joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d7d32a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d7f45e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d7d3428
mov rax, qword [0x6d7f45e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d7d32ec
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d7d3375
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d7d32d0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d7d345d
mov rax, qword [0x6d7f45e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d7f45e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d7d3440
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d7d336e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d7d33d0
add dword [0x6d7f45e4], 1
cmp edi, 8
jae 0x6d7d33a3
test dil, 4
jne 0x6d7d3414
test edi, edi
je 0x6d7d3398
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d7d342f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d7d3398
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d7d33bc
jmp 0x6d7d3398
add rsi, qword [0x6d7f45e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d7d336e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d7d3398
xor esi, esi
jmp 0x6d7d32f7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d7d3398
mov rax, qword [0x6d7f45e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d7d3bb0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d7f48c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d7f48a0]
test rbx, rbx
je 0x6d7d3c04
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d7d3bfb
test rsi, rsi
je 0x6d7d3bfb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d7d3be0
lea rcx, [0x6d7f48c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d7d3e40
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d7d3e50
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d7d3e60
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d7d3ea1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d7d3e98
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d7d3ea3
add rax, 0x28
cmp rax, r9
jne 0x6d7d3e84
xor eax, eax
ret

Function at 0x6d7d3f40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f11f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d7d3fad
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d3fad
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d3fad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d3fa4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d3faf
add rax, 0x28
cmp rax, r9
jne 0x6d7d3f90
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d7d40b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d7f11f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d7d40d0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d40c8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d7d412d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d7d4124
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d7d4134
add rax, 0x28
cmp rax, r9
jne 0x6d7d4110
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d7d4150
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d7f11f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d7d41be
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d7d41be
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d7d41be
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d7d41be
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d7d41b5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d7d41c5
add rcx, 0x28
cmp rcx, rax
jne 0x6d7d41a0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d7d41d8
jmp 0x6d7d41be
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d7d41e6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d7d41be
test r9d, r9d
jg 0x6d7d41d0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d7d4520
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6d8f49d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d9155e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8f4b58
mov rax, qword [0x6d9155e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8f4a1c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8f4aa5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8f4a00
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8f4b8d
mov rax, qword [0x6d9155e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d9155e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8f4b70
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8f4a9e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8f4b00
add dword [0x6d9155e4], 1
cmp edi, 8
jae 0x6d8f4ad3
test dil, 4
jne 0x6d8f4b44
test edi, edi
je 0x6d8f4ac8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8f4b5f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8f4ac8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8f4aec
jmp 0x6d8f4ac8
add rsi, qword [0x6d9155e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8f4a9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8f4ac8
xor esi, esi
jmp 0x6d8f4a27
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8f4ac8
mov rax, qword [0x6d9155e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8f52e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d9158c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d9158a0]
test rbx, rbx
je 0x6d8f5334
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8f532b
test rsi, rsi
je 0x6d8f532b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8f5310
lea rcx, [0x6d9158c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d8f5570
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8f5580
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8f5590
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8f55d1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8f55c8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8f55d3
add rax, 0x28
cmp rax, r9
jne 0x6d8f55b4
xor eax, eax
ret

Function at 0x6d8f5670
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d9121f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8f56dd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8f56dd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8f56dd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8f56d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8f56df
add rax, 0x28
cmp rax, r9
jne 0x6d8f56c0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8f57e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d9121f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8f5800
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8f57f8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8f585d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8f5854
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8f5864
add rax, 0x28
cmp rax, r9
jne 0x6d8f5840
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8f5880
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d9121f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8f58ee
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8f58ee
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8f58ee
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8f58ee
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8f58e5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8f58f5
add rcx, 0x28
cmp rcx, rax
jne 0x6d8f58d0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8f5908
jmp 0x6d8f58ee
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8f5916
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8f58ee
test r9d, r9d
jg 0x6d8f5900
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8f5c80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140003910
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14002d1c0]
test rax, rax
jne 0x140003a00
mov rax, qword gs:[0x30]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
movabs rbp, 0x56fb3048e4758c3f
mov qword [rsp + 0x40], rsi
mov rcx, qword [rax + 0x60]
mov qword [rsp + 0x20], rdi
mov rax, qword [rcx + 0x18]
mov rsi, qword [rax + 0x10]
nop word [rax + rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400039c9
mov ebx, dword [rdi + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x1400039c9
mov r9d, dword [rdi + 0x20]
add r9, r11
nop dword [rax]
mov eax, dword [r9]
xor r8d, r8d
add rax, r11
movzx ecx, byte [rax]
test cl, cl
je 0x1400039bd
movsx edx, cl
lea rax, [rax + 1]
movzx ecx, byte [rax]
xor rdx, r8
imul r8, rdx, 0x1000193
test cl, cl
jne 0x1400039a0
cmp r8, rbp
je 0x1400039ce
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140003990
mov rsi, qword [rsi]
jmp 0x140003960
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r11
mov rdi, qword [rsp + 0x20]
add rcx, r11
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
movzx edx, word [rax + r10*2]
mov rbx, qword [rsp + 0x30]
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x14002d1c0], rax
call rax
mov r8d, eax
mov eax, 0x38e38e39
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*8]
sub r8d, ecx
lea eax, [r8 + 8]
add rsp, 0x28
ret
Function at 0x140022110
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r14
sub rsp, 0x30
mov r14, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002223c
mov rax, qword [r14 + 8]
test rax, rax
je 0x140022149
imul r8, rax, 0x84
test r8, r8
je 0x140022141
xor edx, edx
call fcn.1400258e4
mov qword [r14 + 8], 0
mov rax, qword [0x14002d210]
test rax, rax
jne 0x140022230
mov rax, qword gs:[0x30]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x28], rdi
mov rcx, qword [rax + 0x60]
mov qword [rsp + 0x20], r15
movabs r15, 0x19c0f48bf548020e
mov rax, qword [rcx + 0x18]
mov rsi, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x1400221f9
mov ebx, dword [rdi + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x1400221f9
mov r9d, dword [rdi + 0x20]
add r9, r11
nop dword [rax]
mov eax, dword [r9]
xor r8d, r8d
add rax, r11
movzx ecx, byte [rax]
test cl, cl
je 0x1400221ed
movsx edx, cl
lea rax, [rax + 1]
movzx ecx, byte [rax]
xor rdx, r8
imul r8, rdx, 0x1000193
test cl, cl
jne 0x1400221d0
cmp r8, r15
je 0x1400221fe
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x1400221c0
mov rsi, qword [rsi]
jmp 0x140022190
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r11
mov r15, qword [rsp + 0x20]
add rcx, r11
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
movzx edx, word [rax + r10*2]
mov rbx, qword [rsp + 0x48]
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x14002d210], rax
mov rcx, qword [r14]
call rax
mov qword [r14], 0
add rsp, 0x30
pop r14
ret
Function at 0x140022530
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r14
sub rsp, 0x30
mov r14, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002265c
mov rax, qword [r14 + 8]
test rax, rax
je 0x140022566
imul r8, rax, 0x34
test r8, r8
je 0x14002255e
xor edx, edx
call fcn.1400258e4
mov qword [r14 + 8], 0
mov rax, qword [0x14002d210]
test rax, rax
jne 0x140022650
mov rax, qword gs:[0x30]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x28], rdi
mov rcx, qword [rax + 0x60]
mov qword [rsp + 0x20], r15
movabs r15, 0x19c0f48bf548020e
mov rax, qword [rcx + 0x18]
mov rsi, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140022619
mov ebx, dword [rdi + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x140022619
mov r9d, dword [rdi + 0x20]
add r9, r11
nop dword [rax]
mov eax, dword [r9]
xor r8d, r8d
add rax, r11
movzx ecx, byte [rax]
test cl, cl
je 0x14002260d
movsx edx, cl
lea rax, [rax + 1]
movzx ecx, byte [rax]
xor rdx, r8
imul r8, rdx, 0x1000193
test cl, cl
jne 0x1400225f0
cmp r8, r15
je 0x14002261e
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x1400225e0
mov rsi, qword [rsi]
jmp 0x1400225b0
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r11
mov r15, qword [rsp + 0x20]
add rcx, r11
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
movzx edx, word [rax + r10*2]
mov rbx, qword [rsp + 0x48]
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x14002d210], rax
mov rcx, qword [r14]
call rax
mov qword [r14], 0
add rsp, 0x30
pop r14
ret
Function at 0x140022680
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r14
sub rsp, 0x30
mov r14, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400227ac
mov rax, qword [r14 + 8]
test rax, rax
je 0x1400226b9
imul r8, rax, 0x104
test r8, r8
je 0x1400226b1
xor edx, edx
call fcn.1400258e4
mov qword [r14 + 8], 0
mov rax, qword [0x14002d210]
test rax, rax
jne 0x1400227a0
mov rax, qword gs:[0x30]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x28], rdi
mov rcx, qword [rax + 0x60]
mov qword [rsp + 0x20], r15
movabs r15, 0x19c0f48bf548020e
mov rax, qword [rcx + 0x18]
mov rsi, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140022769
mov ebx, dword [rdi + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x140022769
mov r9d, dword [rdi + 0x20]
add r9, r11
nop dword [rax]
mov eax, dword [r9]
xor r8d, r8d
add rax, r11
movzx ecx, byte [rax]
test cl, cl
je 0x14002275d
movsx edx, cl
lea rax, [rax + 1]
movzx ecx, byte [rax]
xor rdx, r8
imul r8, rdx, 0x1000193
test cl, cl
jne 0x140022740
cmp r8, r15
je 0x14002276e
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140022730
mov rsi, qword [rsi]
jmp 0x140022700
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r11
mov r15, qword [rsp + 0x20]
add rcx, r11
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
movzx edx, word [rax + r10*2]
mov rbx, qword [rsp + 0x48]
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x14002d210], rax
mov rcx, qword [r14]
call rax
mov qword [r14], 0
add rsp, 0x30
pop r14
ret
Function at 0x140023240
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r14
sub rsp, 0x30
mov r14, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002336c
mov rax, qword [r14 + 8]
test rax, rax
je 0x140023276
imul r8, rax, 0x44
test r8, r8
je 0x14002326e
xor edx, edx
call fcn.1400258e4
mov qword [r14 + 8], 0
mov rax, qword [0x14002d210]
test rax, rax
jne 0x140023360
mov rax, qword gs:[0x30]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x28], rdi
mov rcx, qword [rax + 0x60]
mov qword [rsp + 0x20], r15
movabs r15, 0x19c0f48bf548020e
mov rax, qword [rcx + 0x18]
mov rsi, qword [rax + 0x10]
nop dword [rax]
mov r11, qword [rsi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140023329
mov ebx, dword [rdi + 0x18]
xor r10d, r10d
test ebx, ebx
je 0x140023329
mov r9d, dword [rdi + 0x20]
add r9, r11
nop dword [rax]
mov eax, dword [r9]
xor r8d, r8d
add rax, r11
movzx ecx, byte [rax]
test cl, cl
je 0x14002331d
movsx edx, cl
lea rax, [rax + 1]
movzx ecx, byte [rax]
xor rdx, r8
imul r8, rdx, 0x1000193
test cl, cl
jne 0x140023300
cmp r8, r15
je 0x14002332e
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x1400232f0
mov rsi, qword [rsi]
jmp 0x1400232c0
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r11
mov r15, qword [rsp + 0x20]
add rcx, r11
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
movzx edx, word [rax + r10*2]
mov rbx, qword [rsp + 0x48]
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x14002d210], rax
mov rcx, qword [r14]
call rax
mov qword [r14], 0
add rsp, 0x30
pop r14
ret
Function at 0x1400375a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400375cd
xor al, al
jmp 0x14003772f
mov rax, qword [0x1400576b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400576b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400576c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400576c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400576d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400576d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400576e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400576e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400576f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140037721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140037679
mov r11d, 2
jmp 0x14003769d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140037693
mov r11d, 1
jmp 0x14003769d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140037745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400376e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400376fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14003770a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140037718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140037660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14003772a