joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140094cc8
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
test edx, edx
je 0x140094f22
mov r11, rsp
push rbx
push rbp
push rsi
sub rsp, 0x160
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov ebx, edx
mov rbp, rcx
test rcx, rcx
je 0x140094f08
lea edx, [rdx + rdx*4 + 0xa]
mov eax, 0x55555556
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x30], r14
mov rcx, rsi
imul edx
mov r8d, edx
mov qword [r11 - 0x38], r15
shr r8d, 0x1f
add r8d, edx
lea eax, [r8 + r8]
cdq
idiv ebx
lea edx, [rax + r8 + 3]
mov r8d, 0x3f0
call fcn.140068630
mov eax, 0x55555556
xor r14d, r14d
xor r10d, r10d
xor r11d, r11d
lea r15, [0x1404a8420]
imul ebx
mov r12d, edx
shr r12d, 0x1f
add r12d, edx
test r12d, r12d
jle 0x140094e39
mov qword [rsp + 0x150], r13
mov edi, r12d
mov r13, rbp
nop
movzx edx, byte [r13]
movzx r9d, byte [r13 + 1]
movzx r8d, byte [r13 + 2]
mov eax, edx
and edx, 3
mov ecx, r9d
sar rax, 2
sar rcx, 4
shl edx, 4
and eax, 0x3f
and ecx, 0xf
and r9d, 0xf
movzx eax, byte [rax + r15]
shl r9d, 2
add r10d, 4
mov byte [rsp + r11 + 0x20], al
movsxd rax, edx
mov edx, r8d
or rcx, rax
and edx, 0x3f
add r14d, 3
movzx eax, byte [rcx + r15]
movsxd rcx, r9d
add r11, 4
mov byte [rsp + r11 + 0x1d], al
mov eax, r8d
add r13, 3
sar rax, 6
and eax, 3
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rsp + r11 + 0x1e], al
movzx eax, byte [rdx + r15]
mov byte [rsp + r11 + 0x1f], al
cmp r10d, 0x100
jl 0x140094e13
lea rdx, [rsp + 0x20]
mov r8d, r10d
mov rcx, rsi
call fcn.140068990
xor r10d, r10d
xor r11d, r11d
dec rdi
jne 0x140094d70
mov r13, qword [rsp + 0x150]
test r10d, r10d
je 0x140094e39
lea rdx, [rsp + 0x20]
mov r8d, r10d
mov rcx, rsi
call fcn.140068990
lea eax, [r12 + r12*2]
mov r12, qword [rsp + 0x158]
sub ebx, eax
dec ebx
je 0x140094ea9
dec ebx
jne 0x140094ef0
movsxd rax, r14d
mov rcx, rsi
movzx ebx, byte [rax + rbp]
movzx edi, byte [rax + rbp + 1]
mov eax, ebx
sar rax, 2
and eax, 0x3f
movzx edx, byte [rax + r15]
call fcn.140068030
mov r11d, edi
and ebx, 3
sar r11, 4
shl ebx, 4
mov rcx, rsi
and r11d, 0xf
movsxd rax, ebx
or r11, rax
movzx edx, byte [r11 + r15]
call fcn.140068030
and edi, 0xf
shl edi, 2
movsxd rax, edi
movzx edx, byte [rax + r15]
jmp 0x140094ede
movsxd rax, r14d
mov rcx, rsi
movzx ebx, byte [rax + rbp]
mov eax, ebx
sar rax, 2
and eax, 0x3f
movzx edx, byte [rax + r15]
call fcn.140068030
and ebx, 3
mov rcx, rsi
shl ebx, 4
movsxd rax, ebx
movzx edx, byte [rax + r15]
call fcn.140068030
mov dl, 0x3d
mov rcx, rsi
call fcn.140068030
mov dl, 0x3d
mov rcx, rsi
call fcn.140068030
mov r14, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x198]
mov r15, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140360fe0
add rsp, 0x160
pop rsi
pop rbp
pop rbx
repz ret
Function at 0x1400a2c80
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable.Md5.0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov qword [rcx], rax
xor eax, eax
mov dword [rcx + 0x10], 0x98badcfe
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x1400a2f30
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov rsi, rcx
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov qword [rcx + 0x18], rax
mov rcx, rdx
mov rbp, r8
mov rdi, rdx
call fcn.140067c00
mov rcx, rdi
mov ebx, eax
call fcn.140098640
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call fcn.1400a2ce0
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400a2e20

Function at 0x1400a2fb0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, r9
mov rbx, rcx
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov qword [rcx + 0x18], rax
mov dword [rcx + 0x14], 0x10325476
call fcn.1400a2ce0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400a2e20

Function at 0x1400a3000
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov rsi, rcx
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov qword [rcx + 0x18], rax
mov rcx, rdx
mov rbp, r8
mov rdi, rdx
call fcn.140098650
mov rcx, rdi
mov ebx, eax
call fcn.140098640
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
call fcn.1400a2ce0
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400a2e20
Function at 0x1400a3f20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [rsp + 0x60]
mov rax, rdx
xor edx, edx
mov byte [rbx], 0
mov rsi, r9
mov ebp, r8d
mov rdi, rcx
mov dword [r9], edx
test r8d, r8d
je 0x1400a3fd7
test rax, rax
je 0x1400a3fd7
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400a3fa4
mov qword [rsp + 0x20], rdx
mov r8d, ebp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a3f98
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1400a3f9d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400a3fee
mov edx, eax
call fcn.1400aab30
jmp 0x1400a3fee
cmp dword [rsi], 0
jne 0x1400a3fa0
mov byte [rbx], 1
mov al, 1
jmp 0x1400a3ff0
mov r9, qword [rdi + 0x10]
test r9, r9
je 0x1400a3fee
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.140361f30
mov dword [rsi], eax
cmp eax, ebp
je 0x1400a3fa0
mov rcx, qword [rdi + 0x10]
call fcn.1403634bc
test eax, eax
jne 0x1400a3fee
mov byte [rbx], 1
mov al, 1
jmp 0x1400a3ff0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400a3fee
mov rax, qword [rcx]
lea rdx, str.NULL_buf_or_bufSize
call qword [rax + 0x20]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a4010
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rsi, r9
mov rdi, r8
mov rbp, rdx
mov r12, rcx
cmp qword [rcx + 8], 0xffffffffffffffff
jne 0x1400a406b
cmp qword [rcx + 0x10], 0
jne 0x1400a406b
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x1400a4064
mov rax, qword [rcx]
lea rdx, str.Failed_to_write_because_file_is_not_open.
call qword [rax + 0x20]
xor al, al
jmp 0x1400a4189
xor r14d, r14d
test r9, r9
je 0x1400a4076
mov qword [r9], r14
test r8, r8
je 0x1400a4187
mov r13d, 0x989680
mov edx, dword [rsp + 0xa0]
nop dword [rax]
mov ebx, edi
cmp rdi, r13
cmovg ebx, r13d
mov rcx, qword [r12 + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400a40d6
mov dword [rsp + 0xa0], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xa0]
mov r8d, ebx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400a411b
mov edx, dword [rsp + 0xa0]
cmp edx, ebx
jne 0x1400a411b
jmp 0x1400a40ff
mov r9, qword [r12 + 0x10]
test r9, r9
je 0x1400a40ff
mov edx, ebx
mov r8d, 1
mov rcx, rbp
call fcn.140362250
cmp rax, 1
jne 0x1400a4169
mov edx, ebx
mov dword [rsp + 0xa0], ebx
mov eax, ebx
add rbp, rax
sub rdi, rax
test rsi, rsi
je 0x1400a4111
mov eax, edx
add qword [rsi], rax
test rdi, rdi
je 0x1400a4187
jmp 0x1400a4090
mov rdi, qword [rsp + 0xc0]
test rdi, rdi
je 0x1400a4165
lea rcx, [rsp + 0x38]
call fcn.140068bf0
nop
lea rcx, [rsp + 0x38]
call fcn.14006b800
mov rbx, qword [rdi]
lea rcx, [rsp + 0x38]
call fcn.140098640
mov r8, rax
lea rdx, str.WriteFileError
mov rcx, rdi
call qword [rbx + 0x50]
nop
lea rcx, [rsp + 0x38]
call fcn.140068e70
xor al, al
jmp 0x1400a4189
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x1400a4183
mov rax, qword [rcx]
lea rdx, str.fwrite_failed.
call qword [rax + 0x20]
xor al, al
jmp 0x1400a4189
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x1400a41b0
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rsi, rdx
mov rax, qword [rcx + 8]
cmp rax, 0xffffffffffffffff
je 0x1400a4238
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1400a4234
test rsi, rsi
je 0x1400a4234
lea rcx, [rsp + 0x28]
call fcn.140068bf0
nop
lea rcx, [rsp + 0x28]
call fcn.14006b800
mov rbx, qword [rsi]
lea rcx, [rsp + 0x28]
call fcn.140098640
mov rdx, rax
mov rcx, rsi
call qword [rbx + 0x20]
mov r11, qword [rsi]
lea rdx, str.Failed_to_get_file_size__32_
mov rcx, rsi
call qword [r11 + 0x20]
nop
lea rcx, [rsp + 0x28]
call fcn.140068e70
mov eax, edi
jmp 0x1400a4252
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400a424f
call fcn.140369088
mov ecx, eax
call fcn.140367768
jmp 0x1400a4252
or eax, 0xffffffff
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400a4270
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rdi, rdx
mov rax, qword [rcx + 8]
cmp rax, 0xffffffffffffffff
je 0x1400a4307
mov dword [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x1400a42fa
test rdi, rdi
je 0x1400a431e
lea rcx, [rsp + 0x28]
call fcn.140068bf0
nop
lea rcx, [rsp + 0x28]
call fcn.14006b800
mov rbx, qword [rdi]
lea rcx, [rsp + 0x28]
call fcn.140098640
mov rdx, rax
mov rcx, rdi
call qword [rbx + 0x20]
mov r11, qword [rdi]
lea rdx, str.Failed_to_get_file_size__64_
mov rcx, rdi
call qword [r11 + 0x20]
nop
lea rcx, [rsp + 0x28]
call fcn.140068e70
jmp 0x1400a431e
mov edx, dword [rsp + 0x70]
mov ecx, eax
call fcn.1400a38f0
jmp 0x1400a4322
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400a431e
call fcn.140369088
mov ecx, eax
call fcn.140367870
jmp 0x1400a4322
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400a4d20
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov dword [0x14063be64], 0x65
mov byte [r8], 0
mov r10, qword [rcx + 0x18]
mov r11, qword [rcx + 0x20]
mov rsi, r8
mov rdi, rdx
mov r8, r10
mov rdx, r11
mov rbx, rcx
call fcn.1400a4a50
cmp byte [rbx + 0x50], 0
mov ebp, eax
jne 0x1400a4d77
lea rcx, [r11 + rdi]
mov qword [rbx + 0x20], rcx
cmp rcx, r10
jle 0x1400a4d77
mov qword [rbx + 0x20], r10
xor edi, edi
mov dword [0x14063be64], 0x66
cmp byte [rbx + 0x50], dil
jne 0x1400a4d9b
mov r8, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
call fcn.1400a4a50
mov edi, eax
mov dword [0x14063be64], 0x67
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x1400a4e6c
cmp byte [rbx + 0x50], 0
jne 0x1400a4e0a
cmp edi, ebp
jbe 0x1400a4e0a
cmp edi, dword [rbx + 0x28]
jbe 0x1400a4e0a
mov dword [0x14063be64], 0x68
call sub.KERNEL32.dll_GetTickCount
cmp byte [rbx + 0x51], 0
mov dword [rbx + 0x3c], eax
je 0x1400a4de2
cmp edi, 0x64
je 0x1400a4e63
mov dword [0x14063be64], 0x69
mov rcx, qword [rbx + 0x30]
mov dword [rbx + 0x28], edi
mov rax, qword [rcx]
mov r8, rsi
mov edx, edi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [0x14063be64], 0x6a
jmp 0x1400a4e63
test rax, rax
je 0x1400a4e6c
cmp byte [rbx + 0x44], 0
jne 0x1400a4e6c
mov dword [0x14063be64], 0x6c
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 0x40]
mov edx, eax
mov r8d, 0x12c
sub edx, dword [rbx + 0x3c]
test ecx, ecx
cmove ecx, r8d
cmp edx, ecx
jbe 0x1400a4e6c
mov dword [0x14063be64], 0x6d
mov rcx, qword [rbx + 0x30]
mov dword [rbx + 0x48], eax
mov dword [rbx + 0x3c], eax
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_recv]
mov dword [0x14063be64], 0x6e
cmp byte [rsi], 0
je 0x1400a4e6c
mov byte [rbx + 0x38], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov dword [0x14063be64], 0x6f
add rsp, 0x20
pop rdi
ret
Function at 0x1400a6580
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r10, rcx
test rdx, rdx
jne 0x1400a6594
or eax, 0xffffffff
add rsp, 0x38
ret
test r8, r8
je 0x1400a658c
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x30], rdi
mov rdi, r8
lea r9d, [rax + 1]
repne scasb al, byte [rdi]
not rcx
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdi, qword [rsp + 0x30]
neg eax
sbb eax, eax
add rsp, 0x38
ret

Function at 0x1400a65e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x88
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r13, r9
mov rbx, r8
mov r12, rdx
mov rbp, rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
xor sil, sil
test eax, eax
jne 0x1400a6753
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400a67a8
mov ecx, eax
call fcn.1402245bc
mov rdi, rax
test rax, rax
je 0x1400a67ac
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, eax
test eax, eax
jne 0x1400a66f4
mov r8d, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
cmp eax, 4
jne 0x1400a66cd
cmp r8d, eax
jne 0x1400a66e4
mov r8d, dword [rdi]
lea rdx, [0x1404ab0ec]
lea rcx, [rsp + 0x40]
call fcn.1403625d8
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140068720
jmp 0x1400a66ef
cmp eax, 1
je 0x1400a66d7
cmp eax, 2
jne 0x1400a66e4
mov rdx, rdi
mov rcx, rbx
call fcn.140068720
jmp 0x1400a66ef
mov rdx, rdi
mov rcx, rbx
call fcn.14006a8e0
mov sil, 1
jmp 0x1400a6749
lea rcx, [rsp + 0x40]
call fcn.140068bf0
nop
mov edx, ebp
lea rcx, [rsp + 0x40]
call fcn.14006a290
mov rbx, qword [r13]
lea rcx, [rsp + 0x40]
call fcn.140098640
mov r8, rax
lea rdx, str.RegistryQueryError2
mov rcx, r13
call qword [rbx + 0x50]
mov r11, qword [r13]
mov r8, r12
lea rdx, str.ValueName
mov rcx, r13
call qword [r11 + 0x50]
nop
lea rcx, [rsp + 0x40]
call fcn.140068e70
mov rcx, rdi
call fcn.140224608
jmp 0x1400a67a8
lea rcx, [rsp + 0x40]
call fcn.140068bf0
nop
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.14006a290
mov rbx, qword [r13]
lea rcx, [rsp + 0x40]
call fcn.140098640
mov r8, rax
lea rdx, str.RegistryQueryError
mov rcx, r13
call qword [rbx + 0x50]
mov r11, qword [r13]
mov r8, r12
lea rdx, str.ValueName
mov rcx, r13
call qword [r11 + 0x50]
nop
lea rcx, [rsp + 0x40]
call fcn.140068e70
movzx eax, sil
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140360fe0
add rsp, 0x88
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b2839
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rdx, rdx
je 0x1400b2aca
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x120
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov r12, r9
mov edi, r8d
mov rsi, rdx
test r8d, r8d
je 0x1400b2aaf
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
xor r14b, r14b
xor r13b, r13b
xor ebx, ebx
call fcn.14006fd10
lea r10d, [rbx + 0x70]
mov r15, rax
mov qword [rsp + 0x118], rbp
nop word [rax + rax]
movzx edx, byte [rsi]
dec edi
inc rsi
cmp dl, 0x1b
jne 0x1400b2926
test edi, edi
je 0x1400b2a73
movzx eax, byte [rsi]
dec edi
inc rsi
cmp al, 0x24
jne 0x1400b28e8
test edi, edi
je 0x1400b2a73
movzx eax, byte [rsi]
dec edi
inc rsi
cmp al, 0x40
je 0x1400b28dd
cmp al, 0x42
jne 0x1400b2a65
mov r13b, 1
xor r14b, r14b
jmp 0x1400b2a65
cmp al, 0x28
jne 0x1400b2a65
test edi, edi
je 0x1400b2a73
movzx eax, byte [rsi]
dec edi
inc rsi
cmp al, 0x42
je 0x1400b291b
cmp al, 0x4a
je 0x1400b291b
cmp al, 0x49
jne 0x1400b2a65
mov r14b, 1
xor r13b, r13b
jmp 0x1400b2a65
xor r13b, r13b
xor r14b, r14b
jmp 0x1400b2a65
cmp dl, 0xd
je 0x1400b2a37
cmp dl, 0xa
je 0x1400b2a37
test r13b, r13b
je 0x1400b2a24
test edi, edi
je 0x1400b2a73
movzx r9d, byte [rsi]
lea eax, [rdx - 0x79]
dec edi
inc rsi
cmp al, 3
ja 0x1400b29b5
movzx r8d, al
lea eax, [r9 - 0x21]
movzx ecx, al
imul r8d, r8d, 0x5e
add r8d, ecx
cmp r8d, 0x1f6
ja 0x1400b29b5
movsxd rcx, ebx
lea ebp, [r8 + r8]
inc ebx
movzx eax, byte [rbp + r15]
mov byte [rsp + rcx + 0x20], al
cmp ebx, 0xc8
jne 0x1400b29a1
lea rdx, [rsp + 0x20]
mov r8d, ebx
mov rcx, r12
call fcn.14006c950
xor ebx, ebx
lea eax, [rbp + 1]
movsxd rdx, ebx
movzx eax, byte [rax + r15]
mov byte [rsp + rdx + 0x20], al
jmp 0x1400b2a49
cmp dl, 0x5f
movzx ecx, dl
mov r8d, 0xb0
mov eax, ecx
cmovb r8d, r10d
and eax, 0x80000001
jge 0x1400b29d5
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1400b29e8
xor ebp, ebp
cmp r9b, 0x5f
seta bpl
add ebp, 0x1f
jmp 0x1400b29ed
mov ebp, 0x7e
add bpl, r9b
inc ecx
movsxd rax, ebx
sar ecx, 1
inc ebx
add cl, r8b
mov byte [rsp + rax + 0x20], cl
cmp ebx, 0xc8
jne 0x1400b2a1a
lea rdx, [rsp + 0x20]
mov r8d, ebx
mov rcx, r12
call fcn.14006c950
xor ebx, ebx
movsxd rax, ebx
mov byte [rsp + rax + 0x20], bpl
jmp 0x1400b2a49
movsxd rax, ebx
inc ebx
test r14b, r14b
je 0x1400b2a31
sub dl, 0x80
mov byte [rsp + rax + 0x20], dl
jmp 0x1400b2a4b
test r13b, r13b
je 0x1400b2a42
xor r13b, r13b
xor r14b, r14b
movsxd rax, ebx
mov byte [rsp + rax + 0x20], dl
inc ebx
cmp ebx, 0xc8
jne 0x1400b2a65
lea rdx, [rsp + 0x20]
mov r8d, ebx
mov rcx, r12
call fcn.14006c950
xor ebx, ebx
mov r10d, VarBstrFromDisp
test edi, edi
jne 0x1400b28a0
mov r15, qword [rsp + 0x100]
mov r14, qword [rsp + 0x108]
mov r13, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x118]
test ebx, ebx
je 0x1400b2aa7
lea rdx, [rsp + 0x20]
mov r8d, ebx
mov rcx, r12
call fcn.14006c950
mov rbx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140360fe0
add rsp, 0x120
pop r12
pop rdi
pop rsi
repz ret
Function at 0x1400b2ba0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edi, ecx
test ecx, ecx
jns 0x1400b2bc0
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rdx, rdx
je 0x1400b2bb3
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
xor bpl, bpl
call fcn.14007c030
mov rsi, rax
test rax, rax
je 0x1400b2c09
mov r8, rbx
mov edx, edi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ecx, 1
movzx ebx, bpl
test eax, eax
cmovne ebx, ecx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
movzx eax, bl
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b8fa0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r11d, dword [rcx + 0x408]
mov ebx, dword [rcx + 0x40c]
movsxd r9, r9d
mov rdi, r8
mov rsi, rdx
mov r10, rcx
test r9, r9
jle 0x1400b902a
sub rsi, r8
inc r11b
inc rdi
movzx r11d, r11b
mov r8d, dword [r10 + r11*4 + 8]
add bl, r8b
movzx ebx, bl
mov ecx, dword [r10 + rbx*4 + 8]
mov dword [r10 + r11*4 + 8], ecx
add cl, r8b
mov dword [r10 + rbx*4 + 8], r8d
movzx eax, cl
movzx ecx, byte [r10 + rax*4 + 8]
xor cl, byte [rsi + rdi - 1]
dec r9
mov byte [rdi - 1], cl
jne 0x1400b8fd0
mov dword [r10 + 0x408], r11d
mov dword [r10 + 0x40c], ebx
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [rcx + 0x40c], ebx
mov rbx, qword [rsp + 8]
mov dword [rcx + 0x408], r11d
ret

Function at 0x1400b9de0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
movsxd rdi, r8d
mov ebx, 0x80
mov r12d, r9d
mov rbp, rcx
cmp edi, ebx
jbe 0x1400b930e
xor al, al
jmp 0x1400b9403
mov eax, 0x400
test r9d, r9d
mov qword [rsp + 0x30], rsi
lea rsi, [rcx + 8]
mov r8d, edi
cmove r12d, eax
mov rcx, rsi
call fcn.14035fcd0
lea r11, [0x1404af1b0]
cmp edi, ebx
jae 0x1400b9371
lea eax, [rdi - 1]
lea rdx, [rdi + rbp + 8]
movzx r8d, byte [rax + rbp + 8]
nop word [rax + rax]
movzx eax, byte [rsi]
movzx ecx, r8b
inc edi
add ecx, eax
inc rdx
inc rsi
movzx eax, cl
movzx r8d, byte [rax + r11]
mov byte [rdx - 1], r8b
cmp edi, ebx
jb 0x1400b9350
mov rsi, qword [rsp + 0x30]
lea r9d, [r12 + 7]
neg r12d
shr r9d, 3
movzx ecx, r12b
mov edx, 0xff
sub ebx, r9d
and cl, 7
movzx eax, byte [rbx + rbp + 8]
sar rdx, cl
movsxd rcx, ebx
and rdx, rax
movzx eax, byte [rdx + r11]
mov byte [rbx + rbp + 8], al
test ebx, ebx
je 0x1400b93cb
lea rdx, [rcx + rbp + 8]
movzx ecx, byte [rdx + r9 - 1]
dec rdx
movzx eax, al
xor rcx, rax
dec ebx
movzx eax, byte [rcx + r11]
mov byte [rdx], al
jne 0x1400b93b1
mov r8d, 0x3f
lea rdx, [rbp + 0x86]
mov r9d, 0x100
nop
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
sub rdx, 2
imul cx, r9w
add cx, ax
mov eax, r8d
mov word [rdx + 2], cx
dec r8d
test eax, eax
jne 0x1400b93e0
mov al, 1
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, 0x80
mov rbp, rdx
mov rsi, rcx
cmp r8d, edi
ja 0x1400b9e12
mov eax, 1
mov edi, r8d
cmp r8d, eax
cmovb edi, eax
mov ebx, 0x400
test r9d, r9d
je 0x1400b9e26
cmp r9d, ebx
cmova r9d, ebx
mov ebx, r9d
mov dword [rcx + 0x90], edi
mov dword [rcx + 0x94], ebx
mov edx, edi
mov rcx, rbp
call fcn.14006ddb0
mov rcx, rbp
call fcn.140098640
mov r9d, ebx
mov r8d, edi
mov rdx, rax
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x1400b92e0