joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012bbd0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x140215954]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x14012bc00
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x14012bc72
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140222280]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x14012bcd0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x14012bcd0
cmp dword [rsp + 0x20], 0x100000
jge 0x14012bc93
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x140222280]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x14012bd10
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140215954]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x14012bd50
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140215954]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret
Function at 0x14012bfa0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x140215954]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x14012bffb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x14012bffb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x14012bffd
xor eax, eax
add rsp, 0x38
ret

Function at 0x14012c010
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140215954]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x14012c0a0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x140215954]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx]
add rsp, 0x38
ret

Function at 0x14012c460
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, DispGetIDsOfNames
xor edx, edx
mov rcx, qword [0x140222280]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetDim
xor edx, edx
mov rcx, qword [0x140222280]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], reloc.OLEAUT32.dll_SafeArrayGetDim
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x140215954]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x14012c660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
lea rbx, [rcx + 0x588]
lea rsi, [rcx + 0x1c58]
xor edi, edi
lea r14, [rcx + 0x1018]
lea r15, [rcx + 0x1038]
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rsi + 2]
mov r8d, edi
mov r10d, edi
shr rax, 4
and r8d, 1
shr r10d, 1
mov edx, r10d
mov ecx, r8d
add r8d, 2
neg ecx
and edx, 1
shr r10d, 1
shr rcx, 4
lea r9d, [rdx + r8*2]
and r10d, 1
and ecx, 0x7f
inc edi
lea r15, [r15 + 4]
xor rcx, rax
mov eax, edx
lea r14, [r14 + 4]
mov r11d, dword [rbx + rcx*4]
movzx ecx, word [rsi + r8*2]
neg eax
shr rax, 4
shr rcx, 4
and eax, 0x7f
xor rcx, rax
mov eax, r10d
add r11d, dword [rbx + rcx*4]
movzx ecx, word [rsi + r9*2]
neg eax
shr rax, 4
shr rcx, 4
and eax, 0x7f
xor rcx, rax
lea eax, [r10 + r9*2]
add r11d, dword [rbx + rcx*4]
movzx eax, word [rsi + rax*2]
mov edx, eax
shr rax, 4
mov ecx, dword [rbx + rax*4]
xor rdx, 0x7f0
add ecx, r11d
shr rdx, 4
mov dword [r14 - 4], ecx
mov ecx, dword [rbx + rdx*4]
add ecx, r11d
mov dword [r15 - 4], ecx
cmp edi, 8
jb 0x14012c6a0
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
pop r15
ret
Function at 0x14012ea00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, 0x100
xor ebx, ebx
mov r11d, r8d
or edx, r10d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
mov ecx, edx
shr ecx, 7
shr r8d, 8
mov eax, r10d
and ecx, 1
and eax, r11d
add edx, edx
neg ecx
add eax, r10d
shr rcx, 4
add r8d, eax
movzx r8d, word [rdi + r8*2]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
mov ecx, edx
add ebx, dword [r9 + r8*4]
xor ecx, r11d
not ecx
and r10d, ecx
cmp edx, 0x10000
jb 0x14012ea20
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x14012ff90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0
mov rbp, rcx
jne 0x14012ffbd
call fcn.14012c770
mov rcx, rbp
call fcn.14012c660
mov ecx, dword [rbp + 0xc4]
mov eax, dword [rbp + 0x48]
mov ebx, 1
dec eax
mov edx, ebx
lea r8, [rbp + 0x22d8]
shl edx, cl
lea r9, [rbp + 0x588]
lea rcx, [rbp + 0x6ad8]
mov dword [rbp + 0xaedc], eax
mov dword [rbp + 0x6ad8], eax
mov dword [rbp + 0xec], 0x40
call fcn.14012e670
mov ecx, dword [rbp + 0xc4]
lea r8, [rbp + 0x26d8]
shl ebx, cl
lea r9, [rbp + 0x588]
lea rcx, [rbp + 0xaedc]
mov edx, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14012e670

Function at 0x140130890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov rsi, rcx
xor r11d, r11d
mov r9d, r11d
mov r10d, r11d
add r11d, 2
shr r9d, 2
shr r10d, 1
lea rdi, [rdi + 8]
lea eax, [r9 + 2]
mov ecx, r10d
movzx edx, word [rsi + rax*2]
movzx eax, word [rsi + 2]
and ecx, 1
neg ecx
shr rdx, 4
shr rax, 4
shr rcx, 4
and ecx, 0x7f
xor rdx, rcx
mov ecx, r9d
mov r8d, dword [rbx + rdx*4]
neg ecx
shr rcx, 4
and ecx, 0x7f
xor rcx, rax
lea eax, [r10 + 4]
add r8d, dword [rbx + rcx*4]
movzx eax, word [rsi + rax*2]
add r8d, ebp
mov edx, eax
shr rax, 4
mov ecx, dword [rbx + rax*4]
xor rdx, 0x7f0
add ecx, r8d
shr rdx, 4
mov dword [rdi - 8], ecx
mov ecx, dword [rbx + rdx*4]
add ecx, r8d
mov dword [rdi - 4], ecx
cmp r11d, 8
jb 0x1401308b2
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x140132fc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov qword [rcx + 0x480], 0xffffffffffffffff
mov dword [rcx + 0x3c], SafeArrayAllocDescriptor
mov byte [rcx + 0x21], 1
mov dword [rcx + 0x5c], 4
lea r8, [rcx + 0x78]
mov qword [rcx + 0x40], rdx
mov word [rcx + 0x22], dx
mov qword [rcx + 0x28], rdx
nop
mov ecx, edx
mov eax, edx
inc edx
shr eax, 1
and ecx, 1
lea r8, [r8 + 4]
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x140132ff0
ret
Function at 0x14013e860
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, edx
mov r10, rcx
mov r8d, 0x80000000
test rcx, rcx
je 0x14013e8cf
mov qword [rsp], rbx
lea rbx, [0x1401e8b40]
test r10b, 1
je 0x14013e8c3
mov ecx, r11d
mov eax, r8d
mov edx, 0x80000000
and ecx, 0x1f
xor r8d, r8d
mov r9d, dword [rbx + rcx*4]
nop dword [rax + rax]
test r9d, edx
je 0x14013e8b0
lea ecx, [rdx - 1]
xor r8d, eax
test r9d, ecx
je 0x14013e8c3
shr edx, 1
test al, 1
je 0x14013e8bf
shr eax, 1
xor eax, 0xedb88320
jmp 0x14013e8a0
shr eax, 1
jmp 0x14013e8a0
inc r11d
sar r10, 1
jne 0x14013e880
mov rbx, qword [rsp]
mov eax, r8d
add rsp, 8
ret

Function at 0x140141400
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 0xf8]
mov rbp, rcx
call fcn.14015e510
mov rbx, rax
test rax, rax
jne 0x14014143d
lea r8, str.Encryption_needs_passphrase
or rdx, 0xffffffffffffffff
mov rcx, rbp
call fcn.140157280
lea eax, [rbx - 0x19]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_inet_addr
call fcn.14015e460
test eax, eax
je 0x140141470
lea r8, str.Cant_generate_random_number_for_encryption
or rdx, 0xffffffffffffffff
mov rcx, rbp
call fcn.140157280
mov eax, 0xffffffe2
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x70], rsi
or rax, 0xffffffffffffffff
mov qword [rsp + 0x78], r14
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x140141480
lea rcx, [rdi + 0x50]
mov r8, rax
mov rdx, rbx
call fcn.1401419c0
movzx eax, byte [rdi + 0x5d]
xor ebx, ebx
mov byte [rsp + 0x2b], al
lea r14d, [rbx + 0xc]
nop word [rax + rax]
movzx edx, byte [rsp + rbx + 0x20]
mov eax, dword [rdi + 0x58]
mov r8d, 1
or eax, 2
mov byte [rsp + 0x60], dl
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, dl
lea rdx, [rsp + 0x60]
mov byte [rsp + rbx + 0x30], cl
mov ecx, dword [rdi + 0x50]
not ecx
call fcn.14013e1c0
lea rdx, [rsp + 0x68]
mov r8d, 1
not eax
mov dword [rdi + 0x50], eax
movzx eax, al
add eax, dword [rdi + 0x54]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rdi + 0x54], ecx
mov ecx, dword [rdi + 0x58]
movzx eax, byte [rdi + 0x57]
not ecx
mov byte [rsp + 0x68], al
call fcn.14013e1c0
lea rbx, [rbx + 1]
not eax
mov dword [rdi + 0x58], eax
dec r14
jne 0x1401414b0
lea r8d, [r14 + 0xc]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140152fc0
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
test eax, eax
jne 0x140141552
add qword [rdi + 0xb0], 0xc
add qword [rdi + 0x18], 0xc
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
Function at 0x1401418f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x60]
mov rdi, r9
mov rsi, rdx
cmp r8, rax
mov rbx, rcx
cmovb eax, r8d
test eax, eax
je 0x1401419b6
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], r14
sub rsi, r9
mov r14d, eax
mov ebp, eax
nop word [rax + rax]
movzx edx, byte [rsi + rdi]
mov eax, dword [rbx + 8]
mov r8d, 1
or eax, 2
mov byte [rsp + 0x60], dl
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, dl
lea rdx, [rsp + 0x60]
mov byte [rdi], cl
mov ecx, dword [rbx]
not ecx
call fcn.14013e1c0
lea rdx, [rsp + 0x50]
mov r8d, 1
not eax
mov dword [rbx], eax
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
movzx eax, byte [rbx + 7]
not ecx
mov byte [rsp + 0x50], al
call fcn.14013e1c0
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
dec rbp
jne 0x140141930
mov rbp, qword [rsp + 0x40]
mov eax, r14d
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401419c0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov dword [rcx], 0x12345678
mov dword [rcx + 4], 0x23456789
mov dword [rcx + 8], 0x34567890
test r8, r8
je 0x140141a4c
mov ecx, dword [rbx]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x30]
not ecx
mov r8d, 1
mov byte [rsp + 0x30], al
call fcn.14013e1c0
lea rdx, [rsp + 0x40]
mov r8d, 1
not eax
mov dword [rbx], eax
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
movzx eax, byte [rbx + 7]
not ecx
mov byte [rsp + 0x40], al
call fcn.14013e1c0
lea rsi, [rsi + 1]
not eax
mov dword [rbx + 8], eax
dec rdi
jne 0x1401419f1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140145060
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x50]
mov rdi, r9
mov rsi, rdx
cmp r8, rax
mov rbx, rcx
cmovb eax, r8d
test eax, eax
je 0x140145105
mov qword [rsp + 0x30], rbp
sub rsi, r9
mov ebp, eax
mov eax, dword [rbx + 8]
lea rdx, [rsp + 0x50]
mov r8d, 1
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rsi + rdi]
mov byte [rdi], cl
mov byte [rsp + 0x50], cl
mov ecx, dword [rbx]
not ecx
call fcn.14013e1c0
lea rdx, [rsp + 0x40]
mov r8d, 1
not eax
mov dword [rbx], eax
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
movzx eax, byte [rbx + 7]
not ecx
mov byte [rsp + 0x40], al
call fcn.14013e1c0
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
dec rbp
jne 0x140145092
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140145120
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rsp + 0x70], 0xc
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
jae 0x140145158
mov rax, qword [rsp + 0x78]
mov byte [rax], 0xff
or eax, 0xffffffff
jmp 0x14014525c
mov dword [rcx], 0x12345678
mov dword [rcx + 4], 0x23456789
mov dword [rcx + 8], 0x34567890
test r8, r8
je 0x1401451cc
mov ecx, dword [rbx]
movzx eax, byte [rdi]
lea rdx, [rsp + 0x70]
not ecx
mov r8d, 1
mov byte [rsp + 0x70], al
call fcn.14013e1c0
lea rdx, [rsp + 0x20]
mov r8d, 1
not eax
mov dword [rbx], eax
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
movzx eax, byte [rbx + 7]
not ecx
mov byte [rsp + 0x20], al
call fcn.14013e1c0
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
dec rsi
jne 0x140145171
lea rax, [rsp + 0x28]
lea rdi, [rsp + 0x28]
mov esi, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
sub rbp, rax
nop
mov eax, dword [rbx + 8]
lea rdx, [rsp + 0x70]
mov r8d, 1
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rdi + rbp]
mov byte [rdi], cl
mov byte [rsp + 0x70], cl
mov ecx, dword [rbx]
not ecx
call fcn.14013e1c0
lea rdx, [rsp + 0x20]
mov r8d, 1
not eax
mov dword [rbx], eax
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
movzx eax, byte [rbx + 7]
not ecx
mov byte [rsp + 0x20], al
call fcn.14013e1c0
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
dec rsi
jne 0x1401451e0
movzx eax, byte [rsp + 0x33]
mov rcx, qword [rsp + 0x78]
mov byte [rcx], al
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401502c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push r15
sub rsp, 8
mov r14, rdx
mov r15, rcx
cmp r8, 5
jae 0x1401502df
xor eax, eax
add rsp, 8
pop r15
pop r14
ret
mov r9d, dword [rcx + 0x4e00]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbp
mov ebp, dword [rcx + 0x4e04]
mov qword [rsp + 0x30], rsi
mov rsi, qword [rcx + 0x4df8]
lea rbx, [r8 - 4]
mov qword [rsp + 0x38], rdi
xor r10d, r10d
mov qword [rsp], r12
lea r12, [0x140000000]
add rbx, rdx
nop dword [rax]
lea rax, [r10 + r14]
cmp rax, rbx
jae 0x140150343
nop dword [rax]
movzx ecx, byte [rax]
and cl, 0xfe
cmp cl, 0xe8
je 0x140150343
inc rax
cmp rax, rbx
jb 0x140150330
mov r10, rax
sub r10, r14
cmp rax, rbx
jae 0x140150467
mov rcx, r10
sub rcx, rsi
cmp rcx, 3
jbe 0x140150380
xor r9d, r9d
movzx edx, byte [rax + 4]
mov rsi, r10
lea ecx, [rdx - 1]
cmp cl, 0xfd
ja 0x1401503c6
and r9d, 3
add r9d, r9d
or r9d, 1
inc r10
jmp 0x140150320
dec ecx
shl r9d, cl
and r9d, 7
je 0x140150361
movzx ecx, byte [r9 + r12 + 0x1ea798]
mov rdx, rax
sub rdx, rcx
cmp byte [r9 + r12 + 0x1ea790], 0
movzx ecx, byte [rdx + 4]
je 0x1401503b0
inc cl
test cl, 0xfe
jne 0x140150361
and r9d, 3
mov rsi, r10
add r9d, r9d
or r9d, 1
inc r10
jmp 0x140150320
movzx ecx, byte [rax + 3]
movzx r8d, dl
shl r8d, 8
or r8d, ecx
movzx ecx, byte [rax + 2]
shl r8d, 8
or r8d, ecx
movzx ecx, byte [rax + 1]
shl r8d, 8
or r8d, ecx
sub r8d, r10d
sub r8d, ebp
test r9d, r9d
je 0x140150438
movzx r11d, byte [r9 + r12 + 0x1ea798]
shl r11d, 3
neg r11d
nop word [rax + rax]
lea ecx, [r11 + 0x18]
mov edx, r8d
shr edx, cl
inc dl
test dl, 0xfe
jne 0x140150438
lea ecx, [r11 + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor r8d, edx
sub r8d, r10d
sub r8d, ebp
jmp 0x140150410
mov ecx, r8d
mov byte [rax + 1], r8b
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [rax + 4], cl
mov ecx, r8d
shr ecx, 0x10
mov byte [rax + 3], cl
mov ecx, r8d
shr ecx, 8
add r10, 5
mov byte [rax + 2], cl
jmp 0x140150320
add dword [r15 + 0x4e04], r10d
mov r12, qword [rsp]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov qword [r15 + 0x4df8], rsi
mov rsi, qword [rsp + 0x30]
mov dword [r15 + 0x4e00], r9d
mov rax, r10
add rsp, 8
pop r15
pop r14
ret

Function at 0x140156dc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, 0x24
mov rbx, rdx
mov edi, ecx
lea ecx, [r8 - 0x22]
lea rdx, str.Fatal_Internal_Error_in_libarchive:
call fcn.14015df20
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140156df0
mov rdx, rbx
mov ecx, 2
call fcn.14015df20
mov r8d, 1
lea rdx, [0x1401ebc14]
lea ecx, [r8 + 1]
call fcn.14015df20
mov ecx, edi
call qword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x140158780
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r8, qword [rdx + 8]
mov rdx, qword [rdx]
call fcn.140158280
test rax, rax
jne 0x1401587a8
lea rdx, [0x1401e10b0]
lea ecx, [rax + 1]
add rsp, 0x28
jmp fcn.140156dc0
add rsp, 0x28
ret
Function at 0x14015d820
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov eax, 0xffffffff
mov rbx, r8
mov rdi, rdx
cmp r8, rax
cmova rbx, rax
test ecx, ecx
jns 0x14015d85b
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 9
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
jne 0x14015d86d
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14015d8f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x14015d8bc
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], reloc.WS2_32.dll_inet_addr
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp eax, 0x6d
je 0x14015d860
cmp eax, 5
jne 0x14015d8e1
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 9
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.14015d460
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14015df20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov eax, 0xffffffff
mov rbx, r8
mov rdi, rdx
cmp r8, rax
cmova rbx, rax
test ecx, ecx
jns 0x14015df5b
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 9
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14015dfbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14015dfa8
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 9
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.14015d460
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14015e460
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14015e4c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14015e4f1
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14015e4f1
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x14015e4f1
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, 0xffffffe7
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret