joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5acc40
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5acce7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5acd8a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5acce7
cmp r9, 0
je 0x5ace43
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5acda0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5fb180
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5fb255
movdqa xmm0, xmmword [0x0073df70]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5fb1c1
movdqa xmm0, xmmword [0x0073df80]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5fb2d7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5fb2ab
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0073dbd8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0073df90]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x6080c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60825b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x6080e1
inc rcx
cmp rbx, rcx
jle 0x608251
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x6080de
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call sym.net.SplitHostPort
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x008da4a8]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call sym.vendor_golang.org_x_net_idna._Profile_.process
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x608245
test rdx, rdx
je 0x60823a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0096e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x608209
xor eax, eax
lea rbx, [0x0073dbb4]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006c2137]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x608230
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0073c5e0]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.vendor_golang.org_x_net_http_httpguts.PunycodeHostPort
Function at 0x649420
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x649522
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call sym.net_url.splitHostPort
test rdi, rdi
jne 0x649473
mov rbx, qword [0x008e7430]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0067ad40]
call sym.runtime.mapaccess1_faststr
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call sym.net_http.idnaASCIIFromURL
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0096e668]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x6494f5
xor eax, eax
lea rbx, [0x0073dbb4]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006c2137]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x64951c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0073c5e0]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net_http.canonicalAddr
Function at 0x1400012a0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebp, ebp
lea r14, str.epicgameslauncher.exe
lea r13, [0x140005588]
lea r15, str.TaskKill__F__IM
lea r12, [0x1400134a8]
nop dword [rax]
mov rdx, qword [r14]
lea rcx, [rsp + 0x38]
call fcn.1400027b0
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x10
jb 0x140001385
lea rax, [r8 + 0x10]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x140001328
mov rdi, qword [rbx]
cmp r13, rdi
jbe 0x140001348
lea rax, [rdi + r8]
cmp r15, rax
ja 0x140001348
cmp rdi, r15
ja 0x140001340
mov rsi, rbp
jmp 0x14000134d
mov rsi, rdi
sub rsi, r15
jmp 0x14000134d
mov esi, 0x10
lea rcx, [rdi + 0x10]
inc r8
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rsi]
mov r8d, 0x10
sub r8, rsi
lea rdx, [r15 + 0x10]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14000139e
mov qword [rsp + 0x28], 0x10
mov edx, 0x10
mov rcx, rbx
call fcn.140002e70
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14000140d
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001408
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001498
call fcn.14000305c
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000145d
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001458
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000149f
call fcn.14000305c
add r14, 8
cmp r14, r12
jne 0x1400012f0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003000
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140011285
Capabilities:
Terminate process

Disassembly:
jmp 0x140014a20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011334
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015d70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015d90
xor al, al
jmp 0x140015e11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015da3
xor al, al
jmp 0x140015e11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140015dcd
xor al, al
jmp 0x140015e11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015de1
xor al, al
jmp 0x140015e11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015df3
xor al, al
jmp 0x140015e11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140015e0f
xor al, al
jmp 0x140015e11
mov al, 1
add rsp, 0x38
ret
Function at 0x140013c50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001149c
movzx eax, al
test eax, eax
jne 0x140013c70
mov ecx, 7
call fcn.1400113e8
nop
mov byte [rsp + 0x20], 0
call fcn.1400113fc
mov byte [rsp + 0x21], al
cmp dword [0x14001f8c8], 1
jne 0x140013c94
mov ecx, 7
call fcn.1400113e8
nop
jmp 0x140013cec
cmp dword [0x14001f8c8], 0
jne 0x140013ce7
mov dword [0x14001f8c8], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.140011226
test eax, eax
je 0x140013cc8
mov eax, 0xff
jmp 0x140013df1
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.1400113f2
mov dword [0x14001f8c8], 2
jmp 0x140013cec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400113d4
call fcn.140011361
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013d49
mov rcx, qword [rsp + 0x30]
call fcn.1400111d1
movzx eax, al
test eax, eax
je 0x140013d49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.140011398
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140013d7d
mov rcx, qword [rsp + 0x38]
call fcn.1400111d1
movzx eax, al
test eax, eax
je 0x140013d7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001144c
nop
call fcn.140013ea0
mov dword [rsp + 0x28], eax
call fcn.140011334
movzx eax, al
test eax, eax
jne 0x140013d9c
mov ecx, dword [rsp + 0x28]
call fcn.140011078
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140013dab
call fcn.14001145b
nop
xor edx, edx
mov cl, 1
call fcn.1400111b8
mov eax, dword [rsp + 0x28]
jmp 0x140013df1
add rsp, 0x68
ret
Function at 0x142930058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1429301df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142930089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14293006f
add dl, dl
jne 0x142930096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429300f6
xor eax, eax
add dl, dl
jne 0x1429300a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1429301ad
add dl, dl
jne 0x1429300b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429300c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429300d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1429300dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1429300ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14293007e
mov eax, 1
add dl, dl
jne 0x142930106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142930113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1429300fb
sub eax, ebx
mov ebx, 1
jne 0x14293014c
mov ecx, 1
add dl, dl
jne 0x14293012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14293013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142930123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14293007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142930168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142930175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14293015d
cmp eax, 0x7d00
jae 0x14293019b
cmp eax, 0x500
jb 0x142930196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14293007e
cmp eax, 0x7f
ja 0x14293019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14293007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1429301d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14293007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18009208c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor r8d, r8d
jmp 0x1801461d8
mov qword [rsp + 8], rbx
sub rbx, 0x7baa77c8
push rdi
bsr bx, r11w
xor bl, 0x1f
sub rsp, 0x40
mov rbx, rdx
or rdi, r15
shr dil, cl
mov rdi, rcx
stc
test rcx, rcx
jne 0x180146228
call fcn.18012706c
mov dword [rax], 0x16
jmp 0x180146217
call fcn.180122a31
xor eax, eax
jmp 0x180146223
jmp 0x1801462eb
test rbx, rbx
jmp 0x180146230
je 0x180146207
cmp rdi, rbx
jae 0x18014621c
mov rdx, r8
movzx ecx, cx
lea rcx, [rsp + 0x20]
jmp 0x18014624f
call fcn.18012875a
mov rcx, qword [rsp + 0x30]
bts rdx, rcx
or dx, 0x48e6
lea rdx, [rbx - 1]
stc
cmp al, spl
cmp dword [rcx + 8], 0
jmp 0x180146273
je 0x1801462cc
dec rdx
cmp r11b, 0xb0
cmp bl, r10b
cmp rdi, rdx
ja 0x1801462a4
movzx eax, byte [rdx]
clc
cmp bpl, 0xdf
test byte [rax + rcx + 0x19], 4
jmp 0x18014629e
jne 0x180146279
mov rcx, rbx
test r9d, r11d
sub rcx, rdx
bt rdx, r8
movzx rdx, di
mov rdx, rbx
clc
cmp r11w, cx
jmp 0x1801462c2
and ecx, 1
sub rdx, rcx
dec rdx
stc
cmp byte [rsp + 0x38], 0
jmp 0x1801462d6
je 0x1801462e8
mov rcx, qword [rsp + 0x20]
and dword [rcx + 0x3a8], 0xfffffffd
mov rax, rdx
mov rbx, qword [rsp + 0x50]
bts rdi, rdx
bsr di, r14w
cmc
add rsp, 0x40
movzx rdi, r12w
mov dil, 0x34
pop rdi
jmp 0x18014630b
ret

Function at 0x18009511c
Capabilities:
Parse pe header

Disassembly:
jmp 0x180129fdc
sub r8d, r8d
xchg dh, dl
setno dl
mov edx, 0x65664820
lea edx, [r8 + 2]
jmp 0x1800933f9

Function at 0x18009a057
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x180096154
mov eax, 0x100
jmp 0x18009b1d5
mov rax, rdx
sar r8, cl
mov r9, rdx
sal r8b, 0xef
mov r8d, dword [rcx + 0x30]
stc
cmp r15b, 0x73
test bl, sil
test r8d, r8d
jmp 0x180095028
je 0x18009aefc
lea eax, [r8 - 1]
movzx r8w, al
not r8b
movzx r8d, r10w
and r8w, 0xf
cmc
test r9b, 0x51
clc
shr r10, 4
add r8w, 0x30
mov dword [rcx + 0x30], eax
cmp r8w, 0x39
jmp 0x18009acf0
jg 0x1800923da
test r10, r10
jmp 0x1800923d4
mov dword [rcx + 0x48], edx
jmp 0x180096f20
mov r9, rax
mov rax, qword [rcx + 0x450]
shr rax, 2
rcl r8w, cl
lea rax, [rax - 1]
ror dx, cl
lea rdx, [r9 + rax*2]
mov qword [rcx + 0x40], rdx
add rax, 0x7cce44ae
jmp 0x180091d58
mov qword [rcx + 0x40], rax
ret
jmp 0x180091d65
mov r10, rdx
cmp r10b, r11b
test rax, rax
jmp 0x180090068
lea r9, [rcx + 0x50]
add r11b, 0x53
shrd rax, r13, 0x3e
rcl r10d, cl
mov r11b, r8b
sbb al, 0x46
mov rax, qword [r9 + 0x408]
sbb r10d, 0x42461556
jmp 0x180098121
jbe 0x18009ad2f
mov al, r11b
test dh, 0x2a
stc
xor al, 1
cmp r13w, dx
test eax, r8d
shl al, 5
stc
test r11, 0x3eb5319e
cmc
add al, 7
test r15b, cl
clc
add al, r8b
shl r8b, 0x2c
sub r8b, 0x8d
bts r8, rsp
movzx r8d, al
sar rax, 0xd8
mov word [r9], r8w
add qword [rcx + 0x40], 0xfffffffffffffffe
mov rax, qword [rcx + 0x40]
movzx r9w, dil
xchg r9b, r9b
movsx r9, r9w
mov r9, rax
jmp 0x1800980e4
sub rdx, rax
cmc
cmp cl, 0xb
add rax, 2
sar rdx, 1
jmp 0x18009528a
jmp 0x180096166
Function at 0x18009a150
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
shr r8d, cl
sub ecx, ecx
lea r8d, [rdx + 1]
jmp 0x18009bb00
jmp 0x180129fdc
mov dword [rsp + 0x18], r8d
test dl, 0x69
cmp r13b, 0x90
mov dword [rsp + 0x10], edx
stc
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp r9b, r10b
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
ror bh, cl
movzx rbx, ax
mov ebx, ecx
test r8d, r8d
jmp 0x18012a015
jne 0x18012a0b4
xor ecx, ecx
jmp 0x18012a022
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x18012a030
je 0x18012a0b4
mov ecx, 0x5a4d
test r14d, 0x7a9e174d
stc
cmp r12d, 0x294e5069
cmp word [rax], cx
jmp 0x18012a052
jne 0x18012a0b4
movsxd rcx, dword [rax + 0x3c]
cmc
test rax, rbp
lea rcx, [rcx + rax]
cmc
cmp r15b, 0x62
cmp dword [rcx], 0x4550
jne 0x18012a0b4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18012a0b4
cmp dword [rcx + 0x84], 0xe
jmp 0x18012a090
jbe 0x18012a0b4
cmp dword [rcx + 0xf8], 0
jmp 0x18012a0a2
je 0x18012a0b4
mov ecx, ebx
jmp 0x18012a0af
call fcn.18012a214
mov byte [rbp + 0x28], 0
bswap r8w
xchg r8b, al
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lahf
lea rax, [rbp + 0x20]
not dx
movsx dx, ah
mov dx, si
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
cbw
bswap r8d
mov eax, 2
cmovle edx, ebx
movzx r9, di
movzx edx, r8w
mov dword [rbp - 0x2c], eax
movzx cx, ch
cdq
bswap r9w
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
movsx r8w, r9b
jmp 0x18012a118
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
movzx rcx, r14w
lea rcx, [rbp - 0x30]
call fcn.180129dec
nop
stc
cmc
cmp dil, r13b
cmp dword [rbp + 0x20], 0
jmp 0x18012a13c
je 0x18012a164
mov rbx, qword [rsp + 0x60]
shl bpl, cl
xor bp, sp
add rsp, 0x50
mov bp, 0x11e2
setno bpl
movsx ebp, r12w
pop rbp
jmp 0x18012a163
ret
mov ecx, ebx
jmp 0x18012a16b
call fcn.18012a176
int3

Function at 0x18009a570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x18009aa28
jmp fcn.18011ab9b
Function at 0x1800a8a4a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x40
and ax, 0x1e04
cdq
mov rax, qword [0x180086020]
xor rax, rsp
movsx rdx, r9w
cmp r14b, bl
bts bx, bp
mov qword [rsp + 0x38], rax
stc
mov rdx, qword [0x180088f28]
add r8w, cx
bsf r8, rbp
mov rbx, rcx
mov r8, qword [rcx]
btr eax, 0x64
lahf
mov qword [rsp + 0x30], r8
movsx eax, si
movsx ax, dl
mov rax, 0x26e146b0
mov rax, qword [rdx]
cmp rax, rdx
jmp 0x1800a8aa8
je 0x1800a8adf
nop
cmp spl, r8b
cmp qword [rax + 0x10], r8
je 0x1800a8b26
cmp qword [rax + 0x18], r8
jmp 0x1800a8ac5
je 0x1800a8b1a
mov rax, qword [rax]
test bl, r12b
cmp rax, rdx
jmp 0x1800a8ad9
jne 0x1800a8ab2
mov eax, 2
movsx ecx, r12w
sub ch, 0x96
test eax, eax
not al
movzx rcx, cx
sete al
jmp 0x1800a8afb
mov rcx, qword [rsp + 0x38]
cmp bl, r10b
xor rcx, rsp
call fcn.1801152b0
add rsp, 0x40
movsxd rbx, r14d
setbe bl
bswap bx
pop rbx
ret
xor eax, eax
jmp 0x1800a8b21
jmp 0x1800a8aeb
lea r8, [rsp + 0x30]
movzx edx, r14w
cqo
lea rdx, [rsp + 0x20]
call fcn.1800de15d
mov rcx, qword [rax]
bsf rax, r15
ror ax, cl
bsr ax, r15w
mov rax, qword [rcx + 0x18]
cmc
shld rcx, rsi, 0x7f
movsx cx, bpl
mov qword [rbx], rax
or cl, r14b
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801152b0
add rsp, 0x40
movzx bx, r15b
movsx bx, r12b
movzx rbx, sp
pop rbx
jmp 0x1800a8b86
ret
Function at 0x1800daeae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bts cx, cx
mov bh, 0xa4
mov qword [rsp + 0x10], rsi
push rdi
rcl dil, 0x8c
movsxd rcx, r9d
sub rsp, 0x40
movsx cx, bpl
mov rbx, qword [0x180089790]
xor esi, esi
movzx rcx, dx
shrd edi, ecx, 0xe2
adc eax, esi
mov rdi, rdx
shrd cx, r9w, 0x8a
mov dword [rsp + 0x28], esi
setl cl
mov rcx, rbx
cmovge ax, bp
ror ax, cl
mov rax, qword [rbx + 8]
clc
cmp r8, 0x5222a6a
mov qword [rsp + 0x20], rax
cmp r10, r9
jmp 0x1800daf16
cmp byte [rax + 0x19], sil
jmp 0x1800daf1f
jne 0x1800daf7b
movzx r8d, byte [rdx]
cmp sp, r9w
mov qword [rsp + 0x20], rax
cmp byte [rax + 0x20], r8b
jae 0x1800daf53
mov rax, qword [rax + 0x10]
jmp 0x1800daf45
mov dword [rsp + 0x28], esi
jmp 0x1800daf4e
jmp 0x1800daf6c
mov rcx, rax
test ebp, 0x652631f9
mov dword [rsp + 0x28], 1
clc
mov rax, qword [rax]
clc
test bh, 0xe6
cmp byte [rax + 0x19], sil
jmp 0x1800daf75
je 0x1800daf2d
cmp byte [rcx + 0x19], sil
jmp 0x1800daf84
jne 0x1800daf9b
movzx eax, byte [rcx + 0x20]
cmp byte [rdx], al
jmp 0x1800daf95
jae 0x1800db04e
movabs rax, 0x3ffffffffffffff
cmp qword [0x180089798], rax
jmp 0x1800dafb1
je 0x1800db07e
mov ecx, 0x40
call fcn.1801152e0
mov r8, rax
lea rdx, [rsp + 0x20]
movzx eax, byte [rdi]
movsxd rcx, eax
movsx rcx, r12w
mov rcx, rsi
lea rcx, [0x180089790]
jmp 0x1800dafe2
mov byte [r8 + 0x20], al
jmp 0x1800dafeb
mov qword [r8 + 0x28], rsi
jmp 0x1800daff4
mov qword [r8 + 0x30], rsi
jmp 0x1800daffd
mov qword [r8 + 0x38], rsi
jmp 0x1800db006
movups xmm0, xmmword [rsp + 0x20]
jmp 0x1800db010
mov qword [r8], rbx
jmp 0x1800db018
mov qword [r8 + 8], rbx
jmp 0x1800db021
mov qword [r8 + 0x10], rbx
jmp 0x1800db02a
movaps xmmword [rsp + 0x20], xmm0
jmp 0x1800db034
mov word [r8 + 0x18], si
jmp 0x1800db03e
call fcn.1800df256
mov rcx, rax
xor bx, si
and al, spl
shr ah, cl
mov rbx, qword [rsp + 0x50]
cmc
bt di, r14w
cmp sil, 0x89
lea rax, [rcx + 0x28]
btc di, bx
ror rsi, 0x89
rcl sil, 0x5b
mov rsi, qword [rsp + 0x58]
cmc
add rsp, 0x40
pop rdi
jmp 0x1800db07d
ret
call fcn.1800a7231
jmp 0x180028d46