joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020da0
Capabilities:
Get thread local storage value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
mov rax, qword [0x14143b040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, ecx
mov eax, edx
add ecx, 0xfffffec0
cmp ecx, 0x10
jbe 0x140020f25
cmp dword [0x141443c80], 0
mov qword [r11 + 0x18], rsi
mov rsi, qword [0x141446d58]
mov qword [0x141446d58], 0
mov qword [r11 + 0x20], rdi
jne 0x140020dfd
xor edx, edx
mov ecx, 0x10001
call fcn.14037c450
xor edi, edi
jmp 0x140020e3e
cmp ebx, 0xffffffff
je 0x140020e33
lea eax, [rbx - 0x20]
cmp eax, 0x13c
ja 0x140020e69
cmp ebx, 0x150
je 0x140020e2b
lea eax, [rbx - 0x140]
cmp eax, 0xe
jbe 0x140020e2b
lea eax, [rbx - 0x27]
cmp eax, 0x7b
jbe 0x140020e2b
xor edi, edi
jmp 0x140020e3e
mov ecx, ebx
call qword [0x141443d10]
mov ecx, eax
call qword [0x141443d08]
mov rdi, rax
cmp dword [0x141443c80], 0
mov qword [0x141446d58], rsi
mov rsi, qword [rsp + 0x90]
je 0x140020e81
mov ecx, dword [0x141445620]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140020e8f
jmp 0x140020e88
mov r8d, ebx
lea rdx, [0x14140bf58]
mov ecx, 0x10003
call fcn.14037c450
xor edi, edi
jmp 0x140020e3e
lea rax, [0x141446d80]
mov dword [rax + 8], 0
test rdi, rdi
je 0x140020f1d
movsx ecx, byte [rdi]
test cl, cl
je 0x140020f1d
cmp byte [rdi + 1], 0
jne 0x140020f1d
vmovsd xmm0, qword [0x1413a37d8]
mov eax, dword [0x1413a37e0]
vmovdqu xmm1, xmmword [0x14140ed10]
mov dword [rsp + 0x58], eax
lea eax, [rcx - 0x30]
vmovsd qword [rsp + 0x50], xmm0
vmovdqu ymm0, ymmword [0x14140f320]
vmovdqu ymmword [rsp + 0x20], ymm0
vmovdqu xmmword [rsp + 0x40], xmm1
cmp al, 9
ja 0x140020ee4
mov ebx, ecx
jmp 0x140020f1d
lea eax, [rcx - 0x41]
mov edx, ecx
cmp al, 0x19
ja 0x140020ef1
mov ebx, ecx
jmp 0x140020f1d
sub cl, 0x61
cmp cl, 0x19
ja 0x140020efe
lea ebx, [rdx - 0x20]
jmp 0x140020f1d
lea rcx, [rsp + 0x50]
vzeroupper
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
je 0x140020f1d
lea rcx, [rsp + 0x50]
sub rax, rcx
mov ebx, dword [rsp + rax*4 + 0x20]
mov rdi, qword [rsp + 0x98]
mov eax, ebx
vzeroupper
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1403f4b10
add rsp, 0x70
pop rbx
ret
Function at 0x140024b70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movabs rax, 0x9e3779b185ebca87
lea rdi, [0x140518740]
mov r9, rdx
mov r11d, edx
imul r9, rax
shr r11d, 4
mov rbx, rdx
xor r8d, r8d
mov r10, rcx
nop word [rax + rax]
mov eax, r8d
inc r8d
shl eax, 4
mov ecx, eax
mov rdx, qword [rax + r10]
mov rax, qword [rax + rdi + 8]
xor rax, qword [rcx + r10 + 8]
mov rcx, qword [rcx + rdi]
xor rcx, rdx
mul rcx
xor rax, rdx
add r9, rax
cmp r8d, 8
jb 0x140024bb0
mov rax, qword [0x1405187bf]
movabs rsi, 0x165667919e3779f9
xor rax, qword [r10 + rbx - 8]
mov r8d, 8
mov rcx, qword [0x1405187b7]
xor rcx, qword [r10 + rbx - 0x10]
mul rcx
mov rcx, r9
shr rcx, 0x25
mov rbx, rax
xor rcx, r9
xor rbx, rdx
imul rcx, rsi
mov r9, rcx
shr r9, 0x20
xor r9, rcx
cmp r11d, r8d
jbe 0x140024c66
nop dword [rax]
mov eax, r8d
mov ecx, r8d
shl ecx, 4
inc r8d
shl eax, 4
add ecx, 0xffffff80
mov rdx, qword [rcx + rdi + 0xb]
xor rdx, qword [rax + r10 + 8]
mov rcx, qword [rcx + rdi + 3]
xor rcx, qword [rax + r10]
mov rax, rdx
mul rcx
xor rdx, rax
add rbx, rdx
cmp r8d, r11d
jb 0x140024c30
mov rdi, qword [rsp + 0x18]
lea rax, [rbx + r9]
mov rbx, qword [rsp + 8]
mov rcx, rax
shr rcx, 0x25
xor rcx, rax
imul rcx, rsi
mov rsi, qword [rsp + 0x10]
mov rax, rcx
shr rax, 0x20
xor rax, rcx
ret

Function at 0x140025f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rdx]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140025f74
call fcn.140025020
mov rsi, qword [rbx + 0x18]
mov r9, rax
imul r9, qword [rbx + 8]
mov ebp, dword [rbx + 0x38]
mov rax, r9
shr rax, 0x21
xor r9, rax
mov eax, dword [rbx + 0x3c]
mov rcx, r9
shr r9, 5
and r9, qword [rbx + 0x28]
and ecx, 0x1f
shrx r10, rcx, rax
add r10d, ebp
movzx eax, byte [rsi + r9]
lea r11, [r9 + r9*2]
shl r11, 3
cmp r10d, eax
jne 0x140025feb
mov rax, qword [rbx + 0x10]
mov rcx, qword [rdi]
mov r8, qword [r11 + rax]
sub r8, rcx
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140025fe7
inc rcx
test eax, eax
jne 0x140025fd4
test edx, edx
je 0x140026048
movzx eax, byte [rsi + r9 + 1]
add r10d, ebp
cmp r10d, eax
jne 0x140026027
mov rcx, qword [rbx + 0x10]
mov rax, qword [rdi]
mov r8, qword [r11 + rcx + 0x18]
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140026023
inc rax
test ecx, ecx
jne 0x140026010
test edx, edx
je 0x14002604d
movzx eax, byte [rsi + r9 + 2]
add r9, 2
add r11, 0x30
add r10d, ebp
cmp r10d, eax
jbe 0x140025fc4
cmp qword [rbx + 0x28], 0
jne 0x140026053
xor edx, edx
jmp 0x140026075
mov rax, r9
jmp 0x140026078
lea rax, [r9 + 1]
jmp 0x140026078
mov rcx, rsi
movabs rax, 0x2aaaaaaaaaaaaaab
sub rcx, qword [rbx + 0x10]
imul rcx
sar rdx, 2
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rax, rdx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140026090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r13, r8
mov r15d, ebp
mov r12, rdx
mov rbx, rcx
nop word [rax + rax]
mov rcx, qword [r13]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rcx + rdx], bpl
jne 0x1400260d0
call fcn.140025020
mov rdi, qword [rbx + 0x18]
mov r8, rax
imul r8, qword [rbx + 8]
mov r14d, dword [rbx + 0x38]
mov rcx, r8
shr rcx, 0x21
xor r8, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, r8
shr r8, 5
and r8, qword [rbx + 0x28]
and edx, 0x1f
shrx r10, rdx, rcx
add r10d, r14d
movzx eax, byte [rdi + r8]
cmp r10d, eax
jae 0x140026131
nop dword [rax + rax]
movzx eax, byte [rdi + r8 + 1]
inc r8
add r10d, r14d
cmp r10d, eax
jb 0x140026120
movzx eax, byte [rdi + r8]
cmp r10d, eax
jne 0x14002618c
mov rax, qword [rbx + 0x10]
lea rcx, [r8 + r8*2]
mov rsi, qword [r13]
lea r11, [rax + rcx*8]
nop dword [rax + rax]
mov r9, qword [r11]
mov rax, rsi
sub r9, rsi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140026173
inc rax
test ecx, ecx
jne 0x140026160
test edx, edx
je 0x1400261bb
movzx eax, byte [rdi + r8 + 1]
inc r8
add r11, 0x18
add r10d, r14d
cmp r10d, eax
je 0x140026150
mov rax, qword [rbx + 0x30]
cmp qword [rbx + 0x20], rax
jb 0x1400261cd
mov rcx, rbx
call fcn.1400262e0
test al, al
je 0x1400261b2
inc r15d
cmp r15d, 0x100
jl 0x1400260c0
mov qword [r12], rbp
jmp 0x1400262b3
mov qword [r12], r8
mov dword [r12 + 8], 1
jmp 0x1400262b8
lea eax, [r14 + r10]
mov r9, r8
cmp eax, 0xff
jbe 0x1400261df
mov qword [rbx + 0x30], rbp
cmp byte [rdi + r8], bpl
je 0x140026299
nop dword [rax]
mov rdx, r8
inc r8
cmp byte [rdi + r8], bpl
jne 0x1400261f0
cmp r8, r9
je 0x140026299
mov rax, qword [rbx + 0x10]
lea rcx, [r8 + r8*2]
vmovups xmm0, xmmword [rax + rcx*8 - 0x18]
vmovups xmmword [rax + rcx*8], xmm0
vmovsd xmm1, qword [rax + rcx*8 - 8]
vmovsd qword [rax + rcx*8 + 0x10], xmm1
cmp rdx, r9
je 0x140026265
lea rcx, [rdx + rdx*2]
shl rcx, 3
sub rdx, r9
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rcx - 0x18]
vmovups xmm0, xmmword [rax + rcx]
vmovups xmmword [rax + rcx + 0x18], xmm0
vmovsd xmm1, qword [rax + rcx + 0x10]
vmovsd qword [rax + rcx + 0x28], xmm1
sub rdx, 1
jne 0x140026240
mov rdx, qword [rbx + 0x18]
mov rcx, r8
nop dword [rax]
movzx eax, byte [rcx + rdx - 1]
add al, byte [rbx + 0x38]
mov byte [rcx + rdx], al
mov rdx, qword [rbx + 0x18]
movzx eax, byte [rcx + rdx]
add eax, dword [rbx + 0x38]
cmp eax, 0xff
jbe 0x140026291
mov qword [rbx + 0x30], rbp
dec rcx
cmp rcx, r9
jne 0x140026270
mov rax, qword [rbx + 0x18]
mov qword [r12], r9
mov byte [r9 + rax], r10b
inc qword [rbx + 0x20]
cmp r8, r9
setne bpl
add ebp, 2
mov dword [r12 + 8], ebp
mov rbx, qword [rsp + 0x50]
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140026770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30], 0
mov rdi, rdx
mov rbx, rcx
jne 0x140026794
call fcn.140026410
test al, al
je 0x1400268fa
mov rcx, qword [rdi]
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400267a3
call fcn.140025020
imul rax, qword [rbx + 8]
mov r9d, dword [rbx + 0x38]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, rax
shr rax, 5
and rax, qword [rbx + 0x28]
and edx, 0x1f
shrx r8, rdx, rcx
mov rdx, qword [rbx + 0x18]
add r8d, r9d
movzx ecx, byte [rdx + rax]
cmp r8d, ecx
ja 0x140026800
nop word [rax + rax]
movzx ecx, byte [rdx + rax + 1]
inc rax
add r8d, r9d
cmp r8d, ecx
jbe 0x1400267f0
movzx ecx, r8b
xor esi, esi
add ecx, r9d
mov r10, rax
cmp ecx, 0xff
jbe 0x140026818
mov qword [rbx + 0x30], rsi
cmp byte [rdx + rax], sil
je 0x140026829
nop
inc rax
cmp byte [rdx + rax], sil
jne 0x140026820
mov rdx, qword [rbx + 0x10]
lea rcx, [r10 + r10*2]
lea r11, [rdx + rcx*8]
cmp rax, r10
je 0x1400268ca
lea rcx, [rax + rax*2]
vmovups xmm0, xmmword [rdx + rcx*8 - 0x18]
vmovups xmmword [rdx + rcx*8], xmm0
vmovsd xmm1, qword [rdx + rcx*8 - 8]
lea r9, [rax - 1]
vmovsd qword [rdx + rcx*8 + 0x10], xmm1
cmp r9, r10
je 0x140026895
lea rdx, [r9 + r9*2]
shl rdx, 3
sub r9, r10
nop dword [rax]
mov rcx, qword [rbx + 0x10]
lea rdx, [rdx - 0x18]
vmovups xmm0, xmmword [rdx + rcx]
vmovups xmmword [rdx + rcx + 0x18], xmm0
vmovsd xmm1, qword [rdx + rcx + 0x10]
vmovsd qword [rdx + rcx + 0x28], xmm1
sub r9, 1
jne 0x140026870
mov rdx, qword [rbx + 0x18]
nop dword [rax]
movzx ecx, byte [rdx + rax - 1]
add cl, byte [rbx + 0x38]
mov byte [rdx + rax], cl
mov rdx, qword [rbx + 0x18]
movzx ecx, byte [rdx + rax]
add ecx, dword [rbx + 0x38]
cmp ecx, 0xff
jbe 0x1400268c2
mov qword [rbx + 0x30], rsi
dec rax
cmp rax, r10
jne 0x1400268a0
vmovups xmm0, xmmword [rdi]
mov rsi, qword [rsp + 0x30]
vmovups xmmword [r11], xmm0
vmovsd xmm1, qword [rdi + 0x10]
vmovsd qword [r11 + 0x10], xmm1
mov rax, qword [rbx + 0x18]
mov byte [r10 + rax], r8b
inc qword [rbx + 0x20]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14001c8f0
int3
Function at 0x140028370
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx], rdx
je 0x14002853a
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rcx], rdx
test rdx, rdx
jne 0x1400283a9
xor eax, eax
jmp 0x1400283f3
mov qword [rsp + 0x20], rsi
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1400283b5
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rcx, [r8 + 0xca8]
call fcn.1401b59d0
lea rcx, [rax + rax*2]
mov rax, qword [r14 + 0xcb8]
lea rax, [rax + rcx*8]
cmp rax, qword [r14 + 0xcc0]
jne 0x1400283f0
xor eax, eax
jmp 0x1400283f3
mov eax, dword [rax + 0x10]
mov dword [rdi + 8], eax
mov rbx, qword [rdi + 0x28]
mov rbp, qword [rdi + 0x30]
cmp rbx, rbp
je 0x14002841c
mov rcx, rbx
call fcn.140028990
add rbx, 0x28
cmp rbx, rbp
jne 0x140028403
mov rax, qword [rdi + 0x28]
mov qword [rdi + 0x30], rax
test rsi, rsi
je 0x140028530
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rsi
lea rcx, [r14 + 0x2150]
call fcn.140025f50
lea rcx, [rax + rax*2]
mov rax, qword [r14 + 0x2160]
lea rdx, [rax + rcx*8]
cmp rdx, qword [r14 + 0x2168]
jne 0x140028459
vpxor xmm0, xmm0, xmm0
jmp 0x14002845e
vmovups xmm0, xmmword [rdx + 8]
vmovq rax, xmm0
test rax, rax
je 0x14002847d
vpextrd esi, xmm0, 2
mov qword [rdi + 0x10], rax
mov eax, esi
mov qword [rdi + 0x20], rax
jmp 0x140028512
mov rdx, rsi
mov rcx, r15
call fcn.14014cfe0
mov rcx, rax
lea rdx, [0x1413a189c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x140028529
xor edx, edx
mov r8d, 2
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov esi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
cmp rsi, qword [rdi + 0x20]
jbe 0x1400284ec
mov rcx, qword [rdi + 0x18]
call fcn.1403f4db4
mov ecx, esi
call fcn.1403f4de8
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rsi
mov rcx, qword [rdi + 0x18]
mov r9, rbx
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rax, qword [rdi + 0x18]
mov rcx, rbx
mov qword [rdi + 0x10], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
cmp qword [rdi], 0
je 0x140028530
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
mov r8d, esi
call fcn.140028550
jmp 0x140028530
mov qword [rdi], 0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14002cdd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r13, r8
mov r15d, ebp
mov r12, rdx
mov rbx, rcx
nop word [rax + rax]
mov rcx, qword [r13]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rcx + rdx], bpl
jne 0x14002ce10
call fcn.140025020
mov rdi, qword [rbx + 0x18]
mov r8, rax
imul r8, qword [rbx + 8]
mov r14d, dword [rbx + 0x38]
mov rcx, r8
shr rcx, 0x21
xor r8, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, r8
shr r8, 5
and r8, qword [rbx + 0x28]
and edx, 0x1f
shrx r10, rdx, rcx
add r10d, r14d
movzx eax, byte [rdi + r8]
cmp r10d, eax
jae 0x14002ce71
nop dword [rax + rax]
movzx eax, byte [rdi + r8 + 1]
inc r8
add r10d, r14d
cmp r10d, eax
jb 0x14002ce60
movzx eax, byte [rdi + r8]
cmp r10d, eax
jne 0x14002cecc
mov rax, qword [rbx + 0x10]
mov rsi, qword [r13]
lea r11, [rax + r8*8]
nop word [rax + rax]
mov r9, qword [r11]
mov rax, rsi
sub r9, rsi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14002ceb3
inc rax
test ecx, ecx
jne 0x14002cea0
test edx, edx
je 0x14002cefb
movzx eax, byte [rdi + r8 + 1]
inc r8
add r11, 8
add r10d, r14d
cmp r10d, eax
je 0x14002ce90
mov rax, qword [rbx + 0x30]
cmp qword [rbx + 0x20], rax
jb 0x14002cf0d
mov rcx, rbx
call fcn.14002cff0
test al, al
je 0x14002cef2
inc r15d
cmp r15d, 0x100
jl 0x14002ce00
mov qword [r12], rbp
jmp 0x14002cfc3
mov qword [r12], r8
mov dword [r12 + 8], 1
jmp 0x14002cfc8
lea eax, [r14 + r10]
mov r9, r8
cmp eax, 0xff
jbe 0x14002cf1f
mov qword [rbx + 0x30], rbp
cmp byte [rdi + r8], bpl
je 0x14002cfa9
nop dword [rax]
mov rdx, r8
inc r8
cmp byte [rdi + r8], bpl
jne 0x14002cf30
cmp r8, r9
je 0x14002cfa9
mov rax, qword [rbx + 0x10]
lea rcx, [rax + r8*8]
mov rax, qword [rax + r8*8 - 8]
mov qword [rcx], rax
cmp rdx, r9
je 0x14002cf77
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*8]
dec rdx
mov rax, qword [rcx - 8]
mov qword [rcx], rax
cmp rdx, r9
jne 0x14002cf60
mov rdx, qword [rbx + 0x18]
mov rcx, r8
nop
movzx eax, byte [rcx + rdx - 1]
add al, byte [rbx + 0x38]
mov byte [rcx + rdx], al
mov rdx, qword [rbx + 0x18]
movzx eax, byte [rcx + rdx]
add eax, dword [rbx + 0x38]
cmp eax, 0xff
jbe 0x14002cfa1
mov qword [rbx + 0x30], rbp
dec rcx
cmp rcx, r9
jne 0x14002cf80
mov rax, qword [rbx + 0x18]
mov qword [r12], r9
mov byte [r9 + rax], r10b
inc qword [rbx + 0x20]
cmp r8, r9
setne bpl
add ebp, 2
mov dword [r12 + 8], ebp
mov rbx, qword [rsp + 0x50]
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14004a3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14004a3d4
call fcn.14004a520
test al, al
je 0x14004a50f
mov rcx, qword [rdi]
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14004a3e3
call fcn.140025020
imul rax, qword [rbx + 8]
mov r9d, dword [rbx + 0x38]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, rax
shr rax, 5
and rax, qword [rbx + 0x28]
and edx, 0x1f
shrx r8, rdx, rcx
mov rdx, qword [rbx + 0x18]
add r8d, r9d
movzx ecx, byte [rdx + rax]
cmp r8d, ecx
ja 0x14004a440
nop word [rax + rax]
movzx ecx, byte [rdx + rax + 1]
inc rax
add r8d, r9d
cmp r8d, ecx
jbe 0x14004a430
movzx ecx, r8b
xor esi, esi
add ecx, r9d
mov r10, rax
cmp ecx, 0xff
jbe 0x14004a458
mov qword [rbx + 0x30], rsi
cmp byte [rdx + rax], sil
je 0x14004a469
nop
inc rax
cmp byte [rdx + rax], sil
jne 0x14004a460
mov rdx, qword [rbx + 0x10]
mov r11, r10
shl r11, 4
add r11, rdx
cmp rax, r10
je 0x14004a4ea
mov rcx, rax
lea r9, [rax - 1]
add rcx, rcx
vmovups xmm0, xmmword [rdx + rcx*8 - 0x10]
vmovups xmmword [rdx + rcx*8], xmm0
cmp r9, r10
je 0x14004a4b9
mov rdx, r9
shl rdx, 4
sub r9, r10
mov rcx, qword [rbx + 0x10]
lea rdx, [rdx - 0x10]
vmovups xmm0, xmmword [rdx + rcx]
vmovups xmmword [rdx + rcx + 0x10], xmm0
sub r9, 1
jne 0x14004a4a0
mov rdx, qword [rbx + 0x18]
nop dword [rax]
movzx ecx, byte [rdx + rax - 1]
add cl, byte [rbx + 0x38]
mov byte [rdx + rax], cl
mov rdx, qword [rbx + 0x18]
movzx ecx, byte [rdx + rax]
add ecx, dword [rbx + 0x38]
cmp ecx, 0xff
jbe 0x14004a4e2
mov qword [rbx + 0x30], rsi
dec rax
cmp rax, r10
jne 0x14004a4c0
vmovups xmm0, xmmword [rdi]
mov rsi, qword [rsp + 0x30]
vmovups xmmword [r11], xmm0
mov rax, qword [rbx + 0x18]
mov byte [r10 + rax], r8b
inc qword [rbx + 0x20]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14001c8f0
int3
Function at 0x14004ba60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r13, r8
mov r15d, ebp
mov r12, rdx
mov rbx, rcx
nop word [rax + rax]
mov rcx, qword [r13]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rcx + rdx], bpl
jne 0x14004baa0
call fcn.140025020
mov rdi, qword [rbx + 0x18]
mov r8, rax
imul r8, qword [rbx + 8]
mov r14d, dword [rbx + 0x38]
mov rcx, r8
shr rcx, 0x21
xor r8, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, r8
shr r8, 5
and r8, qword [rbx + 0x28]
and edx, 0x1f
shrx r10, rdx, rcx
add r10d, r14d
movzx eax, byte [rdi + r8]
cmp r10d, eax
jae 0x14004bb01
nop dword [rax + rax]
movzx eax, byte [rdi + r8 + 1]
inc r8
add r10d, r14d
cmp r10d, eax
jb 0x14004baf0
movzx eax, byte [rdi + r8]
cmp r10d, eax
jne 0x14004bb5c
mov rsi, qword [r13]
mov r11, r8
shl r11, 4
add r11, qword [rbx + 0x10]
nop word [rax + rax]
mov r9, qword [r11]
mov rax, rsi
sub r9, rsi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14004bb43
inc rax
test ecx, ecx
jne 0x14004bb30
test edx, edx
je 0x14004bb8b
movzx eax, byte [rdi + r8 + 1]
inc r8
add r11, 0x10
add r10d, r14d
cmp r10d, eax
je 0x14004bb20
mov rax, qword [rbx + 0x30]
cmp qword [rbx + 0x20], rax
jb 0x14004bb9d
mov rcx, rbx
call fcn.140058640
test al, al
je 0x14004bb82
inc r15d
cmp r15d, 0x100
jl 0x14004ba90
mov qword [r12], rbp
jmp 0x14004bc63
mov qword [r12], r8
mov dword [r12 + 8], 1
jmp 0x14004bc68
lea eax, [r14 + r10]
mov r9, r8
cmp eax, 0xff
jbe 0x14004bbaf
mov qword [rbx + 0x30], rbp
cmp byte [rdi + r8], bpl
je 0x14004bc49
nop dword [rax]
mov rdx, r8
inc r8
cmp byte [rdi + r8], bpl
jne 0x14004bbc0
cmp r8, r9
je 0x14004bc49
mov rax, qword [rbx + 0x10]
mov rcx, r8
add rcx, rcx
vmovups xmm0, xmmword [rax + rcx*8 - 0x10]
vmovups xmmword [rax + rcx*8], xmm0
cmp rdx, r9
je 0x14004bc19
mov rcx, rdx
shl rcx, 4
sub rdx, r9
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rcx - 0x10]
vmovups xmm0, xmmword [rax + rcx]
vmovups xmmword [rax + rcx + 0x10], xmm0
sub rdx, 1
jne 0x14004bc00
mov rdx, qword [rbx + 0x18]
mov rcx, r8
movzx eax, byte [rcx + rdx - 1]
add al, byte [rbx + 0x38]
mov byte [rcx + rdx], al
mov rdx, qword [rbx + 0x18]
movzx eax, byte [rcx + rdx]
add eax, dword [rbx + 0x38]
cmp eax, 0xff
jbe 0x14004bc41
mov qword [rbx + 0x30], rbp
dec rcx
cmp rcx, r9
jne 0x14004bc20
mov rax, qword [rbx + 0x18]
mov qword [r12], r9
mov byte [r9 + rax], r10b
inc qword [rbx + 0x20]
cmp r8, r9
setne bpl
add ebp, 2
mov dword [r12 + 8], ebp
mov rbx, qword [rsp + 0x50]
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14005eb40
Capabilities:
Create directory

Disassembly:
push rbx
push r12
sub rsp, 0x98
mov rax, qword [0x14143b040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor r12d, r12d
mov rbx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x14005eb6a
mov rcx, qword [rcx]
mov qword [rsp + 0xb8], rbp
lea rdx, [rsp + 0x48]
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x14005ecc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 2
jne 0x14005ed0a
mov rsi, r12
nop word [rax + rax]
mov r15, qword [rbx + 0x18]
inc rsi
mov rdi, qword [rbx + 0x10]
mov r14, rbx
cmp r15, 0xf
jbe 0x14005ebd7
mov r14, qword [rbx]
cmp rsi, rdi
jae 0x14005ec18
mov r8, rdi
lea rcx, [r14 + rsi]
sub r8, rsi
mov edx, 0x2f
call sub.VCRUNTIME140.dll_memchr
mov rsi, rax
test rax, rax
je 0x14005ec18
sub rsi, r14
mov rbp, rsi
cmp rsi, 2
jne 0x14005ec22
mov rax, rbx
cmp r15, 0xf
jbe 0x14005ec10
mov rax, qword [rbx]
cmp byte [rax + 1], 0x3a
je 0x14005ebc0
jmp 0x14005ec22
mov rbp, 0xffffffffffffffff
mov rsi, rbp
cmp rdi, rbp
mov qword [rsp + 0x38], r12
mov r8, rbp
mov qword [rsp + 0x40], r12
cmovb r8, rdi
mov rdx, rbx
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x28], xmm0
cmp r15, 0xf
jbe 0x14005ec4c
mov rdx, qword [rbx]
lea rcx, [rsp + 0x28]
call fcn.140004000
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rdx, qword [rsp + 0x40]
mov edi, eax
cmp rdx, 0xf
jbe 0x14005eca8
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005eca3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005ed03
call fcn.1403f4db4
test edi, edi
je 0x14005ecb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x11
jne 0x14005ed0a
cmp rbp, 0xffffffffffffffff
jne 0x14005ebc0
mov al, 1
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1403f4b10
add rsp, 0x98
pop r12
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor al, al
jmp 0x14005ecc3