joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c9f74
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x14011e480]
test rcx, rcx
jne 0x1400c9ecb
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x1400c9ec4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400c9ef6
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x1400c9ec0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x14011e480], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x1400c9f69
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400c9f19
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], reloc.ATL100.DLL_Ordinal_32
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x14011e480]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x1400c9f46
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x1400c9f69
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x14011e480]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x1400c9f4d
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x1400c9e50
Function at 0x1400cb5d7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14011d8d0]
jne 0x1400cafba
rol rcx, 0x10
test cx, 0xffff
jne 0x1400cafb6
repz ret
ror rcx, 0x10
jmp 0x1400cb530
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14011e650]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14011e748]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400cb5b5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14011e650]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400cb5d7
mov rax, qword [rsp + 0x88]
mov qword [0x14011e748], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14011e6e8], rax
mov rax, qword [0x14011e748]
mov qword [0x14011e5c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14011e6d0], rax
mov dword [0x14011e5b0], 0xc0000409
mov dword [0x14011e5b4], 1
mov rax, qword [0x14011d8d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14011d8d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14011e648], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400f0630]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14011e648], 0
jne 0x1400cb65e
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400011c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea r14d, [rbp + 4]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov r15d, 0x20
mov eax, dword [r15 + rsi]
mov r12d, 0x30
test al, 1
jne 0x140001259
or eax, 1
mov dword [r15 + rsi], eax
mov ebx, r12d
add rbx, rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
lea ecx, [rbp + 1]
lea r8, [rbx + 8]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140001231
mov dword [rbx], 0x270
mov eax, dword [r15 + rsi]
mov ecx, 0x10
test al, 2
jne 0x14000127a
or eax, 2
mov dword [r15 + rsi], eax
mov qword [rsi + rcx], rbp
mov qword [rsi + rcx + 8], 0xf
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
lea r15, [rsi + rcx]
mov ebx, r12d
add rbx, rsi
lea r12, str.0123456789ABCDEF
nop dword [rax + rax]
dec r14
mov qword [rsp + 0x28], rbx
mov rbp, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x1400012e5
mov rcx, rbx
call fcn.14000ec10
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.14000ec10
mov eax, eax
or rsi, rax
jmp 0x1400012f5
inc rdx
lea rcx, [rsp + 0x28]
call fcn.14000ea60
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000132a
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14000131f
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001332
mov rcx, rdi
call fcn.14000e390
test r14, r14
jne 0x1400012b0
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000ec10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000ec71
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000ec30
mov ecx, dword [r9]
jmp 0x14000ed58
cmp ecx, 0x4e0
jb 0x14000ed58
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000ec90
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000ece0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14000f8f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f93a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f93a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f93a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f93a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f93a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000f93c
xor al, al
add rsp, 0x28
ret
Function at 0x1400087bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140008808
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140008800
cmp dword [rcx + 0x3c], edx
jl 0x140008800
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140008800
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140008808
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140603058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406031df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140603089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14060306f
add dl, dl
jne 0x140603096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406030f6
xor eax, eax
add dl, dl
jne 0x1406030a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406031ad
add dl, dl
jne 0x1406030b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406030c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406030d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406030dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406030ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14060307e
mov eax, 1
add dl, dl
jne 0x140603106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140603113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406030fb
sub eax, ebx
mov ebx, 1
jne 0x14060314c
mov ecx, 1
add dl, dl
jne 0x14060312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14060313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140603123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14060307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140603168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140603175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14060315d
cmp eax, 0x7d00
jae 0x14060319b
cmp eax, 0x500
jb 0x140603196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14060307e
cmp eax, 0x7f
ja 0x14060319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14060307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406031d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14060307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140035670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rcx, rdx
je 0x140035832
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14009a008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, r8
mov r15, rdx
mov rsi, rcx
lea rdi, [rcx + 0x60]
cmp rdi, rdx
je 0x140035807
xor r12d, r12d
nop word [rax + rax]
mov rbp, rdi
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 8]
mov dword [rsp + 0x38], eax
movss xmm0, dword [rdi + 0xc]
movss dword [rsp + 0x3c], xmm0
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x40], eax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x44], eax
movss xmm0, dword [rdi + 0x18]
movss dword [rsp + 0x48], xmm0
movss xmm1, dword [rdi + 0x1c]
movss dword [rsp + 0x4c], xmm1
movss xmm0, dword [rdi + 0x20]
movss dword [rsp + 0x50], xmm0
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x58], rax
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x60], eax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], r12w
lea rdx, [rdi + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140004930
nop
mov rdx, rsi
lea rcx, [rsp + 0x30]
call qword [r14]
test al, al
je 0x14003579a
mov rbx, rdi
cmp rsi, rdi
je 0x140035795
nop word [rax + rax]
sub rbx, 0x60
lea rcx, [rbx + 0x60]
mov rdx, rbx
call fcn.140035840
cmp rbx, rsi
jne 0x140035780
mov rcx, rsi
jmp 0x1400357d4
lea rbx, [rdi - 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [r14]
test al, al
je 0x1400357d1
nop dword [rax]
mov rdx, rbx
mov rcx, rbp
call fcn.140035840
mov rbp, rbx
sub rbx, 0x60
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [r14]
test al, al
jne 0x1400357b0
mov rcx, rbp
lea rdx, [rsp + 0x30]
call fcn.140035840
nop
mov r8, qword [rsp + 0x88]
cmp r8, 8
jb 0x1400357fa
inc r8
mov rdx, qword [rsp + 0x70]
call fcn.1400049c0
add rdi, 0x60
cmp rdi, r15
jne 0x1400356d0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140070eb0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140035679
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rcx, rdx
je 0x140035832
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14009a008]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, r8
mov r15, rdx
mov rsi, rcx
lea rdi, [rcx + 0x60]
cmp rdi, rdx
je 0x140035807
xor r12d, r12d
nop word [rax + rax]
mov rbp, rdi
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 8]
mov dword [rsp + 0x38], eax
movss xmm0, dword [rdi + 0xc]
movss dword [rsp + 0x3c], xmm0
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x40], eax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x44], eax
movss xmm0, dword [rdi + 0x18]
movss dword [rsp + 0x48], xmm0
movss xmm1, dword [rdi + 0x1c]
movss dword [rsp + 0x4c], xmm1
movss xmm0, dword [rdi + 0x20]
movss dword [rsp + 0x50], xmm0
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x58], rax
mov eax, dword [rdi + 0x30]
mov dword [rsp + 0x60], eax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x88], 7
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], r12w
lea rdx, [rdi + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140004930
nop
mov rdx, rsi
lea rcx, [rsp + 0x30]
call qword [r14]
test al, al
je 0x14003579a
mov rbx, rdi
cmp rsi, rdi
je 0x140035795
nop word [rax + rax]
sub rbx, 0x60
lea rcx, [rbx + 0x60]
mov rdx, rbx
call fcn.140035840
cmp rbx, rsi
jne 0x140035780
mov rcx, rsi
jmp 0x1400357d4
lea rbx, [rdi - 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [r14]
test al, al
je 0x1400357d1
nop dword [rax]
mov rdx, rbx
mov rcx, rbp
call fcn.140035840
mov rbp, rbx
sub rbx, 0x60
mov rdx, rbx
lea rcx, [rsp + 0x30]
call qword [r14]
test al, al
jne 0x1400357b0
mov rcx, rbp
lea rdx, [rsp + 0x30]
call fcn.140035840
nop
mov r8, qword [rsp + 0x88]
cmp r8, 8
jb 0x1400357fa
inc r8
mov rdx, qword [rsp + 0x70]
call fcn.1400049c0
add rdi, 0x60
cmp rdi, r15
jne 0x1400356d0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140070eb0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b8940
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140132c07
popfq
and ebp, 0x3d629a7e
xor byte [rsi], al
stosb byte [rdi], al
invalid
push 0xfffffffff3860bcf
call fcn.14062e9c9
sbb edi, dword [rbp - 0x48]
add dword [rax], eax
add byte [rax], al
add r12b, byte [r14]
jno 0x140132bfc
sub dword [rbx + 0x7b], edi
add al, 0xdc
push rdx
cmp dword [rbx + 0x62], edi
sar byte [rsi + 0x4c], 0xc0
xor eax, 0x2707baec
add al, 0x4f
movabs dword [0xb52d9b5d31d0ad7b], eax
test al, 0x20
loopne 0x140132c84
sub esi, dword [rdx - 0x16c0b5b9]
mov dl, 0xfa
movabs eax, dword [0xb484939f410f0e6d]
xchg edx, ebx
retf 0x15dd
jmp qword [rbx + 0x7b]

Function at 0x1400bb5a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400bb5cd
xor al, al
jmp 0x1400bb72f
mov rax, qword [0x1400db6b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400db6b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400db6c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400db6c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400db6d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400db6d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400db6e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400db6e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400db6f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400bb721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400bb679
mov r11d, 2
jmp 0x1400bb69d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400bb693
mov r11d, 1
jmp 0x1400bb69d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400bb745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400bb6e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400bb6fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400bb70a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400bb718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400bb660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400bb72a
Function at 0x140004220
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400042b0
jmp 0x14000429f
jae 0x140004370
cmp r8, 0x201
jae 0x1400042b0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140004308
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400042df
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001c740
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140004331
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400043d8
mov r8d, r14d
cmp r15, r8
jne 0x140004290
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400043fb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000429f
jmp 0x1400042b0
cmp rsi, r8
jb 0x140004415
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140007030
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400043c1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140001550
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400043a9
jmp 0x1400043c1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_5680fa18feaa87f3ff04063800aec256c3d4b4belibrary_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001d2d0
jmp 0x14000442a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001d720
ud2
Function at 0x140007a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140007a60
test ecx, ecx
jne 0x140007ab0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140007a6c
test ecx, ecx
jne 0x140007ab0
mov rcx, rdi
call fcn.140007910
movzx eax, al
test bpl, bpl
jne 0x140007ab7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140007aa3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140007c28]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140007aa3.2
xor eax, eax
test bpl, bpl
je 0x140007a7c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140007c09
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x140007aea
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140007b69
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140007b30
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x140007b4b
inc rax
dec rdi
cmp rax, 1
jne 0x140007b10
jmp 0x140007b69
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x140007b4b
cmp ebx, 0x5c
je 0x140007b4b
inc rax
dec rdi
cmp rax, 1
jne 0x140007b30
jmp 0x140007b69
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140007c17
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140007b93
mov al, 9
cmp rdx, 2
je 0x140007b97
cmp rdx, 1
jne 0x140007ba7
cmp byte [r8], 0x2e
jne 0x140007ba7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140007ba7
mov al, 0xa
jmp 0x140007ba7
cmp byte [r8], 0x2e
jne 0x140007ba7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140007aa3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140007aa3.2
mov ecx, 2
jmp case.0x140007aa3.2
lea r8, str.library_std_srcpath.rs
call fcn.14001d6a0
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14001d6a0
ud2