joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180008670
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa8
mov rax, qword [0x180015008]
xor rax, rsp
mov qword [rbp - 1], rax
mov r12, qword [rbp + 0x7f]
xor r13d, r13d
mov r15, r9
mov dword [rbp - 0x41], 0x18
mov r14, r8
mov dword [rbp - 0x3d], 0xf0000000
mov rsi, rdx
mov qword [rbp - 0x39], r13
mov rdi, rcx
mov dword [rsp + 0x20], 0xf0000000
lea r9d, [r13 + 0x18]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x18000870d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x180008707
mov r9d, dword [rbp - 0x41]
lea rcx, [rbp - 0x39]
xor r8d, r8d
mov dword [rsp + 0x20], 8
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x18000870d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rbp - 0x39]
test rbx, rbx
jne 0x180008723
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180008836
mov eax, dword [rdi + 8]
lea rcx, [rbp - 0x25]
mov rdx, qword [rdi]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [rbp - 0x51], r13
mov r8d, eax
mov dword [rbp - 0x31], 0x208
movdqu xmmword [rbp - 0x25], xmm0
mov dword [rbp - 0x2d], 0x660e
movdqu xmmword [rbp - 0x15], xmm1
mov dword [rbp - 0x29], eax
call sub.msvcrt.dll_memcpy
xor r9d, r9d
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x31]
mov rcx, rbx
mov dword [rsp + 0x20], r13d
lea r8d, [r9 + 0x2c]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x18000878b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000881b
mov rcx, qword [rbp - 0x51]
mov ebx, r13d
mov dword [rbp - 0x45], 1
test rcx, rcx
je 0x1800087b1
xor r9d, r9d
lea r8, [rbp - 0x45]
lea edx, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 1
jne 0x18000881b
mov rcx, qword [rbp - 0x51]
mov ebx, r13d
test rcx, rcx
je 0x1800087db
mov r8, qword [rdi + 0x10]
xor r9d, r9d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 1
jne 0x18000881b
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x18000881b
lea rax, [rbp - 0x49]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
mov dword [rbp - 0x49], r15d
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [rbp - 0x49]
mov qword [r12], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x51]
mov ebx, eax
test rcx, rcx
je 0x180008836
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp - 0x51], r13
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180008847
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.18000f990
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180008870
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x90
mov rax, qword [0x180015008]
xor rax, rsp
mov qword [rbp + 0x1f], rax
xor r15d, r15d
mov dword [rbp - 0x21], 0x18
mov r14, r9
mov dword [rbp - 0x1d], 0xf0000000
mov rsi, rdx
mov qword [rbp - 0x19], r15
mov rdi, rcx
mov dword [rsp + 0x20], 0xf0000000
lea r9d, [r15 + 0x18]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180008905
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x1800088ff
mov r9d, dword [rbp - 0x21]
lea rcx, [rbp - 0x19]
xor r8d, r8d
mov dword [rsp + 0x20], 8
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180008905
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rbp - 0x19]
test rbx, rbx
jne 0x18000891b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x180008a22
mov eax, dword [rdi + 8]
lea rcx, [rbp - 5]
mov rdx, qword [rdi]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [rbp - 0x31], r15
mov r8d, eax
mov dword [rbp - 0x11], 0x208
movdqu xmmword [rbp - 5], xmm0
mov dword [rbp - 0xd], 0x660e
movdqu xmmword [rbp + 0xb], xmm1
mov dword [rbp - 9], eax
call sub.msvcrt.dll_memcpy
xor r9d, r9d
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x11]
mov rcx, rbx
mov dword [rsp + 0x20], r15d
lea r8d, [r9 + 0x2c]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x180008983
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180008a07
mov rcx, qword [rbp - 0x31]
mov ebx, r15d
mov dword [rbp - 0x29], 1
test rcx, rcx
je 0x1800089a9
xor r9d, r9d
lea r8, [rbp - 0x29]
lea edx, [r9 + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 1
jne 0x180008a07
mov rcx, qword [rbp - 0x31]
mov ebx, r15d
test rcx, rcx
je 0x1800089d3
mov r8, qword [rdi + 0x10]
xor r9d, r9d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 1
jne 0x180008a07
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x180008a07
lea rax, [rbp - 0x25]
mov dword [rbp - 0x25], r14d
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x31]
mov ebx, eax
test rcx, rcx
je 0x180008a22
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp - 0x31], r15
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180008a33
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, ebx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.18000f990
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180008aa0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov qword [rsp + 0x30], 1
mov edi, edx
mov qword [rsp + 0x38], rbx
mov rsi, rcx
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rsp + 0x38]
lea r9d, [rbx + 1]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180008b14
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x180008b0e
mov r9d, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x20], 8
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180008b14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180008b32
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x38]
test eax, eax
jne 0x180008b37
mov ebx, 0xffffffff
test rcx, rcx
je 0x180008b44
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18000baa0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000bafc
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18000bafc
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18000bafc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18000bafc
cmp dword [rcx + 0x84], 0xe
jbe 0x18000bafc
cmp dword [rcx + 0xf8], 0
je 0x18000bafc
mov ecx, ebx
call fcn.18000ba30
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x180017100]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.18000b8b0
cmp dword [rsp + 0x60], 0
jne 0x18000bb3f
mov ecx, ebx
call fcn.18000b9e0
int3
add rsp, 0x40
pop rbx
ret
Function at 0x18000bba0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x180015008]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18000bbdc
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.18000fc1c
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x18000bc98
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x18000bcfe
test ebx, ebx
jne 0x18000bcfe
lea ecx, [rax + 2]
call fcn.18000fc1c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.18000f990
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x18000f820
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp dword [rcx], 0xe06d7363
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
jne 0x18000f8dc
mov rax, qword [r9 + 0x38]
mov qword [rsp + 0x48], rbx
mov ebx, dword [rax]
add rbx, qword [r9 + 8]
mov eax, dword [rbx]
and eax, 0x1fffffff
sub eax, 0x19930521
cmp eax, 1
ja 0x18000f8d7
mov eax, 1
xchg dword [0x181777170], eax
cmp eax, 1
jne 0x18000f890
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
xchg dword [0x181777170], eax
cmp eax, 1
je 0x18000f875
mov edx, 4
lea r9, [rsp + 0x40]
mov rcx, rbx
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18000f8cf
and dword [rbx], 0xf9930520
lea r9, [rsp + 0x40]
or dword [rbx], 0x19930520
mov edx, 4
mov r8d, dword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
xchg dword [0x181777170], eax
mov rbx, qword [rsp + 0x48]
mov r9, rdi
mov r8, rbp
mov rdx, r14
mov rcx, rsi
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp qword [sym.imp.msvcrt.dll___CxxFrameHandler]
Function at 0x1400043d0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x14036e100]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.14012a420
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14036e100]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140004560
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x14000457c
cmp rcx, r8
jl 0x14000456f
mov qword [rdx + 0x80], rcx
test dword [0x140367280], 1
je 0x1400045ab
cmp byte [rsp + 0xd0], 0
je 0x1400045ab
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400040d0
mov rsp, r8
jmp rax
Function at 0x1400045b0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x14036e100]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + pe_nt_image_headers64]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400c29b0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
mov qword [rsp + 0x60], r9
mov r10, qword [rcx]
mov ecx, dword [rcx + 8]
mov r11, qword [rdx]
mov esi, ecx
and esi, 0xfffffffc
mov edi, dword [rdx + 8]
xor ebx, ebx
xor ebp, ebp
test ecx, ecx
je 0x1400c2bd5
lea r14, [0x140289ce8]
mov eax, esi
sar eax, 2
lea eax, [rax + rax*2]
cmp edi, eax
jl 0x1400c29f7
lea r15d, [rsi - 4]
jmp 0x1400c2a0e
mov edx, 0x55555556
mov eax, edx
imul edi
mov r15d, edx
shr r15d, 0x1f
add r15d, edx
shl r15d, 2
test r15d, r15d
jle 0x1400c2ab6
movsxd rax, ebx
lea rax, [r10 + rax*2]
movzx edx, word [rax]
movzx r12d, word [rax + 2]
movzx r13d, word [rax + 4]
movzx eax, word [rax + 6]
mov r9d, edx
or r9d, r12d
or r9d, r13d
or r9d, eax
test r9d, 0xffffff00
je 0x1400c2a4c
mov r9d, 0xffffffff
jmp 0x1400c2a83
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
movsxd r9, r12d
movsx r12, byte [r14 + r9]
movsxd r9, r13d
movsx r13, byte [r14 + r9]
cdqe
movsx rax, byte [r14 + rax]
shl edx, 0x12
shl r12d, 0xc
shl r13d, 6
or eax, edx
mov edx, eax
or r12d, r13d
or edx, r12d
mov r9d, edx
test r9d, r9d
jl 0x1400c2bf2
movsxd rax, ebp
add rax, r11
mov edx, r9d
sar edx, 0x10
mov byte [rax], dl
mov edx, r9d
sar edx, 8
mov byte [rax + 1], dl
mov byte [rax + 2], r9b
add ebp, 3
add ebx, 4
cmp ebx, r15d
jl 0x1400c2a17
lea eax, [rsi - 4]
cmp r15d, eax
jne 0x1400c2bf2
cmp ebx, esi
je 0x1400c2bf2
lea eax, [rsi - 4]
cdqe
movzx eax, word [r10 + rax*2]
lea edx, [rsi - 3]
movsxd rdx, edx
movzx edx, word [r10 + rdx*2]
lea r9d, [rsi - 2]
movsxd r9, r9d
movzx r9d, word [r10 + r9*2]
lea r15d, [rsi - 1]
movsxd r15, r15d
movzx r10d, word [r10 + r15*2]
mov r15d, eax
or r15d, edx
or r15d, r9d
or r15d, r10d
test r15d, 0xffffff00
jne 0x1400c2bf2
cdqe
movsx rax, byte [r14 + rax]
movsxd rdx, edx
movsx rdx, byte [r14 + rdx]
shl eax, 0x12
shl edx, 0xc
or eax, edx
cmp r10d, 0x3d
je 0x1400c2b7b
movsxd r9, r9d
movsx r9, byte [r14 + r9]
movsxd r10, r10d
movsx r10, byte [r14 + r10]
shl r9d, 6
or r10d, eax
mov eax, r10d
or eax, r9d
jl 0x1400c2bf2
add edi, 0xfffffffd
cmp ebp, edi
jg 0x1400c2bf2
movsxd r9, ebp
add r11, r9
mov edx, eax
sar edx, 0x10
mov byte [r11], dl
mov edx, eax
sar edx, 8
mov byte [r11 + 1], dl
mov byte [r11 + 2], al
add ebp, 3
jmp 0x1400c2bce
cmp r9d, 0x3d
je 0x1400c2bb7
movsxd r9, r9d
movsx r9, byte [r14 + r9]
shl r9d, 6
or eax, r9d
jl 0x1400c2bf2
lea edx, [rdi - 2]
cmp ebp, edx
jg 0x1400c2bf2
mov edx, eax
sar edx, 0x10
movsxd r9, ebp
mov byte [r11 + r9], dl
sar eax, 8
lea edx, [rbp + 1]
movsxd rdx, edx
mov byte [r11 + rdx], al
add ebp, 2
jmp 0x1400c2bce
test eax, eax
jl 0x1400c2bf2
lea edx, [rdi - 1]
cmp ebp, edx
jg 0x1400c2bf2
sar eax, 0x10
movsxd rdx, ebp
mov byte [r11 + rdx], al
inc ebp
add ebx, 4
cmp esi, ecx
jne 0x1400c2bf2
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
mov eax, 1
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [r8], ebx
mov r9, qword [rsp + 0x60]
mov dword [r9], ebp
xor eax, eax
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400ecfa0
Capabilities:
Hash data using sha1

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp qword [rsi], 0
jne 0x1400ecfca
lea rcx, [0x1402d7790]
mov edx, 0x55
call fcn.140003d80
mov rdx, rax
mov rcx, rsi
call fcn.140003fa0
xor eax, eax
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], eax
mov rax, qword [rsi]
cmp dword [rax + 8], 0x50
jbe 0x1400ed038
mov dword [rax + 0x150], 0x67452301
mov rax, qword [rsi]
cmp dword [rax + 8], 0x51
jbe 0x1400ed038
mov dword [rax + 0x154], 0xefcdab89
mov rax, qword [rsi]
cmp dword [rax + 8], 0x52
jbe 0x1400ed038
mov dword [rax + 0x158], 0x98badcfe
mov rax, qword [rsi]
cmp dword [rax + 8], 0x53
jbe 0x1400ed038
mov dword [rax + 0x15c], 0x10325476
mov rax, qword [rsi]
cmp dword [rax + 8], 0x54
jbe 0x1400ed038
mov dword [rax + 0x160], 0xc3d2e1f0
add rsp, 0x20
pop rsi
ret
call fcn.140152380
int3