joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093a70
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov edi, r8d
movzx ecx, byte [rcx + 0x200072]
mov rsi, rdx
cmp cl, 8
jne 0x140093c65
test rdx, rdx
je 0x140093c65
test r8d, r8d
je 0x140093c65
movzx eax, byte [rbx + 0x200094]
cmp al, 1
jne 0x140093ae3
mov r8d, edi
lea rcx, str._AsusSync_SharedCamNativeEx__ProcessVideoDataLite__ID:_d__Size:_d__n
xor edx, edx
call fcn.140095ab0
movzx ecx, byte [rbx + 0x200072]
movzx eax, byte [rbx + 0x200094]
mov dword [rsp + 0x30], 0
cmp cl, 8
jne 0x140093c44
mov rdx, qword [rbx + 0x2000f0]
test rdx, rdx
je 0x140093c37
lea rcx, [rdx + 0x1e]
test rcx, rcx
je 0x140093b52
mov r8, rdi
mov rdx, rsi
call fcn.1400c4a50
mov rax, qword [rbx + 0x2000f0]
mov ecx, 0x780
mov dword [rax], edi
mov rax, qword [rbx + 0x2000f0]
mov dword [rax + 4], edi
mov rax, qword [rbx + 0x2000f0]
mov word [rax + 0xe], cx
mov ecx, 0x438
mov rax, qword [rbx + 0x2000f0]
mov word [rax + 0x10], cx
mov rdx, qword [rbx + 0x2000f0]
mov rcx, qword [rbx + 0x200080]
cmp rcx, 0xffffffffffffffff
je 0x140093b93
mov r8d, dword [rbx + 0x50]
lea r9, [rsp + 0x30]
add rdx, 0x1e
mov qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0x140093b93
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str._AsusSync_SharedCamNativeEx__AssembleH264Frame___WriteFile_bitmap_info_header_fail:0x_X_n
call fcn.140095ab0
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ecx, dword [0x1401696e0]
test eax, eax
mov dword [0x1401696e4], eax
cmovne ecx, eax
mov dword [0x1401696e0], ecx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov rax, qword [rbx + 0x2000f0]
mov byte [rax + 0x1c], 1
cmp byte [rbx + 0x200072], 8
jne 0x140093c07
nop word [rax + rax]
mov rax, qword [rbx + 0x2000f0]
cmp byte [rax + 0x1d], 0
jne 0x140093c07
mov ecx, 1
call qword [sym.imp.api_ms_win_mm_time_l1_1_0.dll_timeBeginPeriod]
mov ecx, 5
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_mm_time_l1_1_0.dll_timeEndPeriod]
cmp byte [rbx + 0x200072], 8
je 0x140093bd0
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
cmp byte [rbx + 0x200094], 1
jne 0x140093c1c
inc dword [0x1401696dc]
mov rcx, qword [rbx + 0x2000f0]
test rcx, rcx
je 0x140093c50
xor edx, edx
mov r8d, 0x20001e
call fcn.1400c5120
jmp 0x140093c50
cmp al, 1
jne 0x140093c50
lea rcx, str._AsusSync_SharedCamNativeEx__AssembleH264Frame___pSharedTemp_is_NULL_n
jmp 0x140093c4b
lea rcx, str._AsusSync_SharedCamNativeEx__AssembleH264Frame_is_not_ready_n
call fcn.140095ab0
cmp byte [rbx + 0x200094], 1
jne 0x140093c65
lea rcx, str._AsusSync_SharedCamNativeEx__ProcessVideoDataLite__AssembleH264FrameLite_out_n
call fcn.140095ab0
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140093c90
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x3c], 4
lea rdx, str.SOFTWAREASUSASUS_System_Control_InterfaceLinktoMyASUSSharedCam
mov dword [rsp + 0x40], 4
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x140093d5e
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Inuse
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140093d31
cmp dword [rsp + 0x38], eax
setne al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x58
ret
mov edx, eax
lea rcx, str._AsusSync_SharedCamNativeEx__Error_in_SharedCam_RegQueryValueEx___d_._n
call fcn.140095ab0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x58
ret
mov edx, eax
lea rcx, str._AsusSync_SharedCamNativeEx__Error_in_SharedCam_RegOpenKeyEx___d_._n
call fcn.140095ab0
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2450
add rsp, 0x58
ret

Function at 0x1400940b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x30], rbx
mov qword [rcx], rdx
xor esi, esi
mov word [rcx + 8], si
mov dword [rcx + 0x18], 0x64
add rcx, 0x20
mov rdx, r8
call fcn.140013730
mov eax, 0xffff
mov word [rdi + 0x40], ax
mov qword [rdi + 0x48], 0xffffffffffffffff
mov byte [rdi + 0x50], sil
movzx eax, byte [rsp + 0x70]
mov byte [rdi + 0x51], al
mov word [rdi + 0x52], si
mov qword [rdi + 0x58], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x70], rsi
mov rax, qword [rsp + 0x80]
mov qword [rdi + 0x78], rax
mov qword [rdi + 0x80], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x140094360]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [rdi + 0x10], rax
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14009419a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140094195
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400941c9
mov rcx, r8
call fcn.1400c2470
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.1400c8b64
int3
Function at 0x1400941d0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov byte [rcx + 0x50], 1
mov rcx, qword [rcx + 0x48]
cmp rcx, 0xffffffffffffffff
je 0x140094208
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 0x48], 0xffffffffffffffff
xor edi, edi
cmp qword [rbx + 0x10], rdi
je 0x1400942ae
mov dword [rsp + 0x20], edi
lea rcx, str._AsusSync_TCPServer__TCPServer___Wait_Start_n
call fcn.140095ab0
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeThread]
test eax, eax
je 0x140094280
mov edx, dword [rsp + 0x20]
cmp edx, 0x103
jne 0x140094277
mov edx, 0x3e8
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x140094294
cmp byte [rbx + 0x53], dil
jne 0x140094294
lea rcx, str._AsusSync_TCPServer__TCPServer___wait_thread_STILL_ACTIVE_terminate_it_n
call fcn.140095ab0
xor edx, edx
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateThread]
jmp 0x140094294
lea rcx, str._AsusSync_TCPServer__TCPServer___wait_thread_code:_d_n
jmp 0x14009428f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, str._AsusSync_TCPServer__TCPServer___wait_thread_fail_:_d_n
call fcn.140095ab0
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx + 0x10], rdi
lea rcx, str._AsusSync_TCPServer__TCPServer___Wait_End_n
call fcn.140095ab0
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1400942f4
mov rdx, qword [rbx + 0x68]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400942e3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140094358
mov rcx, r8
call fcn.1400c2470
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x68], rdi
mov rdx, qword [rbx + 0x38]
cmp rdx, 8
jb 0x140094330
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx + 0x20]
cmp rdx, 0x1000
jb 0x14009432b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140094358
mov rcx, r8
call fcn.1400c2470
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x38], 7
mov word [rbx + 0x20], di
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.1400c8b64
int3
Function at 0x140097330
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140164030]
xor rax, rsp
mov qword [rsp + 0x268], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140097448
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32FirstW]
test eax, eax
je 0x140097448
mov qword [rsp + 0x280], rsi
xor esi, esi
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400973b4
add rax, 2
test ecx, ecx
jne 0x1400973a0
test edx, edx
jne 0x1400973d5
mov ecx, dword [rsp + 0x28]
lea rdx, [rsp + 0x260]
mov dword [rsp + 0x260], esi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ProcessIdToSessionId]
test eax, eax
jne 0x14009741b
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_toolhelp_l1_1_0.dll_Process32NextW]
test eax, eax
jne 0x140097392
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor al, al
mov rsi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.1400c2450
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
mov r8d, dword [rsp + 0x28]
mov edx, 1
mov ecx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov al, 1
jmp 0x1400973f2
xor al, al
jmp 0x1400973fa
Function at 0x140001070
Capabilities:
Create thread
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
mov rbx, rax
test rax, rax
je 0x14000113d
mov r8d, 0x234
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140001132
lea rdi, str.winlogon.exe
nop word [rax + rax]
lea rdx, [rsp + 0x6c]
mov rax, 0xffffffffffffffff
nop dword [rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rdi + rax*2 + 2]
jne 0x140001120
add rax, 2
cmp rax, 0xd
je 0x14000116f
movzx ecx, word [rdx + rax*2]
cmp cx, word [rdi + rax*2]
je 0x140001100
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400010f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, str.Winlogon_PID_:__d_n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400012b0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
mov ebx, dword [rsp + 0x48]
lea rcx, str.Winlogon_PID_:__d_n
mov edx, ebx
call fcn.140001010
test ebx, ebx
je 0x140001149
lea rcx, str._____Winlogon_PID_Found__n
call fcn.140001010
mov r8d, ebx
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1400011c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.______Winlogon_Handle_Failed__Error_Code_:__d_n
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
jmp 0x140001149
lea rcx, str._____Winlogon_Process_Found__n
call fcn.140001010
xor edi, edi
lea r8, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x30], rdi
lea edx, [rdi + 0xb]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp qword [rsp + 0x30], rdi
jne 0x14000120f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.______Winlogon_Token_Getting_Failed__Error_Code_:__d_n
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
jmp 0x140001149
lea rcx, str._____Winlogon_Token_Accessed__n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
lea rcx, str._____Winlogon_Token_Impersonated__n
call fcn.140001010
xor edx, edx
lea rcx, [0x1400033e4]
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edx, 8
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movabs rcx, 0x89600000008fe8fc
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov dword [rsp + 0x20], edi
mov r8, rax
xor edx, edx
mov qword [rax], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
jmp 0x14000114e
Function at 0x1400012dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140003638], rbx
je 0x140001328
cmp rax, rbx
jne 0x14000131b
mov ebx, 1
mov esi, ebx
jmp 0x14000132d
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001300
mov ebx, 1
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x140001343
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400013a8
mov eax, dword [0x140003640]
test eax, eax
jne 0x1400013a2
mov dword [0x140003640], ebx
lea r15, [0x1400022c0]
lea rdi, [0x1400022a8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001394
test eax, eax
jne 0x140001398
cmp qword [rdi], 0
je 0x140001389
mov rax, qword [rdi]
mov rcx, qword [0x140002288]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000136a
test eax, eax
je 0x1400013a8
mov eax, 0xff
jmp 0x140001484
mov dword [0x140003044], ebx
mov eax, dword [0x140003640]
cmp eax, ebx
jne 0x1400013cf
lea rdx, [0x1400022a0]
lea rcx, [0x140002290]
call sub.msvcrt.dll__initterm
mov dword [0x140003640], 2
test esi, esi
jne 0x1400013dc
xor eax, eax
xchg qword [0x140003638], rax
cmp qword [0x140003648], 0
je 0x140001410
lea rcx, [0x140003648]
call fcn.140001650
test eax, eax
je 0x140001410
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140003648]
mov r9, qword [0x140002288]
call r9
mov r8, qword [0x140003058]
mov rdx, qword [0x140003050]
mov ecx, dword [0x140003048]
call fcn.14000119c
mov dword [0x140003040], eax
cmp dword [0x140003060], 0
jne 0x140001440
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003044], 0
jne 0x140001455
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003040]
jmp 0x140001484
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140183000
add rsp, 0x28
jmp 0x1400012dc

Function at 0x140001550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000159c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001594
cmp dword [rcx + 0x3c], edx
jl 0x140001594
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001594
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000159c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400206e0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x140020712
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x140020771
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x14002075d
mov rcx, rbx
mov r8, r14
call fcn.1400bfc30
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x1400206fb
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x14002080e
lea rcx, [rbx*8]
call fcn.1400219d0
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x1400207e5
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x1400207d4
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x1400206fb
call fcn.14001d1b0
mov r8, qword [rsi + 0x10]
jmp 0x1400206fb
call fcn.140025240
int3

Function at 0x140020820
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x140020852
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x1400208b1
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x14002089d
mov rcx, rbx
mov r8, r14
call fcn.1400bfc30
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x14002083b
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x14002094e
lea rcx, [rbx*8]
call fcn.1400219d0
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x140020925
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x140020914
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x14002083b
call fcn.14001d1b0
mov r8, qword [rsi + 0x10]
jmp 0x14002083b
call fcn.140025240
int3
Function at 0x140020960
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x140020992
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x1400209f1
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x1400209dd
mov rcx, rbx
mov r8, r14
call fcn.1400bfc30
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x14002097b
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x140020a8e
lea rcx, [rbx*8]
call fcn.1400219d0
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x140020a65
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x140020a54
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x14002097b
call fcn.14001d1b0
mov r8, qword [rsi + 0x10]
jmp 0x14002097b
call fcn.140025240
int3

Function at 0x140020aa0
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x140020ad1
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x140020b23
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x140020b15
mov rcx, rbx
call fcn.1400bfc30
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x140020abb
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x140020bc9
lea rcx, [r14*8]
call fcn.1400219d0
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x140020ba0
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x140020b8f
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x140020abb
call fcn.14001d1b0
mov rbx, qword [rsi + 8]
jmp 0x140020abb
call fcn.140025240
int3
Function at 0x140023b20
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x140023b51
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x140023ba3
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x140023b95
mov rcx, rbx
call fcn.1400bfc30
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x140023b3b
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x140023c49
lea rcx, [r14*8]
call fcn.1400219d0
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x140023c20
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x140023c0f
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x140023b3b
call fcn.14001d1b0
mov rbx, qword [rsi + 8]
jmp 0x140023b3b
call fcn.140025240
int3