joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002bdb0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
cmp byte [rax + rcx], 0
jne 0x14002bdd9
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 0
jmp 0x14002be43
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x14002bf09
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14002bf04
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
cmp byte [rax + rcx], 0
jne 0x14002be9f
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x48], rax
jne 0x14002bf04
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x14002becf
xor eax, eax
jmp 0x14002bf0b
cmp qword [rsp + 0x90], 0
je 0x14002beec
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
jmp 0x14002bf0b
jmp 0x14002be39
xor eax, eax
add rsp, 0x78
ret
Function at 0x14002bf10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14002bf5b
cmp dword [rsp + 0x24], 0x105
jbe 0x14002bf87
lea rdx, [0x140045674]
mov rcx, qword [rsp + 0x270]
call fcn.1400142b0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x270]
jmp 0x14002c019
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0xffffffffffffffff
inc qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
cmp word [rax + rcx*2], 0
jne 0x14002bf9a
mov rax, qword [rsp + 0x28]
movzx eax, word [rsp + rax*2 + 0x4e]
cmp eax, 0x5c
jne 0x14002bff4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
cmp word [rax + rcx*2], 0
jne 0x14002bfd2
mov rax, qword [rsp + 0x30]
xor ecx, ecx
mov word [rsp + rax*2 + 0x4e], cx
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x270]
call fcn.1400142b0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x14002c030
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
jne 0x14002c0cd
cmp qword [rsp + 0x28], 0
je 0x14002c08f
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
jmp 0x14002c06a
cmp dword [rsp + 0x30], 0
jge 0x14002c0f6
cmp qword [rsp + 0x28], 0
je 0x14002c0ef
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14002c211
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14002c10f
xor eax, eax
jmp 0x14002c211
mov dword [rsp + 0x20], 0
jmp 0x14002c123
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x14002c1fc
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140010d10
mov rcx, qword [rsp + 0x90]
call fcn.140016750
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.140016750
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14002c1ed
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
call fcn.140010dc0
mov rax, qword [rsp + 0x58]
jmp 0x14002c211
lea rcx, [rsp + 0x60]
call fcn.140010dc0
jmp 0x14002c119
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x88
ret
Function at 0x14005d6e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14005d70d
xor al, al
jmp 0x14005d86f
mov rax, qword [0x14007e6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14007e6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14007e6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14007e6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14007e6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14007e6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14007e6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14007e6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14007e700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14005d861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14005d7b9
mov r11d, 2
jmp 0x14005d7dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14005d7d3
mov r11d, 1
jmp 0x14005d7dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14005d885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14005d822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14005d83a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14005d84a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14005d858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14005d7a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14005d86a
Function at 0x14037a08f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdi
ret
sub eax, 0x65a85685
cmp r8b, 0xbd
neg eax
sub eax, 0x33f543fe
clc
rol eax, 3
push rbx
cmp edi, 0x11ff3ee3
xor dword [rsp], eax
sbb bx, 0x5ab9
bsf bx, r10w
test r13, 0x11283f51
pop rbx
cmp dl, r14b
cmc
clc
movsxd rax, eax
jmp 0x14036cc6d
add rdi, rax
jmp 0x14028b701
push rdx
not dl
cwd
push r13
cdq
movzx dx, r14b
movzx rdx, r8w
push rax
push r9
movzx r9d, r12w
movzx ax, r13b
push rsi
mov dh, 0x25
cdq
push rbx
rdtsc
movzx eax, r13w
push r12
movsx esi, r15w
cdq
push rbp
push rdi
push r10
push r14
movsxd r9, ecx
rdtsc
mov r9, r11
push r11
movsx bp, dl
push rcx
mov dl, r8b
pushfq
shl r9b, cl
sal ax, cl
cwd
push r15
push r8
sub dx, 0x71f2
movabs rsi, 0
movsxd rbx, ebx
push rsi
shld rdx, rax, 0x69
rol dx, cl
ror al, cl
mov r9, qword [rsp + 0x90]
cbw
xor r9d, 0x22f7551e
neg r9d
sub dl, 0xb0
sbb bl, 0xd0
adc bpl, 0x8f
xor r9d, 0x14d17963
inc r9d
setb dil
lea r9, [r9 + rsi]
movabs rdx, 0x100000000
movsx bx, r12b
bswap bp
shrd ax, r13w, 0x8c
lea r9, [r9 + rdx]
clc
mov rbp, rsp
sub rsp, 0x180
movzx r8d, r9w
and rsp, 0xfffffffffffffff0
btr rax, r12
sal dil, cl
mov rbx, r9
movabs r8, 0
sub rbx, r8
adc al, 0x19
xor di, r8w
lea rdi, [0x14037a180]
cbw
sub ah, ch
sub r9, 4
adc eax, esp
mov eax, dword [r9]
test bl, 0xf7
xor eax, ebx
jmp 0x140339eb5
Function at 0x1407fa29b
Capabilities:
Execute anti-debugging instructions

Disassembly:
add rdi, rax
jmp 0x140857a8a
push rdx
not dl
cwd
push r13
cdq
movzx dx, r14b
movzx rdx, r8w
push rax
push r9
movzx r9d, r12w
movzx ax, r13b
push rsi
mov dh, 0x25
cdq
push rbx
rdtsc
movzx eax, r13w
push r12
movsx esi, r15w
cdq
push rbp
push rdi
push r10
push r14
movsxd r9, ecx
rdtsc
mov r9, r11
push r11
movsx bp, dl
push rcx
mov dl, r8b
pushfq
shl r9b, cl
sal ax, cl
cwd
push r15
push r8
sub dx, 0x71f2
movabs rsi, 0
movsxd rbx, ebx
push rsi
shld rdx, rax, 0x69
rol dx, cl
ror al, cl
mov r9, qword [rsp + 0x90]
cbw
xor r9d, 0x22f7551e
neg r9d
sub dl, 0xb0
sbb bl, 0xd0
adc bpl, 0x8f
xor r9d, 0x14d17963
inc r9d
setb dil
lea r9, [r9 + rsi]
movabs rdx, 0x100000000
movsx bx, r12b
bswap bp
shrd ax, r13w, 0x8c
lea r9, [r9 + rdx]
clc
mov rbp, rsp
sub rsp, 0x180
movzx r8d, r9w
and rsp, 0xfffffffffffffff0
btr rax, r12
sal dil, cl
mov rbx, r9
movabs r8, 0
sub rbx, r8
adc al, 0x19
xor di, r8w
lea rdi, [0x1407fa38c]
cbw
sub ah, ch
sub r9, 4
adc eax, esp
mov eax, dword [r9]
test bl, 0xf7
xor eax, ebx
jmp 0x14084ad1a
sub eax, 0x65a85685
cmp r8b, 0xbd
neg eax
sub eax, 0x33f543fe
clc
rol eax, 3
push rbx
cmp edi, 0x11ff3ee3
xor dword [rsp], eax
sbb bx, 0x5ab9
bsf bx, r10w
test r13, 0x11283f51
pop rbx
cmp dl, r14b
cmc
clc
movsxd rax, eax
jmp 0x1407ed532
push rdi
ret
Function at 0x1400475e8
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov r8, rdx
mov dword [rax - 0x10], ebx
mov qword [rax - 0x18], rdx
lea r9, str.sqlite_master
lea rdx, str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
mov rsi, rcx
call fcn.14004bc2c
test ebx, ebx
jne 0x14004763b
lea r8, str.sqlite_master
lea rdx, str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov r9, rdi
mov rcx, rsi
call fcn.14004bc2c
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140083388
Capabilities:
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
mov eax, 0x20020
call fcn.1400c3750
sub rsp, rax
movsxd rdi, ecx
mov rcx, qword [sym.imp.msvcrt.dll__iob]
xor r13d, r13d
add rcx, 0x30
mov rbp, rdx
mov ebx, r13d
call qword [sym.imp.msvcrt.dll__fileno]
mov esi, 0x40000
mov ecx, eax
mov edx, esi
call qword [sym.imp.msvcrt.dll__setmode]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
mov dword [0x140124300], eax
call qword [sym.imp.msvcrt.dll__fileno]
mov edx, esi
mov ecx, eax
call qword [sym.imp.msvcrt.dll__setmode]
mov dword [0x140124308], eax
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ecx, 0xfde9
mov dword [0x140124304], eax
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rcx, str.mimikatz_2.2.0_x64__oe.eo_
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea edx, [r13 + 1]
lea rcx, [0x140083590]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, str._n__..___mimikatz_2.2.0__x64__18362_Feb_29_2020_11:13:36_n_.__.___A_La_Vie__A_LAmour_____oe.eo__n_________Benjamin_DELPY__gentilkiwi____benjamin_gentilkiwi.com___n______________http:__blog.gentilkiwi.com_mimikatz_n__v________Vincent_LE_TOUX_______________vincent.letoux_gmail.com___n____________http:__pingcastle.com___http:__mysmartlogon.com_____n
call fcn.14000a838
lea ecx, [r13 + 1]
call fcn.1400835a4
lea esi, [r13 + 1]
cmp rsi, rdi
jge 0x14008348c
cmp ebx, 0x40000015
je 0x140083517
mov rdx, qword [rbp + rsi*8]
lea rcx, str._nmimikatz_commandline____s_n
call fcn.14000a838
mov rcx, qword [rbp + rsi*8]
call fcn.1400836a4
inc rsi
cmp rsi, rdi
mov ebx, eax
jl 0x140083450
cmp eax, 0x40000015
je 0x140083517
lea rcx, str._nmimikatz_
call fcn.14000a838
mov rcx, qword [sym.imp.msvcrt.dll__iob]
call qword [sym.imp.msvcrt.dll_fflush]
mov r8, qword [sym.imp.msvcrt.dll__iob]
lea rcx, [rsp + 0x20]
mov edx, 0xffff
call qword [sym.imp.msvcrt.dll_fgetws]
cmp rax, r13
je 0x14008350b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
je 0x14008350b
cmp word [rsp + 0x20], 0xa
je 0x14008350b
cmp word [rsp + rcx*2 + 0x1e], 0xa
jne 0x1400834ee
mov word [rsp + rcx*2 + 0x1e], r13w
lea rdx, [rsp + 0x20]
lea rcx, [0x1400e6fb8]
call fcn.14000a980
lea rcx, [rsp + 0x20]
call fcn.1400836a4
mov ebx, eax
cmp ebx, 0x40000015
jne 0x14008348c
call fcn.140083520
int3

Function at 0x140083520
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call fcn.1400835a4
lea rcx, [0x140083590]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x30
call qword [sym.imp.msvcrt.dll__fileno]
mov edx, dword [0x140124300]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__setmode]
mov rcx, qword [sym.imp.msvcrt.dll__iob]
add rcx, 0x60
call qword [sym.imp.msvcrt.dll__fileno]
mov edx, dword [0x140124308]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__setmode]
mov ecx, dword [0x140124304]
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov dword [0x140010004], r8d
test edx, edx
jle 0x140001224
mov r9d, edx
mov r10d, edx
lea rax, [r10 + rcx]
dec rax
lea rdx, [0x140010004]
cmp rax, rdx
jb 0x14000107d
lea rax, [0x140010007]
cmp rcx, rax
ja 0x14000107d
xor edi, edi
nop dword [rax + rax]
imul esi, dword [0x140010004], 0x41c64e6d
add esi, 0x3039
mov eax, esi
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rdi]
mov dword [0x140010004], esi
xor dl, r8b
mov byte [rcx + rdi], dl
inc rdi
cmp r10, rdi
jne 0x140001040
jmp 0x140001224
cmp r9d, 8
jae 0x14000108b
mov edi, r8d
jmp 0x1400011de
mov r11, r10
shr r11, 3
xor esi, esi
mov edi, r8d
nop word [rax + rax]
imul eax, edi, 0x41c64e6d
add eax, 0x3039
imul edi, eax, 0x41c64e6d
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8]
xor dl, r8b
mov byte [rcx + rsi*8], dl
add edi, 0x3039
mov eax, edi
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 1]
imul eax, edi, 0x41c64e6d
xor dl, r8b
mov byte [rcx + rsi*8 + 1], dl
add eax, 0x3039
imul edi, eax, 0x41c64e6d
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 2]
xor dl, r8b
mov byte [rcx + rsi*8 + 2], dl
add edi, 0x3039
mov eax, edi
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 3]
imul eax, edi, 0x41c64e6d
xor dl, r8b
mov byte [rcx + rsi*8 + 3], dl
add eax, 0x3039
imul edi, eax, 0x41c64e6d
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 4]
xor dl, r8b
mov byte [rcx + rsi*8 + 4], dl
add edi, 0x3039
mov eax, edi
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 5]
imul eax, edi, 0x41c64e6d
xor dl, r8b
mov byte [rcx + rsi*8 + 5], dl
add eax, 0x3039
imul edi, eax, 0x41c64e6d
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 6]
xor dl, r8b
mov byte [rcx + rsi*8 + 6], dl
add edi, 0x3039
mov eax, edi
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 7]
xor dl, r8b
mov byte [rcx + rsi*8 + 7], dl
inc rsi
cmp r11, rsi
jne 0x1400010a0
mov esi, r10d
and esi, 0xfffffff8
cmp rsi, r10
jae 0x14000121e
nop dword [rax]
imul edi, edi, 0x41c64e6d
add edi, 0x3039
mov eax, edi
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi]
xor dl, r8b
mov byte [rcx + rsi], dl
inc rsi
cmp r10, rsi
jne 0x1400011f0
mov dword [0x140010004], edi
pop rdi
pop rsi
ret
Function at 0x140001250
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r11d, dword [section..data]
mov r14d, dword [0x140010008]
mov ebp, r11d
sub ebp, r14d
mov r8d, dword [0x14001000c]
add ebp, r8d
lea r9d, [rdx - 1]
mov dword [0x140010004], ebp
test r9d, r9d
jle 0x1400014a7
movsxd r10, edx
lea rax, [r10 + rcx]
add rax, 0xfffffffffffffffe
lea rdx, [0x140010004]
cmp rax, rdx
jb 0x1400012fd
lea rax, [0x140010007]
cmp rcx, rax
ja 0x1400012fd
sub r8d, r14d
add r8d, r11d
dec r10
xor ebp, ebp
nop word cs:[rax + rax]
imul eax, dword [0x140010004], 0x41c64e6d
add eax, 0x3039
movzx ebx, byte [rcx + rbp]
xor bl, r8b
mov dword [0x140010004], eax
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, bl
mov byte [rcx + rbp], dl
inc rbp
cmp r10, rbp
jne 0x1400012c0
jmp 0x1400014a7
dec r10
cmp r10, 8
jb 0x140001456
mov rdi, r10
shr rdi, 3
mov ebx, r8d
sub ebx, r14d
add ebx, r11d
xor esi, esi
nop dword [rax]
imul eax, ebp, 0x41c64e6d
add eax, 0x3039
imul ebp, eax, 0x41c64e6d
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8]
xor dl, bl
mov byte [rcx + rsi*8], dl
add ebp, 0x3039
mov eax, ebp
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 1]
imul eax, ebp, 0x41c64e6d
xor dl, bl
mov byte [rcx + rsi*8 + 1], dl
add eax, 0x3039
imul ebp, eax, 0x41c64e6d
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 2]
xor dl, bl
mov byte [rcx + rsi*8 + 2], dl
add ebp, 0x3039
mov eax, ebp
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 3]
imul eax, ebp, 0x41c64e6d
xor dl, bl
mov byte [rcx + rsi*8 + 3], dl
add eax, 0x3039
imul ebp, eax, 0x41c64e6d
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 4]
xor dl, bl
mov byte [rcx + rsi*8 + 4], dl
add ebp, 0x3039
mov eax, ebp
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 5]
imul eax, ebp, 0x41c64e6d
xor dl, bl
mov byte [rcx + rsi*8 + 5], dl
add eax, 0x3039
imul ebp, eax, 0x41c64e6d
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 6]
xor dl, bl
mov byte [rcx + rsi*8 + 6], dl
add ebp, 0x3039
mov eax, ebp
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
inc dl
xor dl, byte [rcx + rsi*8 + 7]
xor dl, bl
mov byte [rcx + rsi*8 + 7], dl
inc rsi
cmp rdi, rsi
jne 0x140001320
mov rsi, r10
and rsi, 0xfffffffffffffff8
cmp rsi, r10
jae 0x1400014a1
sub r8d, r14d
add r8d, r11d
nop dword [rax + rax]
imul ebp, ebp, 0x41c64e6d
add ebp, 0x3039
mov eax, ebp
shr eax, 0x10
and eax, 0x7fff
xor edx, edx
idiv r9d
movzx eax, byte [rcx + rsi]
xor al, r8b
inc dl
xor dl, al
mov byte [rcx + rsi], dl
inc rsi
cmp r10, rsi
jne 0x140001470
mov dword [0x140010004], ebp
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400052b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp byte [rcx], 0x43
jne 0x1400053e6
mov rsi, rcx
xor ecx, ecx
mov dl, 0x43
xor edi, edi
xor eax, eax
xor ebx, ebx
jmp 0x1400052de
inc edi
mov ebx, eax
mov eax, ecx
movzx edx, byte [rsi + rcx + 1]
inc rcx
cmp dl, 0x5c
je 0x1400052d0
movzx edx, dl
test edx, edx
jne 0x1400052d6
cmp edi, 7
jne 0x140005312
movsxd rax, ebx
cmp byte [rax + rsi - 1], 0x70
jne 0x1400053e6
mov ecx, 0x29
cmp byte [rax + rsi - 4], 0x54
je 0x1400053d2
jmp 0x1400053e6
cmp edi, 2
jne 0x1400053b0
cmp eax, 6
jl 0x1400053b0
mov ecx, eax
movd xmm0, dword [rcx + rsi - 4]
paddb xmm0, xmmword [0x14000d410]
movzx r8d, byte [rcx + rsi - 6]
movzx ecx, byte [rcx + rsi - 5]
add cl, 0xd0
movdqa xmm1, xmmword [str._n_n_n_n]
pmaxub xmm1, xmm0
pcmpeqb xmm1, xmm0
pcmpeqd xmm0, xmm0
pxor xmm0, xmm1
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movmskps edx, xmm0
mov eax, edx
shr al, 1
and al, 5
sub dl, al
mov eax, edx
and al, 0x33
shr dl, 2
and dl, 0x33
add dl, al
mov eax, edx
shr al, 4
add al, dl
and al, 0xf
cmp cl, 0xa
movzx eax, al
adc eax, 0
add r8b, 0xd0
xor ecx, ecx
cmp r8b, 0xa
sbb ecx, ecx
cmp eax, ecx
je 0x1400053b0
mov dword [0x140010880], 0x2a
mov ecx, 0x2a
call qword [0x140010a10]
cmp edi, 3
jne 0x1400053e6
movsxd rax, ebx
cmp byte [rax + rsi - 4], 0x75
jne 0x1400053e6
cmp byte [rax + rsi - 3], 0x73
jne 0x1400053e6
mov ecx, 0x2b
cmp byte [rax + rsi - 1], 0x72
jne 0x1400053e6
mov dword [0x140010880], ecx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [0x140010a10]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret