joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d8f00
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d9902
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4d999a
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4d997e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9972
cmp qword [rbp - 0x10], 0
je 0x2fc4d9972
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d9938
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d999b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9aa0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d9ac8
mov eax, 0
jmp 0x2fc4d9b16
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d9af1
mov eax, 0
jmp 0x2fc4d9b16
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d9b11
mov eax, 0
jmp 0x2fc4d9b16
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9b1c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d9b9a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d9b91
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d9b91
mov rax, qword [rbp - 8]
jmp 0x2fc4d9baf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d9b64
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001000
Capabilities:
Parse pe header
Terminate process

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
cmp word [0x140000000], 0x5a4d
je 0x140001021
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x14000109d
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x140001042
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x14000109d
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x140001080
cmp ecx, 0x20b
je 0x14000105e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x14000109d
cmp dword [rax + 0x84], 0xe
ja 0x14000106f
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x14000109d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x60], ebx
jmp 0x14000109d
cmp dword [rax + 0x74], 0xe
ja 0x14000108e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x14000109d
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x60], ebx
mov ecx, 1
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x14000a358], 0xffffffffffffffff
mov qword [0x14000a360], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x14000a34c]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x14000a348]
mov dword [rcx], eax
call fcn.1400011e0
cmp dword [section..data], 0
jne 0x1400010f7
lea rcx, [fcn.1400011e0]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x1400040f0]
lea rcx, [0x1400040e8]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x14000a344]
mov dword [rsp + 0x68], r11d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x14000a340]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x1400040e0]
lea rcx, [0x1400040d8]
call sub.msvcrt.dll__initterm
mov r11, qword [rsp + 0x38]
mov rax, qword [sym.imp.msvcrt.dll___initenv]
mov qword [rax], r11
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
call fcn.140001250
mov edi, eax
mov dword [rsp + 0x34], eax
test ebx, ebx
jne 0x140001183
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x1400011a4
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret
Function at 0x140001250
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp ecx, 2
je 0x14000126d
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rcx, qword [rdx + 8]
call qword [sym.imp.msvcrt.dll__wtoi]
mov ebx, dword [0x140005014]
xor r8d, r8d
mov r10d, eax
lea rsi, [0x140005018]
test ebx, ebx
je 0x1400012ad
xor ecx, ecx
mov eax, dword [0x140005010]
shr eax, cl
add ecx, r10d
xor byte [r8 + rsi], al
mov ebx, dword [0x140005014]
inc r8d
cmp r8d, ebx
jb 0x140001290
mov edx, 0x19000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9, rsi
mov dword [rsp + 0x20], ebx
mov rdx, rax
mov rdi, rax
call fcn.140001594
test eax, eax
jle 0x1400012f4
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x1400012ec
and qword [rax + 8], 0
and dword [rax + 0x10], 0
mov qword [rax], rdi
mov rcx, rax
call fcn.14000311c
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x14000311c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx]
mov r13, rcx
xor ecx, ecx
movsxd rsi, dword [rdi + 0x3c]
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
mov edx, dword [rsi + rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r14d, r14d
mov rbp, rax
test rax, rax
je 0x1400032de
mov r10d, r14d
cmp r14w, word [rsi + rdi + 6]
jae 0x1400031b2
lea rcx, [rdi + 0x11c]
add rcx, rsi
mov edx, dword [rcx - 8]
mov r8d, dword [rcx]
mov r9d, dword [rcx - 4]
add rdx, rbp
add r8, rdi
test r9d, r9d
je 0x1400031a1
mov al, byte [r8]
inc r8
mov byte [rdx], al
inc rdx
dec r9d
jne 0x140003191
movzx eax, word [rsi + rdi + 6]
inc r10d
add rcx, 0x28
cmp r10d, eax
jl 0x14000317c
cmp dword [rsi + rdi + 0xb4], r14d
je 0x140003221
mov eax, dword [rsi + rdi + 0xb0]
mov r9, rbp
add rax, rbp
sub r9, qword [rsi + rdi + 0x30]
jmp 0x14000321b
mov r8d, ecx
mov ecx, dword [rax + 4]
lea rbx, [rax + 8]
sub rcx, 8
add r8, rbp
shr rcx, 1
test ecx, ecx
je 0x140003215
mov rdx, rbx
mov r10d, ecx
movzx eax, word [rdx]
mov r11d, eax
shr eax, 0xc
and r11d, 0xfff
cmp eax, 3
je 0x140003208
cmp eax, 0xa
jne 0x14000320c
add qword [r11 + r8], r9
add rdx, 2
dec r10
jne 0x1400031ee
mov eax, ecx
lea rax, [rbx + rax*2]
mov ecx, dword [rax]
test ecx, ecx
jne 0x1400031d0
cmp dword [rsi + rdi + 0x94], r14d
je 0x1400032b0
mov ebx, dword [rsi + rdi + 0x90]
add rbx, rbp
jmp 0x1400032ab
mov ecx, dword [rbx + 0xc]
add rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
test rax, rax
je 0x1400032de
mov r14d, dword [rbx]
mov r15d, dword [rbx + 0x10]
add r14, rbp
add r15, rbp
jmp 0x14000329e
mov rax, qword [r14]
mov ecx, 0x80000000
test rcx, rax
jne 0x140003287
movabs rcx, 0x8000000000000000
test rcx, rax
jne 0x140003287
lea rdx, [rbp + 2]
add rdx, rax
jmp 0x14000328a
movzx edx, ax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15], rax
add r15, 8
add r14, 8
cmp dword [r14], 0
jne 0x140003262
add rbx, 0x14
xor r14d, r14d
cmp dword [rbx], r14d
jne 0x14000323b
mov edx, dword [rsi + rdi + 0x50]
lea r9, [rsp + 0x50]
mov r8d, 0x40
mov rcx, rbp
mov dword [rsp + 0x50], r14d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsi + rdi + 0x28]
mov rdx, qword [r13 + 8]
mov ecx, dword [r13 + 0x10]
add rax, rbp
call rax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x141074058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410741df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141074089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14107406f
add dl, dl
jne 0x141074096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410740f6
xor eax, eax
add dl, dl
jne 0x1410740a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410741ad
add dl, dl
jne 0x1410740b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410740c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410740d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410740dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410740ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14107407e
mov eax, 1
add dl, dl
jne 0x141074106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141074113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410740fb
sub eax, ebx
mov ebx, 1
jne 0x14107414c
mov ecx, 1
add dl, dl
jne 0x14107412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14107413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141074123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14107407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141074168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141074175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14107415d
cmp eax, 0x7d00
jae 0x14107419b
cmp eax, 0x500
jb 0x141074196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14107407e
cmp eax, 0x7f
ja 0x14107419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14107407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410741d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14107407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001290
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x27ead076
mov rbx, rcx
jne 0x1400012e7
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x1400012e7
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400012e7
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
test rax, rax
je 0x1400012e7
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
jmp 0x1400012ec
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret

Function at 0x1400012f4
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx], 0x27ead076
mov rbx, rcx
jne 0x1400013f7
mov eax, dword [rcx + 4]
test eax, eax
je 0x1400013f7
and qword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
add eax, 0xccefd76
movsxd rcx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400013f7
mov rdi, qword [rbx + 0x18]
add rdi, 0xd0ce640
cmp byte [rbx + 0x21], 0
je 0x140001369
mov rdx, qword [rbx + 8]
mov rcx, qword [0x140004050]
add rdx, 0xc094835
call fcn.140001710
jmp 0x140001392
mov rcx, qword [rcx + 0x28]
test rcx, rcx
jne 0x140001382
call fcn.140001408
mov ecx, eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rcx + rax]
mov rdx, qword [rbx + 8]
add rdx, 0xc094835
call fcn.140001710
mov r10, rax
test rax, rax
je 0x1400013f7
mov ecx, 0x1000
mov eax, r10d
and eax, 0xfff
sub ecx, eax
cmp ecx, edi
cmovl edi, ecx
mov rcx, qword [rbx + 0x10]
and qword [rsp + 0x48], 0
add rcx, 0x147e620
cmp byte [rbx + 0x20], 0
movsxd r8, edi
je 0x1400013da
mov rdx, rcx
lea r9, [rsp + 0x48]
mov rcx, r10
call fcn.1400018f4
jmp 0x1400013f3
lea rax, [rsp + 0x48]
mov r9d, 1
mov rdx, r10
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_MmCopyMemory]
xor eax, eax
jmp 0x1400013fc
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140001634
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x27ead076
mov rbx, rcx
jne 0x140001699
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x140001699
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001699
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
mov rcx, rax
call fcn.140001010
mov rcx, qword [rsp + 0x30]
mov qword [0x140004050], rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, qword [rbx + 8]
mov qword [rax], 1
xor eax, eax
jmp 0x14000169e
mov eax, 0xc0000001
add rsp, 0x20
pop rbx
ret
Function at 0x100411cb0
Capabilities:
Packed with generic packer

Disassembly:
add byte [rax], al
add byte [rax + 0x3300000], ah
add eax, dword [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
nop
add byte [rax], al
sbb al, 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
clc
rol dword [rax], cl
add byte [rax + 3], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], ch
je 0x100411ca2
js fcn.100411cb3
add byte [rax], al
add byte [rax], bl
add byte [r8], al
add byte [rax], dl
add byte [rax], al
add byte [rax + rax], al
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], ah
push rax
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x40], spl
invalid
Function at 0x140031a0d
Capabilities:
Encode data using base64

Disassembly:
mov word [rax + rdi - 1], bp
movsx esi, byte [rsp + rax*4 + 4]
lea rbx, [rbx + rax*4 - 8]
ror byte [rsp + rax*2 + 9], 0x61
mov ebp, 0xdea86cbf
or rsi, qword [rsp + rax*2 + 6]
mov r10d, dword [rax + rbx - 1]
lea rdx, [rax + rax - 0x7cc32dc9]
xor r10d, r9d
add r10d, eax
mov qword [rsp + rax - 1], 0xffffffff96338f27
dec si
ror byte [rsp + rax*4 + 6], 0x42
xor r10d, 0xf9395a87
btc si, cx
lea r10d, [r10 + rax - 0x20a673a8]
or ebp, edx
inc qword [rsp + rax - 1]
cdqe
bswap r10d
mov qword [rsp + rax + 7], r9
xor dword [rsp + rax + 7], r10d
dec ax
add dword [rsp + rax*2 + 1], 0xf6b6a583
mov r9, qword [rsp + rax + 8]
cbw
or rax, rdx
movsxd r10, r10d
sets byte [rsp + rdx + 0x7cc32dcb]
mov qword [rsp + rax + 0x7cc32dcf], 0xfffffffff788050a
call fcn.14007e006

Function at 0x14003cfcf
Capabilities:
Encode data using base64

Disassembly:
pop rdi
pop rcx
pop r8
jae fcn.140076119
mov r9, qword [rsp + rsi*2 + 0x44]
mov qword [rsp + rsi + 0x32], 0xffffffffdd9280ba
mov rsi, qword [rsp + rsi*2 + 0x4c]
call fcn.140057bff

Function at 0x1400441b8
Capabilities:
Encode data using base64

Disassembly:
push r9
push rax
xor dword [rsp + rbp*2 + 8], r11d
cdq
mov r9, qword [rsp + rbp*2 + 8]
movsxd r11, r11d
add r8, r11
lea rcx, [rdx + rax + 0x42142c22]
add rax, rsi
mov qword [rsp + rbp*2 + 8], rdx
lea rbx, [rbx + rbp*4 - 1]
mul cx
movzx r10d, byte [rbx + rbp*2]
movsx r11d, word [rsp + rbp*2 + 4]
sal bp, cl
xadd qword [rsp + rbp*8 + 8], rbp
xor r10b, r9b
cbw
neg r10b
add cx, si
xchg esi, r11d
cqo
ror r10b, 1
neg r10b
xchg dword [rsp + rdx + 9], r11d
ror r10b, 1
bswap r11
xor r9b, r10b
shl edx, 0x54
sbb rcx, qword [rsp + rdx + 2]
lea rdi, [rdi + rdx - 2]
mov word [rsp + rdx*8 + 4], si
sbb bpl, dl
mov word [rdi + rdx*2], r10w
movsx r10d, sil
pop rdx
pop rsi
jnp fcn.140054d0c
xor edi, r11d
rol edi, 2
shl dx, 0x6b
jp 0x140050f13
mov qword [rsp], rbp
mov esi, ebp
xor r11d, r9d
bswap r11d
not r11d
pop rbp
inc r11d
lea rax, [rsi*2 - 0x30f1d077]
sal bpl, 0xa5
cdqe
not r11d
xor bpl, 0x84
adc ebp, 0xf4a78480
lea r11d, [r11 + rax*2 + 0x31aeb3ec]
bt bp, bp
shl rbp, 0x7d
jae 0x14003bdea
xor dx, ax
not edi
lea r8, [rbx*4 - 0x56cbfae1]
lea edi, [rdx + rdi - 0x748fe412]
xor dx, bx
not edi
movzx r9d, cl
ja 0x14006b36f

Function at 0x140050f36
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rdi + 8], ebx
mov r11, qword [rsp + rdi + 8]
rol r8w, 0xaf
call fcn.14005b42c
Function at 0x140ad8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140ad81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ad8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ad806f
add dl, dl
jne 0x140ad8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ad80f6
xor eax, eax
add dl, dl
jne 0x140ad80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ad81ad
add dl, dl
jne 0x140ad80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ad80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ad80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ad80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ad80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ad807e
mov eax, 1
add dl, dl
jne 0x140ad8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ad8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ad80fb
sub eax, ebx
mov ebx, 1
jne 0x140ad814c
mov ecx, 1
add dl, dl
jne 0x140ad812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ad813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ad8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ad807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ad8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ad8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ad815d
cmp eax, 0x7d00
jae 0x140ad819b
cmp eax, 0x500
jb 0x140ad8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ad807e
cmp eax, 0x7f
ja 0x140ad819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ad807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ad81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ad807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001a1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
test edx, edx
je 0x140001b92
mov r13d, edx
mov edi, 0
lea r14, [0x140001530]
lea rbx, [0x1405b7501]
jmp 0x140001a84
mov byte [0x1405b7501], 0
mov edx, esi
sar edx, 0x1f
shr edx, 0x1b
lea eax, [rsi + rdx]
and eax, 0x1f
sub eax, edx
cdqe
lea rdx, [0x1405b74e0]
xor bpl, byte [rdx + rax]
mov byte [r12 + rdi], bpl
add rdi, 1
cmp r13, rdi
je 0x140001b92
mov esi, edi
movzx ebp, byte [r12 + rdi]
mov byte [rsp + 0x20], 0x85
mov byte [rsp + 0x21], 0x87
mov byte [rsp + 0x22], 0x8a
mov byte [rsp + 0x23], pe_nt_image_headers64
mov byte [rsp + 0x24], 0x8b
mov byte [rsp + 0x25], 0x81
mov byte [rsp + 0x26], 0x81
mov byte [rsp + 0x27], 0x83
mov byte [rsp + 0x28], pe_nt_image_headers64
mov byte [rsp + 0x29], 0x86
mov byte [rsp + 0x2a], 0x89
mov byte [rsp + 0x2b], 0x78
mov byte [rsp + 0x2c], 0x7a
mov byte [rsp + 0x2d], 0x8c
mov byte [rsp + 0x2e], 0x77
mov byte [rsp + 0x2f], 0x8a
mov byte [rsp + 0x30], 0x7a
mov byte [rsp + 0x31], 0x75
mov byte [rsp + 0x32], 0x83
mov byte [rsp + 0x33], 0x75
mov byte [rsp + 0x34], 0x86
mov byte [rsp + 0x35], 0x81
mov byte [rsp + 0x36], pe_nt_image_headers64
mov byte [rsp + 0x37], 0x7f
mov byte [rsp + 0x38], 0x83
mov byte [rsp + 0x39], 0x88
mov byte [rsp + 0x3a], 0x75
mov byte [rsp + 0x3b], 0x86
mov byte [rsp + 0x3c], 0x78
mov byte [rsp + 0x3d], 0x81
mov byte [rsp + 0x3e], 0x7c
mov byte [rsp + 0x3f], 0x8b
mov byte [rsp + 0x40], 0x13
cmp byte [0x1405b74c0], 0
jne 0x140001b6d
mov byte [0x1405b7501], 1
mov eax, 0
lea rcx, [0x1405b74e0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x21
jne 0x140001b4c
mov byte [0x1405b74c0], 1
mov rcx, r14
call fcn.1400014f0
cmp byte [0x1405b7501], 0
je 0x140001a56
lea rax, [0x1405b74e0]
sub byte [rax], 0x13
add rax, 1
cmp rbx, rax
jne 0x140001b81
jmp 0x140001a4f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140006b30
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x140006b60
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x140006b5f
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140006b65
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x140006b5f
mov eax, 0
jmp 0x140006b5f

Function at 0x1400071e0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140007190
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140010810
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140019350
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140019350
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]