joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002814
Capabilities:
Delete file
Get file size
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x190
mov rax, qword [0x180006008]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rsi, r9
lea r8, [0x180004580]
mov r9, rdx
mov rbp, rcx
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.180003028
mov ecx, dword [0x180006020]
cmp ecx, 0xffffffff
je 0x180002a3f
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x180002a3f
mov ecx, dword [0x180006020]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
cmp qword [rax + 8], 0
je 0x180002a3f
mov ecx, dword [0x180006020]
mov qword [rsp + 0x1c0], rdi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov ebx, 1
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov dword [rax], ebx
call fcn.180002e60
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800028ef
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rsi + 0x40], eax
cmp eax, 0xffffffff
jne 0x180002918
mov ecx, edi
call qword [sym.imp.KERNEL32.dll__lclose]
nop dword [rax + rax]
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180001650
add rsp, 0x190
pop rsi
pop rbp
pop rbx
ret
mov ecx, dword [0x180006020]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rsi
mov rsi, qword [0x180006688]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x58], 0
cmp ecx, 0xffffffff
je 0x180002974
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x180002974
mov ecx, dword [0x180006020]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov rcx, qword [rax + 8]
jmp 0x180002976
xor ecx, ecx
movabs r10, 0x93941f025c560970
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, [0x180004584]
lea rax, [0x180002630]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rax, rsi
call qword [0x180004488]
test eax, eax
jne 0x180002a2a
mov ecx, dword [0x180006020]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov ecx, dword [rax + 0x10]
add ecx, 0xfffffffd
cmp ecx, 8
ja case.0x1800029ea.7
movsxd rax, ecx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x2a4c]
add rcx, rdx
jmp rcx
mov ebx, 0xfffffffd
jmp 0x180002a19
mov ebx, 0xfffffffb
jmp 0x180002a19
mov ecx, dword [0x180006020]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov ebx, dword [rax]
jmp 0x180002a19
mov ebx, 0xfffffff9
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileA]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll__lclose]
nop dword [rax + rax]
mov eax, ebx
jmp 0x1800028f4
mov eax, 0xfffffff9
jmp 0x1800028fc
Function at 0x180002cfc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180006008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, dword [0x180006020]
cmp ecx, 0xffffffff
je 0x180002ddb
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x180002ddb
mov ecx, dword [0x180006020]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
cmp qword [rax + 8], 0
je 0x180002ddb
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.180002e60
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180002ddb
mov ecx, dword [0x180006020]
mov rbx, qword [0x1800066a0]
cmp ecx, 0xffffffff
je 0x180002daa
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
test rax, rax
je 0x180002daa
mov ecx, dword [0x180006020]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov rcx, qword [rax + 8]
jmp 0x180002dac
xor ecx, ecx
movabs r10, 0xcb7c170a5cd08370
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rax, rbx
call qword [0x180004488]
mov ecx, edi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll__lclose]
nop dword [rax + rax]
mov eax, ebx
jmp 0x180002ddd
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001650
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180002e60
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
test dl, 1
je 0x180002e70
mov edx, 0x21
jmp 0x180002e79
movzx edx, dl
and edx, 2
or edx, 0x20
call qword [sym.imp.KERNEL32.dll__lopen]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x180002eab
mov ecx, dword [0x180006020]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov dword [rax], 0xffffffff
mov rax, 0xffffffffffffffff
jmp 0x180002ead
cdqe
add rsp, 0x28
ret
Function at 0x180003260
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov edi, 0x800
mov edx, edi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1800032f2
movzx r8d, di
mov r9, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_version_l1_1_1.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
je 0x1800032e3
movzx eax, word [rbx]
cmp di, ax
jae 0x1800032de
mov rcx, rbx
mov edi, eax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x18000328f
jmp 0x1800032f2
mov rax, rbx
jmp 0x1800032f4
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001a08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a52
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a54
xor al, al
add rsp, 0x28
ret

Function at 0x1400050c8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005137
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005137
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005137
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005137
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005137
cmp dword [rcx + 0x84], 0xe
jbe 0x140005137
cmp dword [rcx + 0xf8], 0
je 0x140005137
mov ecx, ebx
call fcn.1400051e8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140004fc4
nop
cmp dword [rbp + 0x20], 0
je 0x140005185
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005190
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400050c8

Function at 0x1400052cc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400050c8
Function at 0x14000838c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400083bc
xor eax, eax
jmp 0x14000847f
mov rbp, rbx
cmp word [rax], si
je 0x1400083e1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400083c8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400083c4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400082ac
movsxd r14, eax
test eax, eax
jne 0x14000841f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400083b5
mov rcx, r14
call fcn.140009268
mov rdi, rax
test rax, rax
jne 0x140008438
xor ecx, ecx
call fcn.14000690c
jmp 0x140008414
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400082ac
test eax, eax
jne 0x140008469
mov rcx, rdi
call fcn.14000690c
jmp 0x140008473
xor ecx, ecx
call fcn.14000690c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000b970
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000737c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000b9fa
cmp byte [rbp - 0x21], r15b
je 0x14000b9f5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000ba30
call fcn.140009a78
test eax, eax
jne 0x14000ba1c
cmp byte [rbp - 0x21], r15b
je 0x14000ba14
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000ba30
cmp byte [rbp - 0x21], r15b
je 0x14000ba2d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000695c
test eax, eax
jne 0x14000bad0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000737c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000ba6f
cmp byte [rbp - 0x21], r15b
je 0x14000baa4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000baa4
call fcn.140009a78
test eax, eax
jne 0x14000ba90
cmp byte [rbp - 0x21], r15b
je 0x14000ba89
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000baa4
cmp byte [rbp - 0x21], r15b
je 0x14000baa1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000695c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000bad0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000bad3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000bae1
mov rcx, rdi
call fcn.14000690c
cmp byte [rbp + 0x3f], r15b
je 0x14000baf0
mov rcx, qword [rbp + 0x27]
call fcn.14000690c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000e920
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000e948
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000e948
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001df8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e42
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e44
xor al, al
add rsp, 0x28
ret
Function at 0x140026780
Capabilities:
Check mutex on windows

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov byte [rcx], 0
mov qword [rcx + 8], 0
lea r8, str.A946A6A9_917E_4949_B9BC_6BADA8C7FD63
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400267c0
mov rcx, rax
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [rsi]
mov rax, rsi
add rsp, 0x20
pop rsi
ret

Function at 0x140027b70
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp rdx, 1
je 0x140027bb2
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
je 0x140027b97
mov rcx, rdi
call fcn.1400e2460
mov rdi, rax
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x140027bb9
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x140143fd0
mov edi, 2
jmp 0x140027b97
jb 0x140027bc3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x140027bd3
cvtsi2ss xmm0, rax
jmp 0x140027be8
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x20]
call fcn.14013fae0
cvttss2si rcx, xmm0
movss xmm1, dword [0x1401eaa64]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rbx, 3
jb 0x140027c9a
mov rcx, rbx
shr rcx, 1
movabs r8, 0x5555555555555555
and r8, rcx
mov rdx, rbx
sub rdx, r8
movabs r8, 0x3333333333333333
mov rcx, rdx
shr rcx, 2
and rdx, r8
and rcx, r8
add rcx, rdx
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x140027c9a
cmp rax, 2
jb 0x140027ca2
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x140027ca2
mov rcx, rax
call fcn.1400e2460
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
jae 0x140027bbb
jmp 0x140027ba0
Function at 0x140027fe0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x14002801a
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r15
jbe 0x140028076
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x140028065
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.140113df0
mov r14, qword [rsi + 8]
add rbx, r15
mov qword [rsi + 0x10], rbx
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x140027fff
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x14002810c
mov r12, r13
shr r12, 2
lea rcx, [r13*8]
call fcn.1401109bc
lea r9, [rax + r12*8]
lea r8, [rax + r13*8]
mov r10, r9
sub rbx, r14
je 0x1400280e0
lea r10, [r9 + rbx]
sar rbx, 3
shl rbx, 3
lea r11, [rax + r12*8]
xor edx, edx
mov rcx, qword [r14 + rdx]
mov qword [r11 + rdx], rcx
add rdx, 8
cmp rbx, rdx
jne 0x1400280cf
mov qword [rsi], rax
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
mov rbx, r10
test r15, r15
je 0x140027fff
mov rcx, r15
call fcn.1401109f8
mov rbx, qword [rsi + 0x10]
jmp 0x140027fff
call fcn.140124830
int3

Function at 0x140028120
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14002815d
mov rdi, rbx
mov rax, qword [r14]
mov qword [rdi - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r15, rax
jae 0x1400281af
sub rax, r15
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r12, [rax + rcx]
inc r12
sar r12, 1
lea rdi, [r15 + r12*8]
mov r8, r15
sub r8, rbx
je 0x1400281a1
sub rdi, r8
mov rcx, rdi
mov rdx, rbx
call fcn.140113df0
mov r15, qword [rsi + 0x10]
mov qword [rsi + 8], rdi
lea rax, [r15 + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x140028141
sub rax, rbx
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x140028240
lea r12, [r13 + 3]
shr r12, 2
lea rcx, [r13*8]
call fcn.1401109bc
lea rdi, [rax + r12*8]
lea r8, [rax + r13*8]
mov r9, rdi
sub r15, rbx
je 0x140028217
lea r9, [rdi + r15]
sar r15, 3
shl r15, 3
lea r10, [rax + r12*8]
xor edx, edx
mov rcx, qword [rbx + rdx]
mov qword [r10 + rdx], rcx
add rdx, 8
cmp r15, rdx
jne 0x140028206
mov qword [rsi], rax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r9
mov qword [rsi + 0x18], r8
test rbx, rbx
je 0x140028141
mov rcx, rbx
call fcn.1401109f8
mov rdi, qword [rsi + 8]
jmp 0x140028141
call fcn.140124830
int3
Function at 0x140028da0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov edi, ecx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r8d, 0x20
call fcn.140123bcc
mov ebx, 6
cmp eax, 0x20
jne 0x140028e76
mov ecx, dword [rsi + 8]
mov rbx, qword [sym.imp.WS2_32.dll_ntohl]
call rbx
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rbx
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rbx
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rbx
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rbx
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rbx
mov dword [rsi + 0x1c], eax
movaps xmm0, xmmword [0x1401e90c0]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
mov ecx, edi
call fcn.140121f48
mov ebx, 6
test eax, eax
jne 0x140028e76
movabs rax, 0x303146464944424d
mov ebx, 8
cmp qword [rsi], rax
jne 0x140028e76
movsxd rax, dword [rsp + 0x34]
cmp rax, 0x20
jb 0x140028e76
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x140028e76
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x140028e76
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x140028e76
setne al
movzx ebx, al
shl ebx, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140111870
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140028e90
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov r12, r8
mov ebx, edx
mov rdi, rcx
mov r13d, dword [rcx + 8]
mov ebp, dword [rcx + 0x18]
add ebp, dword [rcx + 0x14]
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.1400f0650
test rax, rax
je 0x140028ef4
mov r14, rax
add r13, r12
mov rsi, rax
test ebp, ebp
je 0x140028efb
mov ecx, ebx
mov rdx, rsi
mov r8d, ebp
call fcn.140123bcc
test eax, eax
js 0x140028f16
sub ebp, eax
mov ecx, eax
add rsi, rcx
test eax, eax
jne 0x140028ece
test ebp, ebp
je 0x140028ece
jmp 0x140028f0f
mov ebx, 1
jmp 0x140028f23
mov eax, dword [rdi + 0x14]
imul ecx, eax, 0xaaaaaaab
ror ecx, 2
cmp ecx, 0x15555555
jbe 0x140028f36
mov ebx, 8
jmp 0x140028f1b
mov ebx, 6
mov rcx, r14
call fcn.1400f06b0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
je 0x140029075
mov dword [rsp + 0x24], r15d
mov rbp, r14
add rbp, rax
mov eax, dword [rdi + 0x18]
mov ecx, dword [rdi + 0x1c]
add rax, rbp
add rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov rdi, rax
mov qword [rsp + 0x28], rbp
mov r15, r12
mov r12, r14
mov qword [rsp + 0x30], r15
mov ecx, dword [r12]
mov rsi, qword [sym.imp.WS2_32.dll_ntohl]
call rsi
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r13
sub rcx, r15
cmp rcx, rax
jb 0x140028f0f
mov rcx, qword [rsp + 0x40]
sub rcx, rbp
cmp rcx, rax
jb 0x140028f0f
test rax, rax
je 0x140028fdd
xor eax, eax
mov cl, byte [r15 + rax]
add byte [rbp + rax], cl
inc rax
mov r8d, dword [r12]
cmp rax, r8
jb 0x140028fc7
jmp 0x140028fe0
xor r8d, r8d
mov ecx, dword [rsp + 0x24]
mov rdx, rbp
call fcn.140127b58
mov ebx, 7
cmp eax, dword [r12]
jne 0x140028f1b
mov esi, eax
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rdi
cmp rax, r8
jb 0x140028f0f
mov ecx, dword [rsp + 0x24]
mov rdx, rdi
call fcn.140127b58
cmp eax, dword [r12 + 4]
jne 0x140028f1b
mov edx, esi
add r15, rdx
movsxd rcx, dword [r12 + 8]
mov rbx, qword [rsp + 0x30]
sub rbx, r15
cmp rbx, rcx
jg 0x140028f0f
mov rbx, r13
sub rbx, r15
cmp rbx, rcx
jl 0x140028f0f
add rbp, rdx
mov eax, eax
add rdi, rax
add r15, rcx
add r12, 0xc
xor ebx, ebx
cmp r12, qword [rsp + 0x28]
jb 0x140028f73
jmp 0x140028f1b
xor ebx, ebx
jmp 0x140028f1b
Function at 0x140029080
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
movaps xmmword [rsp + 0xa0], xmm6
mov r15, r8
mov rbp, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x98], rax
lea rbx, [rsp + 0x30]
mov dword [rbx], 0xaaaaaaaa
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor esi, esi
mov rcx, rdx
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.140124a1c
cmp eax, 1
sbb esi, esi
not esi
or esi, dword [rbx]
js 0x140029121
movaps xmm6, xmmword [0x1401e90c0]
lea rdx, [rsp + 0x70]
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
mov ecx, esi
call fcn.140028da0
mov r12d, 0xffffffff
xor r14d, r14d
test eax, eax
je 0x14002912b
mov edi, eax
mov ebx, 0xffffffff
jmp 0x140029265
mov edi, 6
jmp 0x14002928c
mov dword [rsp + 0x30], 0xaaaaaaaa
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
mov rcx, rbp
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.140124a1c
mov ebx, dword [rsp + 0x30]
cmp eax, 1
mov ebp, 0
sbb ebp, ebp
not ebp
or ebp, ebx
js 0x14002924d
lea rdx, [rsp + 0x30]
movaps xmmword [rdx + 0x20], xmm6
movaps xmmword [rdx + 0x10], xmm6
movaps xmmword [rdx], xmm6
mov ecx, ebp
call fcn.140121f48
mov r12d, 0xffffffff
mov edi, 6
test eax, eax
jne 0x140029262
mov r13d, dword [rsp + 0x44]
cmp r13d, dword [rsp + 0x78]
jne 0x140029256
mov rcx, r13
call fcn.1400f0650
test rax, rax
je 0x14002925d
mov r14, rax
mov ecx, ebp
mov rdx, rax
mov r8d, r13d
call fcn.140123bcc
cmp eax, dword [rsp + 0x78]
jne 0x140029265
mov ebp, eax
call fcn.14016f420
movsxd rdx, ebp
mov rcx, r14
call fcn.14016f3f0
not eax
cmp dword [rsp + 0x7c], eax
jne 0x1400292ba
lea r12, [rsp + 0x6c]
mov dword [r12], 0xaaaaaaaa
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
xor ebp, ebp
mov rcx, r15
mov edx, 0x8301
mov r8d, 0x40
xor r9d, r9d
call fcn.140124a1c
mov r12d, dword [r12]
cmp eax, 1
sbb ebp, ebp
not ebp
or ebp, r12d
js 0x1400292c1
lea rcx, [rsp + 0x70]
mov edx, esi
mov r8, r14
mov r9d, ebp
call fcn.140028e90
mov edi, eax
jmp 0x140029265
mov edi, 6
mov ebx, ebp
jmp 0x140029265
mov edi, 8
jmp 0x140029262
mov edi, 1
xor r14d, r14d
mov rcx, r14
call fcn.1400f06b0
mov ecx, esi
call fcn.14011f150
test ebx, ebx
js 0x14002927f
mov ecx, ebx
call fcn.14011f150
test r12d, r12d
js 0x14002928c
mov ecx, r12d
call fcn.14011f150
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140111870
mov eax, edi
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 4
jmp 0x140029265
mov r12d, ebp
jmp 0x140029265