
xor ecx, ecx
jmp 0x446dad