joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009b360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov bl, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14009b3b3
mov al, byte [rbp + 0x60]
movzx edx, bl
mov rbx, qword [rcx]
mov dword [rsp + 0x28], edx
mov byte [rsp + 0x20], al
mov rdx, rsi
mov r8, rdi
call qword [rbx + 0x30]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x1401054a8]
call fcn.140052588
mov r14, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14009b3f1
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r15, [rbp - 0x20]
mov qword [r15 + 0x10], rax
movaps xmm0, xmmword [0x1400e9af0]
movaps xmmword [r15], xmm0
mov rax, qword [r14]
xor bl, 1
movzx ebx, bl
mov rcx, r14
mov rdx, r15
call qword [rax + rbx*8 + 0x28]
movzx r9d, byte [r15 + 0x17]
test r9b, r9b
mov rcx, qword [r15]
mov r8, qword [r15 + 8]
mov rax, r9
cmovs rax, r8
test rax, rax
je 0x14009b4a8
test r9b, r9b
mov rbx, r15
cmovs rbx, rcx
test rdi, rdi
je 0x14009b496
mov al, byte [rbx]
movzx eax, al
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14009b49a
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
cmp eax, 0xffffffff
jne 0x14009b46b
xor edi, edi
mov r9b, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
inc rbx
test r9b, r9b
mov rax, r15
cmovs rax, rcx
movzx edx, r9b
cmovs rdx, r8
add rdx, rax
cmp rbx, rdx
jne 0x14009b446
jmp 0x14009b4a8
xor edi, edi
jmp 0x14009b477
mov r8, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [r8 + 0x60]
jmp 0x14009b464
shr r9b, 7
mov qword [rsi], rdi
test r9b, r9b
je 0x14009b3a3
call fcn.1400672f8
jmp 0x14009b3a3
Function at 0x14009c8b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140069820
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r15, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r15
mov dl, 0xaa
call fcn.14006bec0
lea r12, [rsp + 0x3c]
mov dword [r12], 1
lea rsi, [rsp + 0x38]
mov dword [rsi], 0x800
lea rdx, str.ReadValue
lea r8, str..._.._base_win_registry.cc
lea rcx, [rsp + 0x40]
mov r9d, 0x19e
call fcn.14003f330
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rdx, rdi
xor r8d, r8d
mov r9, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14009c98d
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14009c991
lea rdx, [rsp + 0x840]
mov rcx, r14
call fcn.14005279e
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140069890
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, eax
jmp 0x14009c96a
cmp eax, 2
jne 0x14009c9d6
lea rsi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rsi
mov dl, 0xaa
call fcn.14006bec0
lea rcx, [rsp + 0x840]
mov rdx, rsi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
dec eax
cmp eax, 0x3ff
ja 0x14009c9dd
lea rdx, [rsp + 0x40]
jmp 0x14009c960
mov edi, 0x3f4
jmp 0x14009c96a
mov edi, 0xea
jmp 0x14009c96a

Function at 0x14009cc20
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x14009cc5a
mov rax, qword [rdi]
mov qword [rbx], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r15
jbe 0x14009ccb6
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x14009cca5
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.14006b810
mov r14, qword [rsi + 8]
add rbx, r15
mov qword [rsi + 0x10], rbx
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x14009cc3f
mov rax, rbx
sub rax, r15
mov rcx, rax
sar rcx, 2
test rax, rax
mov r13d, 1
cmovne r13, rcx
mov rax, r13
shr rax, 0x3d
jne 0x14009cd4c
mov r12, r13
shr r12, 2
lea rcx, [r13*8]
call fcn.140067308
lea r9, [rax + r12*8]
lea r8, [rax + r13*8]
mov r10, r9
sub rbx, r14
je 0x14009cd20
lea r10, [r9 + rbx]
sar rbx, 3
shl rbx, 3
lea r11, [rax + r12*8]
xor edx, edx
mov rcx, qword [r14 + rdx]
mov qword [r11 + rdx], rcx
add rdx, 8
cmp rbx, rdx
jne 0x14009cd0f
mov qword [rsi], rax
mov qword [rsi + 8], r9
mov qword [rsi + 0x10], r10
mov qword [rsi + 0x18], r8
mov rbx, r10
test r15, r15
je 0x14009cc3f
mov rcx, r15
call fcn.1400672f8
mov rbx, qword [rsi + 0x10]
jmp 0x14009cc3f
call fcn.140067630
int3
Function at 0x1400a0300
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [0x1400e8b40]
mov qword [rcx], rax
lea rdi, [rcx + 8]
lea rax, [0x1400e9010]
mov qword [rcx + 8], rax
lea rbx, [rsp + 0x20]
mov rcx, rbx
call fcn.140038010
mov rcx, rbx
mov rdx, rsi
call fcn.1400a0460
call fcn.140037de0
mov rcx, rax
mov rdx, rdi
call fcn.140055e30
mov rdi, qword [rsi + 0x10]
add rdi, 8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x1400a0409
mov rax, qword [rsi + 0x18]
test rax, rax
jne 0x1400a0416
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x20]
mov dword [rdx], eax
mov ecx, 0x308
add rcx, qword [rsi + 0x10]
call fcn.1400a0470
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [rsi + 0x10]
mov ecx, dword [0x140103438]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x1400a03e2
movsxd rcx, dword [rdi + 0x2f0]
shl rcx, 4
mov qword [rax + rcx], 0
mov ecx, dword [rdi + 0x2f4]
movsxd rdx, dword [rdi + 0x2f0]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
mov rdi, qword [rsi + 0x18]
mov qword [rsi + 0x18], 0
test rdi, rdi
jne 0x1400a044d
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140069890
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.140036430
jmp 0x1400a0373
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rcx + 0x360]
cmp dword [rsi + 0x28], edx
jne 0x1400a0380
mov rcx, qword [rcx + 0x20]
mov qword [rsi + 0x18], 0
lea r8, [rsp + 0x20]
mov qword [r8], rax
mov rdx, qword [rsi + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400a0380
mov rcx, rdi
call fcn.140092050
mov rcx, rdi
call fcn.1400672f8
jmp 0x1400a03f3
Function at 0x1400a2d96
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
test r8d, r8d
jne 0x1400a2dc0
movabs rax, 0x100000001
mov qword [rsi], rax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov edi, r8d
mov dword [rsi], 0
test dl, 1
jne 0x1400a2de1
xor ebx, ebx
movzx edx, dx
shr edx, 1
inc ebx
mov r14d, edx
test dl, 1
je 0x1400a2dd0
jmp 0x1400a2de7
movzx r14d, dx
xor ebx, ebx
bsr eax, r14d
xor eax, 0x1f
mov ecx, 0x20
sub ecx, eax
imul ecx, edi
cmp ecx, 0xde3
jg 0x1400a2eb9
mov ecx, 1
mov ebp, ecx
lea ecx, [rbp + rbp]
cmp ebp, edi
jle 0x1400a2e09
xor r8d, r8d
sar ebp, 2
movzx r9d, dx
jne 0x1400a2e71
xor ebp, ebp
mov rdx, r9
mov dword [rsi], 0
test rdx, rdx
je 0x1400a2e4c
xor eax, eax
mov ecx, edx
and ecx, 0xfffffff
mov dword [rsi + rax*4 + 4], ecx
shr rdx, 0x1c
inc rax
test rdx, rdx
jne 0x1400a2e31
mov word [rsi], ax
test r8b, 1
jne 0x1400a2edb
test ebp, ebp
jne 0x1400a2ebe
imul ebx, edi
mov rcx, rsi
mov edx, ebx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.1400a27bc
xor r8d, r8d
mov r10d, 1
mov rdx, r9
imul rdx, rdx
test ebp, edi
jne 0x1400a2e94
sar ebp, 1
je 0x1400a2e24
mov rcx, rdx
shr rcx, 0x20
jne 0x1400a2e24
jmp 0x1400a2e7d
mov ecx, eax
or cl, 0x20
mov r11, rdx
shr r11, cl
test r11, r11
mov ecx, 1
cmove rcx, r9
movzx r8d, r8b
cmovne r8d, r10d
imul rdx, rcx
jmp 0x1400a2e85
call fcn.1400c87fa
mov rcx, rsi
call fcn.1400d77aa
test ebp, edi
je 0x1400a2ed5
mov rcx, rsi
mov edx, r14d
call fcn.1400a2a7e
sar ebp, 1
je 0x1400a2e5a
jmp 0x1400a2ebe
mov rcx, rsi
mov edx, r14d
call fcn.1400a2a7e
jmp 0x1400a2e56
Function at 0x1400a3440
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
lea rax, [0x1400e9020]
mov qword [rcx], rax
add rcx, 8
call fcn.140049520
lea rcx, [rsi + 0x10]
call fcn.140049520
xor edi, edi
mov byte [rsi + 0x18], dil
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], edi
call fcn.140049520
mov byte [rsi + 0x48], dil
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rdi
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebx, 0x3f800000
mov dword [rsi + 0xd0], ebx
mov dword [rsi + 0xd8], edi
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebx
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebx
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x150], ebx
movups xmmword [rsi + 0x158], xmm6
movups xmmword [rsi + 0x168], xmm6
mov dword [rsi + 0x178], ebx
mov qword [rsi + 0x198], rdi
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], edi
mov dword [rsi + 0x1a0], 1
lea rcx, [rsi + 0x1a8]
call fcn.1400a3700
lea rcx, [rsi + 0x2f0]
movups xmmword [rsi + 0x2d8], xmm6
mov qword [rsi + 0x2e8], rdi
xor edx, edx
call fcn.140036fb0
lea rcx, [rsi + 0x2f8]
xor edx, edx
call fcn.140036fb0
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.140036fb0
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
mov dword [rsi + 0x328], ebx
movups xmmword [rsi + 0x330], xmm6
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x359], xmm6
movups xmmword [rsi + 0x370], xmm6
movups xmmword [rsi + 0x380], xmm6
call fcn.140007890
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x190], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov rcx, rsi
call fcn.1400a3650
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x1400a363e
call fcn.140037de0
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.1400380c0
mov qword [0x140106708], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x1400a360d
Function at 0x1400a6abd
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140067308
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400be170]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.140067e8c
mov qword [rbx], rax
test rax, rax
je 0x1400a6b14
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400a7750
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rcx + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400a777b
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp sub.KERNEL32.dll_ReleaseSRWLockExclusive
lock inc dword [rsi]
mov rcx, rdi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rcx, rsi
call fcn.1400ce840
lock dec dword [rsi]
je 0x1400a779a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.1400ce7e0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400013b0
Function at 0x1400a9a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400a9a38
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x1400a9a96
mov edi, dword [rsi + 0x5c]
test r15b, r15b
je 0x1400a9a76
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069890
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.140068570
cmp eax, 0xffffffff
je 0x1400a9b13
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x1400a9ab4
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x1400a9b1d
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r15b, r15b
je 0x1400a9af0
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x1400a9a76
mov edi, edi
test rdi, rdi
jle 0x1400a9bc2
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movzx ecx, byte [rsp + rax + 0x58]
call fcn.140068518
cmp eax, 0xffffffff
jne 0x1400a9af2
mov edi, 0xffffffff
jmp 0x1400a9a76
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x1400a9bab
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x1400a9b13
mov rcx, qword [rsi + 0x40]
call fcn.140068570
cmp eax, 0xffffffff
je 0x1400a9b13
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400a9b2e
cmp eax, 2
je 0x1400a9b13
cmp eax, 3
je 0x1400a9ad9
jmp 0x1400a9ae1
movzx edi, byte [rsp + 0x57]
jmp 0x1400a9a76
Function at 0x1400a9d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400a9d28
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x1400a9d86
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x1400a9d66
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069890
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.140068570
cmp eax, 0xffffffff
je 0x1400a9e0b
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x1400a9da4
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1400a9e14
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x1400a9de5
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x1400a9d66
mov edi, edi
test rdi, rdi
jle 0x1400a9eb9
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.140068518
cmp eax, 0xffffffff
jne 0x1400a9de7
mov di, 0xffff
jmp 0x1400a9d66
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x1400a9ea2
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp rdi, 8
je 0x1400a9e0b
mov rcx, qword [rsi + 0x40]
call fcn.140068570
cmp eax, 0xffffffff
je 0x1400a9e0b
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400a9e25
cmp eax, 2
je 0x1400a9e0b
cmp eax, 3
je 0x1400a9dcb
jmp 0x1400a9dd5
movzx edi, word [rsp + 0x56]
jmp 0x1400a9d66
Function at 0x1400aa030
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.140068578
cmp rax, rbx
jne 0x1400aa0cc
cmp edi, 1
je 0x1400aa074
cmp edi, 2
je 0x1400aa0cc
mov rcx, qword [rsi + 0x40]
call fcn.1400685fc
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140069890
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400aa0f0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400aa125
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140068578
xor ebx, ebx
test rsi, rsi
jle 0x1400aa14a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x1400aa14a
inc rbx
cmp rsi, rbx
jne 0x1400aa12c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400aa160
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp edx, 0xffffffff
je 0x1400aa1ca
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x1400aa1f0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.140068578
mov esi, 0xffffffff
cmp rax, 1
je 0x1400aa1cd
jmp 0x1400aa1d0
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069890
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x1400aa2a0
mov ebp, eax
cmp eax, 3
je 0x1400aa27f
cmp ebp, 1
ja 0x1400aa2a0
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.140068578
cmp rax, rsi
jne 0x1400aa2a0
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x1400aa208
jmp 0x1400aa1cd
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.140068578
cmp rax, 1
je 0x1400aa1cd
mov esi, 0xffffffff
jmp 0x1400aa1d0

Function at 0x1400aa2f0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400aa325
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140068578
xor ebx, ebx
test rsi, rsi
jle 0x1400aa34b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x1400aa34b
inc rbx
cmp rsi, rbx
jne 0x1400aa32c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400aa360
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x140100028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp dx, 0xffff
je 0x1400aa3ca
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x1400aa3f0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.140068578
mov si, 0xffff
cmp rax, 1
je 0x1400aa3cd
jmp 0x1400aa3d0
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069890
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x1400aa4a0
mov ebp, eax
cmp eax, 3
je 0x1400aa47f
cmp ebp, 1
ja 0x1400aa4a0
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.140068578
cmp rax, rsi
jne 0x1400aa4a0
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x1400aa408
jmp 0x1400aa3cd
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.140068578
cmp rax, 1
je 0x1400aa3cd
mov si, 0xffff
jmp 0x1400aa3d0
Function at 0x1400b1030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov r15b, byte [rbp + 0x78]
test byte [r9 + 8], 1
jne 0x1400b108f
movzx eax, word [rbp + 0x70]
movzx edx, r15b
mov rbx, qword [rcx]
mov dword [rsp + 0x28], edx
mov word [rsp + 0x20], ax
mov rdx, r14
mov r8, rdi
call qword [rbx + 0x30]
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [r9 + 0x30]
lea rcx, [rbp - 0x20]
mov qword [rcx], rax
mov qword [rbp - 8], rax
lock inc dword [rax + 8]
lea rdx, [0x1401054b8]
call fcn.140052588
mov r12, rax
mov eax, 0xffffffff
mov rcx, qword [rbp - 8]
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x1400b10c9
mov rax, qword [rcx]
call qword [rax + VariantCopy]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rbp - 0x20]
mov qword [r13 + 0x10], rax
movaps xmm0, xmmword [0x1400e9af0]
movaps xmmword [r13], xmm0
mov rax, qword [r12]
xor r15b, 1
movzx esi, r15b
mov rcx, r12
mov rdx, r13
call qword [rax + rsi*8 + 0x28]
movzx ebx, byte [r13 + 0x17]
test bl, bl
mov rcx, qword [r13]
mov r8, qword [r13 + 8]
mov rax, rbx
cmovs rax, r8
test rax, rax
je 0x1400b1181
test bl, bl
mov rsi, rcx
cmovns rsi, r13
test rdi, rdi
je 0x1400b1170
movzx eax, word [rsi]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400b1174
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1400b1146
xor edi, edi
mov bl, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
add rsi, 2
test bl, bl
mov rax, r13
cmovs rax, rcx
movzx edx, bl
cmovs rdx, r8
lea rax, [rax + rdx*2]
cmp rsi, rax
jne 0x1400b1121
jmp 0x1400b1181
xor edi, edi
jmp 0x1400b1151
mov rbx, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [rbx + 0x60]
jmp 0x1400b113e
shr bl, 7
mov qword [r14], rdi
test bl, bl
je 0x1400b107b
call fcn.1400672f8
jmp 0x1400b107b