joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400167c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x14059f320]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14059f300]
test rbx, rbx
je 0x140016814
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14001680b
test rsi, rsi
je 0x14001680b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400167f0
lea rcx, [0x14059f320]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140016b70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140597190]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140016bdf
mov rcx, r9
call fcn.140016a40
test eax, eax
je 0x140016bdf
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x140016bdd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140016bd4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140016bdf
add rdx, 0x28
cmp rdx, r9
jne 0x140016bc0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0x140021220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1405929e0]
jmp 0x1400179a0

Function at 0x140021230
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1405929e0]
jmp 0x1400179a0
Function at 0x140056e30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x60], 0
je 0x140056e4e
cmp qword [rsp + 0x68], 0
jne 0x140056e55
xor eax, eax
jmp 0x140056f81
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp], 0
jmp 0x140056ef6
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x140056f7f
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140056f3e
inc rax
test dl, dl
jne 0x140056f2b
xor eax, eax
jmp 0x140056f43
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140056f7a
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x38]
movzx eax, word [rcx + rax*2]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
jmp 0x140056f81
jmp 0x140056eee
xor eax, eax
add rsp, 0x58
ret
Function at 0x140001420
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov r8d, pe_nt_image_headers64
lea rdx, [0x1400856a0]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
cmp eax, 0x100
jb 0x140001483
lea ecx, [rax + 1]
mov qword [rsp + 0x30], rdi
add rcx, rcx
call fcn.14002e61c
mov rdi, rax
test rax, rax
je 0x1400014a6
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, rdi
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
test ebx, ebx
jne 0x140001494
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
lea rax, [0x1400856a0]
add rsp, 0x20
pop rsi
ret
lea rdx, str.Could_not_allocate_environment_buffer
mov ecx, 0x68
call fcn.140001360
int3
Function at 0x140002080
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
lea r14, str.pythonX
mov edx, 0x400
lea r9, str.py__ls
mov qword [rsp + 0x20], r14
mov r8, 0xffffffffffffffff
lea rcx, [0x140085ab0]
lea rsi, str.environment
call fcn.140001210
lea rbx, [0x1400856a0]
mov r8d, pe_nt_image_headers64
mov rdx, rbx
lea rcx, [0x140085ab0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp eax, 0x100
jb 0x140002145
lea ecx, [rax + 1]
add rcx, rcx
call fcn.14002e61c
mov rbx, rax
test rax, rax
je 0x1400021de
mov r8d, edi
lea rcx, [0x140085ab0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r9, rsi
lea rcx, str.found_configured_value__ls_ls_in__ls_n
mov r8, rbx
mov rdx, r14
call fcn.1400012c0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
test edi, edi
jne 0x140002117
xor ebx, ebx
cmp word [0x1400858a0], bx
je 0x14000218f
lea rsi, [0x1400858a0]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
lea r9, [0x140085ab0]
mov rdx, r14
mov dword [rsp + 0x20], 0x400
lea rcx, str.defaults
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14000218f
lea rbx, [0x140085ab0]
jmp 0x140002117
cmp word [0x14006b680], bx
je 0x1400021ca
lea rsi, [0x14006b680]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
lea r9, [0x140085ab0]
mov rdx, r14
mov dword [rsp + 0x20], 0x400
lea rcx, str.defaults
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x140002186
mov rdx, r14
lea rcx, str.found_no_configured_value_for__ls_n
call fcn.1400012c0
jmp 0x14000212c
lea rdx, str.Could_not_allocate_environment_buffer
mov ecx, 0x68
call fcn.140001360
int3
Function at 0x140013aac
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14001389b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001389b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001389b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001389b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001389b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001389b
cmp dword [rcx + 0xf8], 0
je 0x14001389b
mov ecx, ebx
call fcn.1400139cc
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14001360c
cmp dword [rbp + 0x20], 0
je 0x1400138e8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400138f0
int3
xor r8d, r8d
xor edx, edx
jmp 0x140013834
Function at 0x1403ee058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1403ee1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1403ee089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1403ee06f
add dl, dl
jne 0x1403ee096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1403ee0f6
xor eax, eax
add dl, dl
jne 0x1403ee0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1403ee1ad
add dl, dl
jne 0x1403ee0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1403ee0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1403ee0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1403ee0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1403ee0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1403ee07e
mov eax, 1
add dl, dl
jne 0x1403ee106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1403ee113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1403ee0fb
sub eax, ebx
mov ebx, 1
jne 0x1403ee14c
mov ecx, 1
add dl, dl
jne 0x1403ee12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1403ee13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1403ee123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1403ee07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1403ee168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1403ee175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1403ee15d
cmp eax, 0x7d00
jae 0x1403ee19b
cmp eax, 0x500
jb 0x1403ee196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1403ee07e
cmp eax, 0x7f
ja 0x1403ee19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1403ee07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1403ee1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1403ee07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000ffa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r11, qword [rdx + 8]
mov r10, qword [rdx + 0x10]
lea rcx, [r10 + 1]
mov qword [rdx + 0x10], rcx
mov al, 1
cmp rcx, r11
jae 0x14000ffe1
mov rax, qword [rdx]
movzx edi, byte [rax + rcx]
mov al, 1
cmp edi, 0x2b
je 0x14000ffd6
cmp edi, 0x2d
jne 0x14000ffe1
xor eax, eax
add r10, 2
mov qword [rdx + 0x10], r10
mov rcx, r10
cmp rcx, r11
jae 0x14001017a
mov rdi, qword [rdx]
movzx r10d, byte [rdi + rcx]
lea rbx, [rcx + 1]
mov qword [rdx + 0x10], rbx
add r10b, 0xd0
cmp r10b, 0xa
jae 0x140010185
movzx r10d, r10b
cmp rbx, r11
jae 0x140010080
mov ebx, 1
sub rbx, r11
add rcx, 2
jmp 0x14001003c
movzx r11d, r11b
lea r10d, [r10 + r10*4]
lea r10d, [r11 + r10*2]
lea r11, [rbx + rcx]
inc r11
inc rcx
cmp r11, 2
je 0x140010080
movzx r11d, byte [rdi + rcx - 1]
add r11b, 0xd0
cmp r11b, 0xa
jae 0x140010080
mov qword [rdx + 0x10], rcx
cmp r10d, 0xccccccb
jle 0x140010020
cmp r10d, 0xccccccc
jne 0x140010068
cmp r11b, 7
jbe 0x140010020
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
mov rcx, rsi
call fcn.1401dab10
jmp 0x140010167
mov ecx, dword [rsp + 0x80]
test al, al
je 0x14001009c
lea eax, [rcx + r10]
sar eax, 0x1f
add eax, 0x80000000
add ecx, r10d
jmp 0x1400100ac
xor eax, eax
cmp ecx, r10d
setns al
add eax, 0x7fffffff
sub ecx, r10d
cmovo ecx, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x1401e5540]
subpd xmm1, xmmword [0x1401e5550]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x135
jb 0x140010118
xorpd xmm1, xmm1
movsd xmm2, qword [0x1401e5560]
nop word [rax + rax]
ucomisd xmm0, xmm1
jne 0x1400100f8
jnp 0x140010150
test ecx, ecx
jns 0x1400101ab
divsd xmm0, xmm2
add ecx, 0x134
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x134
ja 0x1400100f0
mov eax, eax
mov r9, qword [str._u_]
movsd xmm1, qword [r9 + rax*8]
test ecx, ecx
js 0x14001016f
mulsd xmm0, xmm1
movq rax, xmm0
movabs rcx, 0x7fffffffffffffff
and rcx, rax
movabs rax, 0x7ff0000000000000
cmp rcx, rax
je 0x1400101ab
test r8b, r8b
jne 0x14001015d
xorpd xmm0, xmmword [0x1401e5570]
movsd qword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x140010155
jmp 0x14001015d
mov qword [rsp + 0x28], 5
jmp 0x14001018e
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1401dabb0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140010167
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.1401dabb0
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140010164
Function at 0x140012e70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140012eb2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x140012eba
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140012ecb
jmp 0x140012ee2
xor r10d, r10d
jmp 0x140012f6d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140012ee2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140012ef9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140012f19
add r11, r8
jmp 0x14001304a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140012fe2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140012f90
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140013000
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140013012
jmp 0x14001302c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14001302c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140013046
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140059c70
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, rdx
mov r12, rcx
mov r14, qword [rcx]
mov rsi, qword [rcx + 0x10]
mov edi, 4
test rsi, rsi
mov qword [rbp - 0x10], rcx
je 0x140059ce2
mov rax, rsi
shr rax, 0x3d
jne 0x140059e21
lea r15, [rsi*4]
test r15, r15
je 0x140059ce2
movzx eax, byte [0x1402ef241]
mov edx, 4
mov rcx, r15
call fcn.140016e80
test rax, rax
je 0x140059e28
mov rdi, rax
jmp 0x140059ce5
xor r15d, r15d
mov rcx, rdi
mov rdx, r14
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
mov r8, qword [rbx + 0x30]
movzx ecx, byte [rbx + 0x158]
shr r8, cl
test r8, r8
je 0x140059d81
xor eax, eax
jmp 0x140059d28
inc rax
cmp rax, r8
je 0x140059d81
mov rcx, qword [r12 + 0x18]
and ecx, 0x3f
mov r9, rax
shl r9, cl
cmp rax, rsi
je 0x140059dfc
mov edx, dword [rdi + rax*4]
cmp edx, r9d
je 0x140059d20
nop word [rax + rax]
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, rsi
jae 0x140059de8
mov edx, dword [rdi + rdx*4]
cmp edx, r9d
jne 0x140059d50
mov rdx, qword [r12 + 0x10]
cmp rax, rdx
jae 0x140059e10
mov rcx, qword [r12]
mov dword [rcx + rax*4], r10d
jmp 0x140059d20
lea r8, [r12 + 0x18]
mov rcx, rbx
mov rdx, r12
call fcn.14001cdd0
test rsi, rsi
je 0x140059dab
shl rsi, 2
mov r8d, 4
mov rcx, rdi
mov rdx, rsi
call fcn.140016e90
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140059dd8
mov rcx, qword [rax]
shl rdx, 2
mov r8d, 4
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.140016e90
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.C:Users_admin.JUPITERSERVERS.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfa_remapper.rs
mov rcx, rdx
mov rdx, rsi
call fcn.1401e1c80
jmp 0x140059e35
lea r8, str.C:Users_admin.JUPITERSERVERS.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfa_remapper.rs
mov rcx, rsi
mov rdx, rsi
call fcn.1401e1c80
jmp 0x140059e35
lea r8, str.C:Users_admin.JUPITERSERVERS.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcdfa_remapper.rs
mov rcx, rax
call fcn.1401e1c80
jmp 0x140059e35
call fcn.1401c2890
jmp 0x140059e35
mov ecx, 4
mov rdx, r15
call fcn.1401e1980
ud2
Function at 0x140085200
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rbx, rdx
mov r12, rcx
mov r14, qword [rcx]
mov rsi, qword [rcx + 0x10]
mov edi, 4
test rsi, rsi
mov qword [rbp - 0x10], rcx
je 0x140085272
mov rax, rsi
shr rax, 0x3d
jne 0x1400853a1
lea r15, [rsi*4]
test r15, r15
je 0x140085272
movzx eax, byte [0x1402ef241]
mov edx, 4
mov rcx, r15
call fcn.140016e80
test rax, rax
je 0x1400853a8
mov rdi, rax
jmp 0x140085275
xor r15d, r15d
mov rcx, rdi
mov rdx, r14
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x140085301
xor eax, eax
jmp 0x1400852a8
inc rax
cmp rax, r8
je 0x140085301
mov rcx, qword [r12 + 0x18]
and ecx, 0x3f
mov r9, rax
shl r9, cl
cmp rax, rsi
je 0x14008537c
mov edx, dword [rdi + rax*4]
cmp edx, r9d
je 0x1400852a0
nop word [rax + rax]
mov r10d, edx
mov edx, edx
shr rdx, cl
cmp rdx, rsi
jae 0x140085368
mov edx, dword [rdi + rdx*4]
cmp edx, r9d
jne 0x1400852d0
mov rdx, qword [r12 + 0x10]
cmp rax, rdx
jae 0x140085390
mov rcx, qword [r12]
mov dword [rcx + rax*4], r10d
jmp 0x1400852a0
lea r8, [r12 + 0x18]
mov rcx, rbx
mov rdx, r12
call fcn.140090c90
test rsi, rsi
je 0x14008532b
shl rsi, 2
mov r8d, 4
mov rcx, rdi
mov rdx, rsi
call fcn.140016e90
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140085358
mov rcx, qword [rax]
shl rdx, 2
mov r8d, 4
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.140016e90
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, [0x1401f20c8]
mov rcx, rdx
mov rdx, rsi
call fcn.1401e1c80
jmp 0x1400853b5
lea r8, [0x1401f20b0]
mov rcx, rsi
mov rdx, rsi
call fcn.1401e1c80
jmp 0x1400853b5
lea r8, [0x1401f20e0]
mov rcx, rax
call fcn.1401e1c80
jmp 0x1400853b5
call fcn.1401c2890
jmp 0x1400853b5
mov ecx, 4
mov rdx, r15
call fcn.1401e1980
ud2
Function at 0x1400d5ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400c4cf0
cmp eax, 0x5c
jne 0x1400d5ef0
mov rcx, rsi
mov rdx, rdi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
jmp fcn.1400d1f20
mov r14, qword [rdi]
mov rbx, qword [r14 + 0xa0]
mov rcx, rdi
call fcn.1400c4cf0
mov ecx, 1
cmp eax, 0x80
jb 0x1400d5f28
mov ecx, 2
cmp eax, 0x800
jb 0x1400d5f28
cmp eax, 0x10000
mov ecx, 4
sbb rcx, 0
add rbx, rcx
jb 0x1400d5ff2
mov r15, qword [r14 + 0xb0]
inc r15
je 0x1400d600c
mov r12, qword [r14 + 0xa8]
add r14, 0xa0
mov rcx, rdi
call fcn.1400c4cf0
xor ecx, ecx
cmp eax, 0xa
sete cl
mov eax, 1
cmove r15, rax
add rcx, r12
movups xmm0, xmmword [r14]
movaps xmmword [rbp - 0x60], xmm0
mov rax, qword [r14 + 0x10]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], r15
mov rcx, rdi
call fcn.1400c4cf0
mov dword [rbp - 0x30], eax
mov byte [rbp - 0x2c], 0
mov byte [rbp + 8], 2
mov rcx, rdi
call fcn.1400c4e20
movaps xmm0, xmmword [rbp]
movups xmmword [rsi + 0x68], xmm0
movaps xmm0, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x58], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi + 0x48], xmm0
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
movaps xmm2, xmmword [rbp - 0x40]
movaps xmm3, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x38], xmm3
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov dword [rsi], 0x22
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1401fa2d0]
lea r8, [0x1401fa3d0]
mov edx, 0x2b
call fcn.1401e1be0
ud2
lea rcx, [0x1401fa2d0]
lea r8, [0x1401fa3e8]
mov edx, 0x2b
call fcn.1401e1be0
ud2
Function at 0x1400e4090
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1402ef241]
mov ecx, 0x1818
mov edx, 4
call fcn.140016e80
test rax, rax
je 0x1400e41ae
xor ecx, ecx
lea rdx, [0x1402103a0]
movdqa xmm0, xmmword [0x1401f0f40]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x1810
jne 0x1400e40e0
movabs rcx, 0xe01ef000e0100
mov qword [rax + 0x1810], rcx
mov rcx, rax
add rcx, 0x1818
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x303
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400eadf0
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400f2360
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x1818
call fcn.1401e1980
ud2

Function at 0x1400e42e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1402ef241]
mov ecx, 0x200
mov edx, 4
call fcn.140016e80
test rax, rax
je 0x1400e43ed
xor ecx, ecx
lea rdx, [0x140211c08]
movdqa xmm0, xmmword [0x1401f0f40]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x200
jne 0x1400e4330
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x40
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400eadf0
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400f2360
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x200
call fcn.1401e1980
ud2