joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c4f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140050af8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001c55f
cmp byte [rcx + 0x71], 0
je 0x14001c55f
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001c5b4
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001c579
sub eax, 1
je 0x14001c57d
cmp eax, 2
jne 0x14001c5b4
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140023540
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001c5ab
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001c5b4
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001c561
xor al, al
jmp 0x14001c561

Function at 0x14001c710
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140050af8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001c783
cmp byte [rcx + 0x72], 0
je 0x14001c783
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14001c7d8
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001c79d
sub eax, 1
je 0x14001c7a1
cmp eax, 2
jne 0x14001c7d8
mov byte [rbx + 0x72], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140023540
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001c7cf
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001c7d8
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14001c785
xor al, al
jmp 0x14001c785
Function at 0x1400200e4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x11
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1400200f1
mov byte [rcx + 0x15], r10b
ret

Function at 0x14002010c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x2f
jb 0x140020113
mov byte [rcx + 0x33], 0
ret

Function at 0x140020134
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x2b
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x140020141
mov byte [rcx + 0x2f], r10b
ret

Function at 0x14002015c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x4b
jb 0x140020163
mov byte [rcx + 0x4f], 0
ret

Function at 0x1400201bc
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x29
jb 0x1400201c3
mov byte [rcx + 0x2d], 0
ret

Function at 0x140020254
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xa
jb 0x14002025b
mov byte [rcx + 0xe], 0
ret

Function at 0x14002047c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
mov ecx, 0x20
call fcn.1400237b0
mov rdx, qword [rsp + 0x60]
mov qword [rax], rdx
mov rdx, qword [rbx]
mov qword [rax + 8], rdx
mov rdx, qword [rdi]
mov qword [rax + 0x10], rdx
lea rcx, [0x14000d320]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x48], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140020664]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x140020506
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140020518
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov ecx, 0x20
call fcn.1400237b0
mov r10, qword [rsp + 0x60]
mov qword [rax], r10
mov r9, qword [rbx]
mov qword [rax + 8], r9
mov r8, qword [rdi]
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], rsi
mov qword [rsp + 0x40], rax
lea rbx, [r14 + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140020664]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r14], rax
test rax, rax
je 0x1400205a2
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
and dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400205b4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x10
call fcn.1400237b0
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rsp + 0x40], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400206dc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x14002061c
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140b8ac0c
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
sal word [rsp + 0x18], 0x6a
dec r11
jmp 0x140ba6df7
lea rsp, [rsp + 0x28]
jne 0x140b9ed36
mov eax, 0xf39ffda1
jmp 0x140bc11fa
Function at 0x140ba28f6
Capabilities:
Encode data using base64

Disassembly:
inc qword [rsp + r11*2]
mov qword [r11 + rdi], rbx
movsx ebx, al
not r8b
neg word [rsp + r11*4 + 2]
mov qword [rsp + r11*8], rbp
ret
not dl
mov qword [rsp + rcx - 0x71ba7ebd], r8
sub bl, 0xa7
movzx r10d, word [rsp + rdx - 0x71ba7e80]
rol r8d, cl
sal qword [rsp + rcx - 0x71ba7eb9], 0x23
ror bl, 1
inc r8b
setg r11b
not bl
lea rdx, [rcx + rax*8 + 0x3207fb28]
btc r8w, 0x3f
bt r11d, ecx
adc bl, r11b
xchg r10, rcx
xor r9b, bl
shr dl, cl
add r11b, cl
lea rbx, [rsp + rbx + 0x10]
mov edx, dword [rcx + rbx - 0xc6]
ja 0x140bb88e1
mov r11d, 0x670028a2
shr r11d, 2
movsx eax, r11b
mov r8d, dword [rsi + r11 - 0x19c00a28]
sar r11b, 0x63
idiv al
lea rsi, [rsi + r11 - 0x19c00a01]
xor r8d, r9d
div al
ror r8d, 1
lea r8d, [r8 + r11*4 + 0x7982bc18]
push rax
ror r8d, 2
xor r8d, 0x5ea83716
mov qword [rsp + r11*2 - 0x3380140a], r9
movzx ebx, r11b
xor dword [rsp + r11 - 0x19c00a05], r8d
lea r10, [rax + rbx*8 + 0x47b42f94]
cdq
lea r9, [rbx + rax*8 + 0x2d9c208e]
pop r9
xor r11, 0xffffffff94a702ac
movsxd r8, r8d
idiv r11d
sar al, 0xa4
or dl, dh
adc rbp, r8
neg dl
cdq
sub dl, 0x80
mov rbx, qword [rdi + rax*2]
imul rax, r11
movzx ecx, r10w
movzx r8d, cx
mov cl, byte [rdi + r11 + 0x7298f75f]
imul r8
ror r11b, 7
lea rdi, [r11 + rdi + 0x7298f7af]
sub rdx, 0x48035106
push rax
dec word [rsp + r11 + 0x7298f7b0]
sal rbx, cl
xor r11, r11
jns 0x140b9924f
mov r10d, 0x98b1ea19
movzx edx, r10w
shr dl, 0x22
mov rdx, qword [rdx + rdi - 0xea06]
lea rcx, [r10 + r10*8 + 0x6903632f]
mov eax, 0x821b041b
mov rbx, qword [rdi + riz + 8]

Function at 0x140ba4885
Capabilities:
Encode data using base64

Disassembly:
jmp 0x140bc4c2d
lea rsp, [rsp + 0x50]
jne 0x140b957b8
mov r9d, 0xa9b83697
neg r9
movzx ecx, r9w
pop r9

Function at 0x140ba4a52
Capabilities:
Encode data using base64

Disassembly:
inc word [rsp + 8]
add ecx, 0x1b295395
sal qword [rsp + 8], 0x35
jp 0x140bbbe43
call fcn.140bc650c
mov edx, 0x4433673b
movzx eax, dl
mov r10d, dword [rsi + rdx - 0x4433673b]
lea r11, [rax + rax*8 + 0x67bbf81f]
rol rax, 2
lea rsi, [rsi + rax*2 - 0x1d4]
movzx ecx, ax
xor r10d, r9d
xor r10d, 0xb999b2bb
dec r10d
ror cl, 0x85
bt edx, r11d
neg r10d
mul rax
sbb r10d, 0x9a99810e
push r9
rol ax, 0xa5
add ax, 0xaa2
xor dword [rsp + rdx*4], r10d
and rax, rax
movsx r8d, dl
movsx r9d, al
pop r9
add dx, ax
dec ax
movsx ebx, r11w
movsxd r10, r10d
adc rbp, r10
cqo
cdqe
mov ax, word [rdx + rdi]
add ecx, 0xb199f29a
sbb r11d, 0x5fa8f9a7
sal rbx, 0x4e
lea rdi, [rdx + rdi + 2]
mov r10d, r11d
and dx, r10w
or dx, word [rsi + rdx*4]
shr r11d, cl
or ebx, 0xf4141da2
xchg r8, rcx
lea rsi, [rsi + r11*4 - 0x10260112]
btr rcx, 0xac
xor dx, r9w
bts rcx, r11
call fcn.140bb2a97
add ecx, r8d
movsxd r10, r10d
rol dx, cl
adc rbp, r10
mov qword [rsp + rdx], rbp
ret 0x10
Function at 0x140ba4e86
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rax*2 - 0x135ec45e], rcx
lea rdi, [rdi + rbx - 0x29d]
not r8
bts rcx, 0x8a
and cl, 0x30
cbw
not rdx
or bx, word [rsp + rax*4 - 0x26bc00bc]
and r8, rdx
movsx edx, r11w
not word [rsp + rax*2 - 0x135e005b]
shl word [rsp + rax*4 - 0x26bc00ba], 0x41
mov qword [rdi + rax*8 - 0x4d780178], r8
movzx r10d, r11b
mov eax, dword [rsi + rax*2 - 0x135e005e]
pop r8
lea r11, [rbx*4 + 0x2fac33bf]
lea rsi, [r11 + rsi - 0x2fad83af]
sal r8, 0x7b
and cx, 0x2206
xor eax, r9d
rol ecx, 0x58
cmovae r10w, dx
bts ecx, 0xb
bswap eax
bt r11, rdx
sbb rcx, r11
add r11w, cx
not eax
neg eax
lea eax, [rax + rbx + 0x611e273e]
xchg r11d, ebx
push r9
xor dword [rsp + r11*2 - 0xa7fa], eax
call fcn.140bb5e86

Function at 0x140ba5db0
Capabilities:
Encode data using base64

Disassembly:
btc r10, rdx
mov qword [rsp + r11 + 0x18], r9
rol r8b, 0xa6
call fcn.140bb8bbf
Function at 0x140bae3e5
Capabilities:
Encode data using base64

Disassembly:
ror r11, 0xa5
lea rsi, [rsi + rdx - 0x46a8c014]
xchg cx, r10w
xor r8d, r9d
xchg dx, ax
sub r8d, 0xc600e332
inc r11
rol r11w, 0xa7
shr r11w, 0x86
not r8d
rol ecx, 0x11
not r11d
not r10b
lea r8d, [r8 + rax - 0x52f3e1f0]
rol ecx, cl
sal ax, cl
xchg cl, al
ror r8d, 1
not r10d
call fcn.140b9891c
lea rbx, [rax + 0x4b00f37]
movzx edx, ax
lea rdi, [r11 + rdi - 0x101b07fe]
ror al, 0x46
add al, r11b
and r8b, cl
not r8b
movzx r10d, bl
sub r11w, bx
movzx ecx, al
mov word [rdi + r11*2 - 0x20374182], r8w
mov r10d, dword [rsi + r11 - 0x101ba0c1]
lea rsi, [r11 + rsi - 0x101ba0bd]
jnp 0x140b95f47
lea rdx, [rsp + rdx + 8]
mov word [rdx + rax*2 - 0x2661be08], cx
cdq
rol dx, 0xc3
idiv r11b
add edx, dword [rsi + rax*4 - 0x4cc3e1c8]
dec bl
call fcn.140bbb5cf
mov r11d, 0xdd9b5808
movzx eax, r11w
movzx r8w, byte [rdi + rax - 0x5808]
and r11, 0x101f0885
mov cl, byte [rdi + r11*2 - 0x20360ffe]
ja 0x140b88ff8
mov edx, 0xfeac771b
movsx eax, dx
mov r11d, dword [rdi + rax*8 - 0x3b8d8]
lea r8, [rax*4 - 0x297ea4d4]
rol rdx, 0xf7
mov ebx, dword [rdi + rax*4 - 0x1dc68]
lea rdi, [rdi + rax - 0x7717]
or r8d, eax
lea rcx, [r8*2 - 0x3ae409f1]
adc r11d, ebx
lea rbx, [rcx*4 + 0x67275335]
mov dword [rdi + rax - 0x771b], r11d
movzx r10d, dx
mov edx, dword [rax + rsi - 0x771b]
cbw
jmp fcn.140bc55ad
xor cx, r9w
ror r10, 0x16
sbb cx, ax
neg bl
call fcn.140b92d8a
neg al
sal ecx, cl
adc rdi, 0x10
jmp 0x140bbf20e
mov r9, qword [rsp + rcx - 0x63220e4]
sbb bl, dh
movsxd r11, r11d
adc rbp, r11
mov r8, qword [rdi + rcx*8 - 0x31910760]
call fcn.140bbae69
mov ebx, 0xbe047604
mov r8d, dword [rsi + riz]
mov ecx, 0x77345e90
lea rsi, [rsi + rcx - 0x77345e8c]
lea r10, [rcx + rcx*2 - 0x947f1ec]
sar r10b, 0xc6
xor r8d, r9d
movsx edx, r10b
dec r10
movsx eax, cl
sub r8d, 0xcc2b5736
xor cl, r10b
movsx r11d, ax
xor r8d, edx
xor edx, 0xf7bd928d
jb 0x140ba2a42
rol r8d, 2
bt r11, 0xa0
xchg r10w, bx
dec r10d
neg r8d
push r9
mov r9d, eax
cqo
xor dword [rsp + rcx - 0x77345e6e], r8d
dec bx
add r9b, cl
xor rbx, 0xffffffffd0903537
pop r9
jo 0x140b98a63
bswap edx
ror eax, cl
movsxd r8, r8d
inc ax
add rbp, r8
inc r11w
lea r10, [rbx + rcx*8 + 0x3f3ee414]
mov r11w, word [rdi + rdx*2]
shl bl, 0xa1
not rax
lea rdi, [rdi + rdx*8 + 2]
sal r10d, 0xf0
neg dl
movzx ecx, word [rdx + rsi]
sal bx, 0xc5
mov r8d, edx
lea rsi, [rsi + rdx*2 + 2]
shr dx, 0x8e
add ebx, r10d
jb 0x140b9f96c
movzx r11d, r10w
or cl, cl
mov qword ss:[r11 + rdx - 0xea19], rbx
movsx r8d, al
mov edx, 0x46a8c018
mov r8d, dword [rsi + r11*2 - 0x1d432]
je 0x140b86f12

Function at 0x140bb4a51
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
mov qword [rsp], rdi
mov edi, 0xcdac9b38
push rdi
mov qword [rsp], rsi
jmp 0x140b93689
Function at 0x140bc21df
Capabilities:
Encode data using base64

Disassembly:
call fcn.140b95ef7
mov r8d, 0xa6055cb1
mov r8d, dword [rdi + riz]
mov eax, 0xa48f03a1
mov ebx, dword [rdi + riz + 4]
add rdi, 4
mov ecx, 0x992498a6
add r8d, ebx
movzx r10d, ax
shr r10w, cl
shl rax, 0x76
mov dword [rdi + r10*8 - 0x70], r8d
mov edx, dword [rsi + r10*8 - 0x70]
inc al
lea rsi, [rsi + r10 - 0xa]
lea r8, [rcx*8 - 0x48526ff9]
xor edx, r9d
lea r11, [rax + r8*4 - 0x17d1ef7d]
xadd r10, r11
adc edx, eax
btr r10, r11
sbb r10w, r10w
sar r11w, cl
not edx
movzx ebx, r10w
xor r10d, eax
btc rcx, 0x26
xor edx, 0xfc17a419
neg rcx
shl ax, 0x49
shr bx, 0x49
sbb edx, r11d
or r11b, bl
neg edx
bts rbx, 0x1f
inc eax
xadd r11, rcx
push r9
call fcn.140bbd35d

Function at 0x140bc24c7
Capabilities:
Encode data using base64

Disassembly:
mov dword [rsp + r10*8 - 0x680], edx
sal r11b, 0xa7
mov r9, qword [rsp + r10*8 - 0x678]
ror r11, 0xb6
movsxd rcx, ecx
jae 0x140bc29f9
xor ecx, 0x5e042c38
sal byte [rsp + rdx*2], 0x24
or word [rsp + rdx*4 + 5], r8w
shr r10, 0x1c
ror ecx, 1
neg qword [rsp + r10 - 0x73]
sal r10b, 0x22
mov qword [rsp + r10 - 0xc8], r9
xor dword [rsp + r10 - 0xc8], ecx
jmp 0x140ba4c25
lea r10, [r11*4 + 0x12952b0]
ror al, 1
dec byte [rsp + rcx*4 - 0x248]
lea rdx, [rbx + r11*2 + 0x16003337]
ror rcx, cl
not al
mov qword [rsp + r11], rdx
xchg word [rsp + r11 + 0x15], dx
lea r8, [rcx*4 + 0x1a33ab1f]
sbb al, dl
xor r9b, al
not r11w
rol rcx, 0x8b
lea rax, [rsp + rax + 0x18]
neg rdx
mov edx, dword [rax + r11 - 0xffff]
adc cx, word [rsp + r11 - 0xfffb]
lea rax, [r8 + r8*4 + 0x579d7f03]
lea rdi, [rdi + r11*2 - 0x20002]
mov dword [rdi + r11*4 - 0x3fffc], edx
pop rbx
movsx edx, r11b
pop rdx
pop rcx
jnp fcn.140b8ab70
mov r11d, 0x9c05a311
mov ebx, 0x45acdb3e
push r11
movzx eax, byte [rsi + rbx - 0x45acdb3e]
add byte [rsp + rbx - 0x45acdb39], 0xb7
mov r10d, 0xed0f0cae
lea rsi, [rsi + rbx - 0x45acdb3d]
rol rbx, 0x17
xor al, r9b
inc r10w
sub al, 4
lea r10, [r10*8 - 0x1961ddfb]
ror al, 1
ror bl, 0x65
dec al
shl r10w, 0x82
ror al, 1
shr bx, 0x23
jnp fcn.140bba10f
mov r8d, ebx
xor r9b, al
lea rax, [rsp + rax + 8]
inc qword [rsp]
lea rcx, [r11*2 + 0x793ce719]
mov rbx, qword [rax + riz]
cmovg r8, r11
sub rdi, 8
mov byte [rsp], r10b
mov qword [rdi + riz], rbx
mov edx, 0xf90bd83f
mov ecx, dword [rsi + riz]
add rsi, 4
xor ecx, r9d
add r8w, word [rsp]
je 0x140bbf5a8
sbb ecx, 0xf01eb48a
sal r11, 0x1e
movzx ebx, r8b
not ecx
sar rdx, 0x26
inc qword [rsp + rdx]
lea ecx, [rcx + rdx*4 + 0x20829f8d]
sub r8b, bl
inc edx
bt r10, r10
bswap ecx
push rdx
sub r10w, 0x8b8c
jg 0x140bb0ee6

Function at 0x140bc58d8
Capabilities:
Encode data using base64

Disassembly:
mov word ss:[r10 + r8*4 - 0x379c0], cx
adc edx, 0x24b4a6a6
add rax, rbp
jmp rax
not r10d
lea rcx, [rax + r8*4 + 0x32961b94]
idiv r8
neg r10d
btc cx, r11w
mul bx
mov qword [rsp + r8 - 0x692c7414], r9
xchg dx, bx
or al, al
xor dword [rsp + r8 - 0x692c7414], r10d
rol bx, cl
pop r9
movsxd r10, r10d
imul r11d, r8d
ror rcx, 0xac
adc rbp, r10
cqo
mov r10, qword [r8 + rdi - 0x692c7414]
cdqe
lea rbx, [rbx + 0x6297e904]
xor cx, word [rdi + rax*2 + 8]
bswap edx
imul r8, rax
sub r8w, r11w
lea rdi, [r8 + rdi - 0xde66]
or rdx, rax
jno 0x140ba6f8e
Function at 0x140bc66b9
Capabilities:
Encode data using base64

Disassembly:
add rax, rdx
mov qword [rsp], 0x5b1aedad
jmp 0x140bc686f
mov qword [rbp + riz - 8], rax
lea rsp, [rsp + 8]
mov qword [rbp + riz - 0x10], rsp
jmp 0x140bc459e

Function at 0x140bc6ab8
Capabilities:
Encode data using base64

Disassembly:
mov r10d, 0x69064b87
rol r10, 0x11
mov r11w, word [rdi + riz]
movzx ecx, r10w
sar r10b, 0x81
mov ebx, 0xaa31230a
lea rdi, [rdi + rcx*8 + 2]
or cx, word [rsi + rcx*8]
mov qword [rsp], 0x5233f832
lea rdx, [r10 + r10*2 + 0x15074b96]
and byte [rsp + 6], r10b
adc rsi, 2
push rdx
mov r8d, edx
xor cx, r9w
mov word [rsp + 0xb], r8w
xadd r8, r10
dec cx
shl byte [rsp + 0xc], 0x26
xchg r8w, dx
neg cx
push r8
lea rax, [r10 - 0x7c7b8ec2]
pop rax
rol cx, 1
xor dl, byte [rsp + 8]
xor cx, 0x733
xor r9w, cx
neg bx
mul edx
lea rcx, [rsp + rcx + 0x10]
btr edx, r8d
or r10w, word [rsp + rax - 0x4b675e15]
mov word [rdx + rcx - 0x6085b4f1], r11w
mov byte [rsp + rax - 0x4b675e0d], 0x90
imul edx
mov word [rsp + rdx - 0x1c6e253f], r10w
mov r10d, dword [rdx + rsi - 0x1c6e2548]
lea rsi, [rsi + rdx*2 - 0x38dc4a8c]
jb 0x140b97c0b

Function at 0x140bc6b7e
Capabilities:
Encode data using base64

Disassembly:
lea rsp, [rsp + 8]
jmp 0x140ba5dd0
Function at 0x34585154b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x3c]
cdqe
mov rdx, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x38], rax
mov dword [rbp - 4], 0
jmp 0x345851640
mov eax, dword [rbp - 4]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 0x40]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x34585163c
mov eax, dword [rbp - 4]
lea rdx, [rax + rax]
mov rax, qword [rbp - 0x38]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp - 0x28]
add rax, rdx
mov eax, dword [rax]
mov dword [rbp - 0x44], eax
mov eax, dword [rbp - 0x44]
mov rdx, qword [rbp + 0x10]
add rax, rdx
jmp 0x345851651
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x18]
cmp dword [rbp - 4], eax
jb 0x3458515d3
mov eax, 0
add rsp, 0x70
pop rbp
ret

Function at 0x34585c580
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x34585c5f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x34662a0b4]
test esi, esi
mov rbx, rcx
jle 0x34585c720
mov rax, qword [0x34662a0b8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x34585c63b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x34585c6c5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x34585c620
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov rdi, rax
je 0x34585c742
mov rax, qword [0x34662a0b8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call sym._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x34662a0b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x34585c727
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x34585c6be
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x34585c6d0
add dword [0x34662a0b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x34662a0b8]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x34585c6be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor esi, esi
jmp 0x34585c648
mov rax, qword [0x34662a0b8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]