joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008cb04
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rsi, r8
mov rdi, rcx
mov rbx, qword [rbp + 0x30]
and qword [rbx], 0
cmp edx, 8
je 0x14008cc85
cmp edx, 0x21
je 0x14008cc7a
cmp edx, 0x102
jne 0x14008cc98
or r8d, 0xffffffff
lea rdx, str.__:_____
lea rcx, [rbp - 0x38]
call fcn.1400e6fc8
nop
xor r8d, r8d
movzx edx, si
lea rcx, [rbp - 0x38]
call fcn.1400e7774
lea rbx, vtable.micro::utils::QString.0
test eax, eax
jns 0x14008cc6b
cmp esi, 0x1b
je 0x14008cb8c
cmp esi, 9
jne 0x14008cb9d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14008cc6b
cmp esi, 0xd
jne 0x14008cc55
mov qword [rbp - 0x28], rbx
and qword [rbp - 0x20], 0
mov rax, qword [rdi]
lea rdx, [rbp - 0x28]
mov rcx, rdi
call qword [rax + 0x348]
cmp qword [rbp - 0x20], 0
je 0x14008cbd1
lea rcx, [rbp - 0x28]
call fcn.1400e720c
jmp 0x14008cbd5
lea rax, [rbp - 0x28]
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400e7b9c
mov rax, qword [rbp - 0x30]
test rax, rax
je 0x14008cc46
cmp dword [rax - 8], 0
je 0x14008cc46
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [rbp - 0x18], rbx
and qword [rbp - 0x10], 0
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x18]
call fcn.1400e7b9c
mov eax, dword [rdi + 0x48]
mov dword [rbp - 8], eax
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x14008cc38
lea r9, [rbp - 0x18]
xor r8d, r8d
mov edx, 0x52c
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov qword [rbp - 0x18], rbx
lea rcx, [rbp - 0x18]
call fcn.1400e712c
nop
mov qword [rbp - 0x28], rbx
lea rcx, [rbp - 0x28]
call fcn.1400e712c
jmp 0x14008cc6b
lea rbx, vtable.micro::utils::QString.0
mov qword [rbp - 0x38], rbx
lea rcx, [rbp - 0x38]
call fcn.1400e712c
jmp 0x14008cc98
mov qword [rbp - 0x38], rbx
lea rcx, [rbp - 0x38]
call fcn.1400e712c
jmp 0x14008cc81
mov qword [rbx], 1
mov al, 1
jmp 0x14008cc9a
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [rbx], 1
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14008f498
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edi, 0x3ec
mov rax, rdx
mov rbx, rcx
cmp rdx, rdi
lea edx, [rdi - 1]
jne 0x14008f539
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 8]
mov edx, edi
call qword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
lea rcx, [rbp + 0x18]
mov qword [rbp + 0x18], rax
call qword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [rbx + 0xd4]
cmp edi, 0xffffffff
je 0x14008f51e
mov rcx, qword [rbx + 0x38]
mov r8b, 1
mov edx, edi
mov rax, qword [rcx]
call qword [rax + 0xe8]
mov edx, edi
mov rcx, rbx
call fcn.14008f8c0
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov rcx, qword [rcx + 8]
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x38]
or dword [rbx + 0xd4], 0xffffffff
lea rdx, [rbp + 0x18]
mov r9, qword [rcx]
xor r8d, r8d
call qword [r9 + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x14008f588
cmp rax, rdx
jne 0x14008f588
xor eax, eax
cmp byte [rcx + 0xad], al
jne 0x14008f554
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x14008f588
lea rcx, [rbp + 0x18]
mov qword [rbp + 0x18], rax
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rbx + 8]
lea rdx, [rbp + 0x18]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [rbp + 0x18]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], eax
mov eax, dword [rbp + 0x1c]
mov rcx, rbx
mov dword [rbp + 0x24], eax
call fcn.14008d7e8
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov al, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14008fec8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
or dword [rcx + 0xa8], 0xffffffff
mov rdi, rcx
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [rsp + 0x5c]
mov edx, dword [rsp + 0x58]
mov dword [rsp + 0x6c], ecx
mov rcx, qword [rdi - 0x38]
movzx ebp, ax
mov dword [rsp + 0x68], edx
lea rdx, [rsp + 0x68]
shr ebp, 0xf
mov r15d, 1
and bpl, r15b
call qword [sym.imp.USER32.dll_ScreenToClient]
or dword [rsp + 0x50], 0xffffffff
lea r14, [rdi - 0x40]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.14008f750
xor ebx, ebx
cmp byte [rdi + 0x98], bl
je 0x14008ffc9
test al, al
je 0x14008ffb2
mov esi, dword [rsp + 0x50]
xor r8d, r8d
mov rcx, r14
mov edx, esi
call fcn.14008d908
mov rcx, qword [rdi - 8]
mov edx, esi
mov r8, qword [rcx]
call qword [r8 + 0x138]
test al, al
je 0x14008ffb2
cmp esi, dword [rdi + 0xa4]
jne 0x14008ff82
mov eax, r15d
jmp 0x140090009
mov rcx, qword [rdi - 8]
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x128]
test al, al
jne 0x14008ff7a
mov rcx, qword [rdi - 8]
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x1d0]
test al, al
je 0x14008ff7a
mov dword [rdi + 0xa8], esi
xor eax, eax
jmp 0x140090009
test bpl, bpl
je 0x14008ff7a
mov rcx, qword [rdi - 8]
or edx, 0xffffffff
mov rax, qword [rcx]
call qword [rax + 0x1d0]
jmp 0x140090002
test al, al
je 0x14008fff1
mov esi, dword [rsp + 0x50]
xor r8d, r8d
mov rcx, r14
mov edx, esi
call fcn.14008d908
mov rcx, qword [rdi - 8]
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0x138]
test al, al
jne 0x14008ff95
mov rcx, qword [rdi - 8]
or edx, 0xffffffff
mov r8, qword [rcx]
call qword [r8 + 0x1d0]
test al, al
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140096540
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov eax, r8d
mov rbx, r9
mov r9, qword [rbp + 0x48]
mov r9, qword [r9]
shr eax, 0x18
mov rdi, rdx
mov rdx, qword [0x14017a1c8]
mov byte [rbp + 0x20], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp + 0x23], r8b
lea rcx, [rbp - 0x20]
mov byte [rbp + 0x21], al
mov eax, r8d
mov r8d, SafeArrayGetElement
shr eax, 8
mov dword [rsp + 0x20], r8d
mov byte [rbp + 0x22], al
call fcn.14009ee14
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
lea rdx, [rbp + 0x20]
lea r8d, [r9 + 4]
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov r8d, dword [rbp + 0x30]
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x1400965e1
mov r8d, dword [rbp + 0x40]
test r8d, r8d
je 0x1400965e1
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov r8d, dword [rbp - 0xc]
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
mov rdx, rdi
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
lea rcx, [rbp - 0x20]
call fcn.14009ef68
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x50
pop rbp
ret

Function at 0x14009668c
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov eax, r8d
mov rbx, r9
mov r9, qword [rbp + 0x48]
mov r9, qword [r9]
shr eax, 0x18
mov rdi, rdx
mov rdx, qword [0x14017a1c0]
mov byte [rbp + 0x20], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp + 0x23], r8b
lea rcx, [rbp - 0x20]
mov byte [rbp + 0x21], al
mov eax, r8d
mov r8d, reloc.SHELL32.dll_ILFindLastID
shr eax, 8
mov dword [rsp + 0x20], r8d
mov byte [rbp + 0x22], al
call fcn.14009ee14
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
lea rdx, [rbp + 0x20]
lea r8d, [r9 + 4]
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov r8d, dword [rbp + 0x30]
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x14009672d
mov r8d, dword [rbp + 0x40]
test r8d, r8d
je 0x14009672d
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov r8d, dword [rbp - 0xc]
mov rcx, qword [rbp - 0x20]
xor r9d, r9d
mov rdx, rdi
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
lea rcx, [rbp - 0x20]
call fcn.14009ef68
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x50
pop rbp
ret
Function at 0x140099304
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x380], rax
and dword [rcx + 0x220], 0
cmp dword [rcx + 0xd4c8], 0
mov rsi, rdx
mov rbx, rcx
jne 0x1400993b6
xor eax, eax
mov edi, dword [rbx + 0x20c]
mov edx, dword [rbx + 0x98]
imul r8d, eax, 0x3e8
test edi, edi
mov ecx, 0x3e8
cmove r8d, ecx
test edx, edx
jle 0x140099488
test eax, eax
je 0x140099376
cmp eax, edx
jle 0x140099488
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.msvcrt.dll__difftime64]
mov r8d, dword [rbx + 0x98]
mulsd xmm0, qword [0x140136130]
cvttsd2si eax, xmm0
cmp eax, r8d
jle 0x14009947e
mov eax, 0xfffffff7
mov dword [rbx + 0x220], eax
jmp 0x140099537
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov rdi, rax
movsxd rax, dword [rbx + 0xd4c8]
mov rcx, rax
add rcx, qword [rbx + 0xd4d0]
cmp rcx, rdi
jg 0x140099465
mov ecx, dword [0x14012b7e8]
movups xmm0, xmmword [0x14012b7d0]
mov al, byte [rbx + 0xd4cc]
and qword [rsp + 0x20], 0
mov dword [rbp + 0x378], ecx
xor r9d, r9d
movsd xmm1, qword [0x14012b7e0]
movups xmmword [rbp + 0x360], xmm0
lea rdx, [rbp + 0x360]
lea r8d, [r9 + 0x1b]
mov rcx, rbx
movsd qword [rbp + 0x370], xmm1
mov byte [rbp + 0x37a], al
call fcn.14009d87c
mov ecx, eax
test eax, eax
je 0x140099456
cmp eax, 0xffffffdb
je 0x140099456
lea rax, str.Unable_to_send_keepalive_message
mov dword [rbx + 0x220], 0xfffffff9
mov qword [rbx + 0x218], rax
mov eax, dword [rsp + 0x30]
jmp 0x14009946f
mov eax, dword [rbx + 0xd4c8]
mov qword [rbx + 0xd4d0], rdi
jmp 0x14009946d
sub eax, edi
add eax, dword [rbx + 0xd4d0]
xor ecx, ecx
test ecx, ecx
jns 0x140099344
mov eax, ecx
jmp 0x140099537
sub r8d, eax
mov ecx, 1
jmp 0x140099490
xor ecx, ecx
test r8d, r8d
setg cl
mov eax, 0x10624dd3
xor r10d, r10d
xor r11d, r11d
imul r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x30], edx
imul eax, edx, 0x3e8
sub r8d, eax
imul eax, r8d, 0x3e8
mov dword [rsp + 0x34], eax
test dil, 1
je 0x1400994e5
mov rax, qword [rbx + 0x200]
mov dword [rbp + 0x150], 1
lea r11, [rbp + 0x150]
mov qword [rbp + 0x158], rax
test dil, 2
je 0x140099504
mov rax, qword [rbx + 0x200]
mov dword [rsp + 0x40], 1
lea r10, [rsp + 0x40]
mov qword [rsp + 0x48], rax
neg ecx
lea rcx, [rsp + 0x30]
mov r8, r10
sbb rax, rax
xor r9d, r9d
mov rdx, r11
and rax, rcx
mov ecx, dword [rbx + 0x200]
inc ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x1400993a6
xor eax, eax
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140001010
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x490
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009edb0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x140188c40]
mov ebx, edx
mov rdi, rcx
test al, 1
jne 0x14009edea
or eax, 1
lea rcx, [0x140188c50]
mov dword [0x140188c40], eax
call fcn.1400f70b4
lea rcx, [0x140103454]
call fcn.1400010e8
mov rcx, qword [0x140188c58]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
sub ecx, eax
neg ecx
sbb eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14009efa0
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebp, dword [rsp + 0xb0]
mov r14, r9
mov r12d, r8d
mov ecx, ebp
mov r13, rdx
call qword [sym.imp.msvcrt.dll_malloc]
xor edi, edi
mov rbx, rax
test rax, rax
jne 0x14009efea
or eax, 0xffffffff
jmp 0x14009f108
mov r15d, SafeArrayGetElement
mov ecx, r15d
call qword [sym.imp.msvcrt.dll_malloc]
mov rcx, rbx
mov rsi, rax
test rax, rax
jne 0x14009f00c
call qword [sym.imp.msvcrt.dll_free]
jmp 0x14009efe2
mov r8, rbp
mov rdx, r14
call qword [sym.imp.msvcrt.dll_memcpy]
mov rdx, qword [0x14017a1b8]
lea rcx, [rsp + 0x48]
xor r9d, r9d
mov r8d, r15d
mov dword [rsp + 0x20], edi
call fcn.14009ee14
test eax, eax
jne 0x14009f069
mov r8d, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
js 0x14009f069
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.14009ef14
test eax, eax
jne 0x14009f069
mov ebp, edi
jmp 0x14009f06c
or ebp, 0xffffffff
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
test ebp, ebp
je 0x14009f07e
mov rcx, rsi
jmp 0x14009f004
mov rcx, r12
call qword [sym.imp.msvcrt.dll_malloc]
mov rbp, rax
test rax, rax
je 0x14009f079
mov r14d, dword [rsp + 0xb8]
test r14b, 2
je 0x14009f0b0
lea rax, [0x14012d650]
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
jmp 0x14009f0b3
mov rbx, rdi
mov r8, r12
mov rdx, r13
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x30], r14d
mov rcx, qword [rcx]
mov r9d, r15d
mov r8, rsi
mov rdx, rbx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.bcrypt.dll_BCryptVerifySignature]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
test ebx, ebx
setns dil
lea eax, [rdi - 1]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14009f810
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r12, qword [rsp + 0xa0]
xor ebx, ebx
lea rax, [r11 + 0x18]
mov dword [rsp + 0x48], ebx
mov qword [r11 - 0x38], rax
mov eax, dword [rcx + 0x1c]
mov dword [rsp + 0x38], ebx
mov qword [r11 - 0x48], rbx
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 0x10]
mov r14, r9
xor r9d, r9d
mov r15d, r8d
mov rsi, rcx
mov rcx, qword [rcx]
test r8d, r8d
mov qword [r11 - 0x58], rax
mov rdx, r14
mov r8d, r12d
je 0x14009f876
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
jmp 0x14009f87c
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov edi, eax
test eax, eax
js 0x14009f912
mov edi, dword [rsp + 0x90]
mov ecx, edi
call qword [sym.imp.msvcrt.dll_malloc]
mov rbp, rax
test rax, rax
je 0x14009f90b
mov rcx, qword [rsi]
mov dword [rsp + 0x48], ebx
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov eax, dword [rsi + 0x1c]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov rax, qword [rsi + 0x10]
xor r9d, r9d
mov r8d, r12d
mov rdx, r14
mov qword [rsp + 0x20], rax
test r15d, r15d
je 0x14009f8e0
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
jmp 0x14009f8e6
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov edi, eax
test eax, eax
js 0x14009f900
mov r8d, dword [rsp + 0x90]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
jmp 0x14009f910
mov edi, 0xc0000017
test edi, edi
lea r11, [rsp + 0x50]
setns bl
mov rbp, qword [r11 + 0x38]
lea eax, [rbx - 1]
mov rbx, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400a217c
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x140189c68]
lea rbx, [0x140189c70]
test al, 1
jne 0x1400a21b0
or eax, 1
mov rcx, rbx
mov dword [0x140189c68], eax
call fcn.1400f70b4
lea rcx, [0x140103470]
call fcn.1400010e8
mov ecx, dword [0x14018ac80]
test ecx, ecx
jne 0x1400a21dd
mov rcx, qword [0x140189c78]
lea rdx, [0x140189c80]
xor r9d, r9d
mov r8d, 0x1000
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov ecx, dword [0x14018ac80]
movsxd rax, ecx
inc ecx
mov eax, dword [rbx + rax*4 + 0x10]
and ecx, 0x800003ff
jge 0x1400a21f8
dec ecx
or ecx, 0xfffffc00
inc ecx
mov dword [0x14018ac80], ecx
add rsp, 0x20
pop rbx
ret
Function at 0x1400ab9d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, rcx
mov rcx, qword [rdx + 0x38]
xor ebp, ebp
mov r13, r8
mov rbx, rdx
test rcx, rcx
je 0x1400ab9fe
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbx + 0x38], rbp
mov dword [rbx + 0x30], ebp
cmp dword [r15 + 0x2150], ebp
je 0x1400aba74
mov r8d, dword [rbx]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r15 + 0x21c0]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
sub r8d, 0xc
add rdx, 0xc
mov qword [rsp + 0x20], rax
call fcn.1400bddbc
movsxd rdi, dword [rsp + 0x70]
mov rcx, rbx
lea edx, [rdi + 2]
call fcn.1400a2918
mov rcx, qword [rbx + 0x10]
mov rsi, qword [rsp + 0x78]
add rcx, 0xc
mov rdx, rsi
mov r8, rdi
call qword [sym.imp.msvcrt.dll_memcpy]
test rsi, rsi
je 0x1400aba6f
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
lea eax, [rdi + 0xc]
mov dword [rbx], eax
mov edx, dword [rbx]
mov rcx, rbx
add edx, 4
call fcn.1400a2918
add dword [rbx], 4
mov r12d, dword [rbx]
add r12d, 0xfffffff4
mov ecx, r12d
and ecx, 0x80000007
jge 0x1400aba9d
dec ecx
or ecx, 0xfffffff8
inc ecx
mov esi, 8
mov eax, esi
sub eax, ecx
sub esi, eax
movsxd rdi, esi
lea ebp, [rax + r12]
mov r14, rdi
cmp rdi, 0xc
jge 0x1400abace
call fcn.1400a217c
mov rcx, qword [rbx + 0x10]
mov byte [r14 + rcx], al
inc r14
cmp r14, 0xc
jl 0x1400abab8
mov r11, qword [rbx + 0x10]
lea eax, [rbp - 4]
xor r9d, r9d
lea r10, [r11 + 4]
movsxd r8, eax
add r10, rdi
test eax, eax
je 0x1400abb0d
movzx ecx, byte [r10]
movzx edx, r9b
mov eax, r9d
xor rdx, rcx
shr eax, 8
lea rcx, [0x14010b4c0]
mov r9d, dword [rcx + rdx*4]
inc r10
xor r9d, eax
dec r8
jne 0x1400abae6
movsxd r8, ebp
mov ecx, r9d
mov edx, r9d
shr ecx, 0x18
shr edx, 0x10
lea rax, [r8 + rdi]
mov byte [rax + r11], cl
mov rax, qword [rbx + 0x10]
lea rcx, [r8 + rdi]
mov byte [rcx + rax + 1], dl
mov rax, qword [rbx + 0x10]
mov edx, r9d
lea rcx, [r8 + rdi]
shr edx, 8
mov byte [rcx + rax + 2], dl
mov rax, qword [rbx + 0x10]
lea rcx, [r8 + rdi]
mov byte [rcx + rax + 3], r9b
mov rax, qword [rbx + 0x10]
mov ecx, r12d
sar ecx, 0x18
mov byte [rdi + rax], cl
mov rax, qword [rbx + 0x10]
mov ecx, r12d
sar ecx, 0x10
mov byte [rdi + rax + 1], cl
mov rax, qword [rbx + 0x10]
mov ecx, r12d
sar ecx, 8
mov byte [rdi + rax + 2], cl
mov rax, qword [rbx + 0x10]
mov byte [rdi + rax + 3], r12b
mov r9, qword [r15 + 0x2160]
test r9, r9
je 0x1400abba6
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r15 + 0x2168]
mov r8d, ebp
add rdx, 4
add rdx, rdi
call qword [r9 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test r13, r13
je 0x1400abbaf
mov dword [r13], esi
lea eax, [rbp + 4]
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b0914
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea r15, [r8 + 0x3d0]
mov rbp, rcx
mov r14, r8
mov edi, edx
lea rcx, [rsp + 0x20]
mov r8d, reloc.SHELL32.dll_ILFindLastID
mov rdx, r15
call qword [sym.imp.msvcrt.dll_memcpy]
test edi, edi
jle 0x1400b0a3c
lea rsi, [rbp + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rbp
lea ebp, [rdi - 1]
shr ebp, 4
inc ebp
lea r13, [rsp + 0x40]
lea r12, [rsp + 0x30]
mov rdi, rsi
add r13, rbx
add r12, rbx
mov edx, 4
movzx eax, byte [rdi - 1]
movzx ecx, byte [rdi - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
or ecx, eax
mov dword [rdi + r13], ecx
mov dword [rdi + r12], ecx
add rdi, 4
dec rdx
jne 0x1400b0990
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [r14 + 0x3c8]
lea r9, [rsp + 0x20]
mov r10d, 4
add r9, rbx
mov edx, dword [rsi + r9]
mov r8d, dword [rsi + r12]
mov ecx, edx
mov eax, r8d
shr eax, 0x18
shr ecx, 0x18
xor cl, al
mov eax, r8d
shr r8d, 8
shr eax, 0x10
mov byte [rsi - 2], cl
mov ecx, edx
shr ecx, 0x10
shr edx, 8
xor cl, al
mov al, byte [rsi + r12]
xor dl, r8b
xor al, byte [rsi + r9]
mov byte [rsi - 1], cl
mov byte [rsi], dl
mov byte [rsi + 1], al
mov eax, dword [rsi + r13]
mov dword [rsi + r9], eax
lea rsi, [rsi + 4]
dec r10
jne 0x1400b09dc
sub rbx, 0x10
mov rsi, rdi
dec rbp
jne 0x1400b0978
lea rdx, [rsp + 0x20]
mov r8d, reloc.SHELL32.dll_ILFindLastID
mov rcx, r15
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001010
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b0c84
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10b, byte [rcx]
mov r11b, byte [rcx + 1]
mov rbx, rdx
mov r9, rcx
test r8d, r8d
jle 0x1400b0ce0
mov edi, r8d
inc r10b
movzx r8d, r10b
movzx edx, byte [r8 + r9 + 2]
add r11b, dl
movzx ecx, r11b
mov al, byte [rcx + r9 + 2]
mov byte [r8 + r9 + 2], al
mov byte [rcx + r9 + 2], dl
movzx ecx, byte [r8 + r9 + 2]
add ecx, edx
movzx eax, cl
mov cl, byte [rax + r9 + 2]
xor byte [rbx], cl
inc rbx
dec rdi
jne 0x1400b0ca3
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov byte [r9], r10b
mov byte [r9 + 1], r11b
ret