joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x1400077c7
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
setae cl
cmovb eax, edi
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 2
jbe 0x1400077c9
xor r15d, r15d
jmp 0x140007802
mov al, 1
mov cl, 3
sub cl, al
movzx r12d, cl
xor r15d, r15d
lea r14, [0x14020ad38]
mov ebx, 1
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.140001940
test rax, rax
jne 0x140007889
inc r15
cmp r15, r12
jb 0x1400077e0
cmp edi, 0x64
jb 0x14000784e
movzx eax, di
shr eax, 2
imul eax, eax, 0x147b
shr eax, 0x11
imul ecx, eax, 0x64
sub edi, ecx
movzx ecx, di
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + 0x28], cx
mov ecx, 8
cmp eax, 0xa
jb 0x14000785a
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [rdx + rax*2]
mov word [rsp + rcx + 0x1e], ax
add rcx, 0xfffffffffffffffe
jmp 0x140007863
mov eax, edi
mov ecx, 0xa
cmp eax, 0xa
jae 0x140007838
or al, 0x30
mov byte [rsp + rcx + 0x1f], al
dec rcx
mov r8d, 0xa
sub r8, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.140001940
test rax, rax
je 0x14000788e
mov ebx, 1
mov rsi, rax
jmp 0x140007893
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140009c20
Capabilities:
Parse pe header

Disassembly:
cmp r8, 0x40
jae 0x140009c35
mov r9b, 1
mov byte [rcx + 8], r9b
mov qword [rcx], 2
ret
mov r9b, 4
test dl, 3
je 0x140009c49
mov byte [rcx + 8], r9b
mov qword [rcx], 2
ret
cmp word [rdx], 0x5a4d
jne 0x140009d34
mov eax, dword [rdx + 0x3c]
test al, 3
jne 0x140009c3d
cmp eax, 0x1000000
jbe 0x140009c71
mov r9b, 7
mov byte [rcx + 8], r9b
mov qword [rcx], 2
ret
lea r10, [rax + 0x88]
cmp r10, r8
jbe 0x140009c8c
mov r9b, 1
mov byte [rcx + 8], r9b
mov qword [rcx], 2
ret
cmp dword [rdx + rax], 0x4550
jne 0x140009d34
movzx r11d, word [rdx + rax + 0x18]
cmp r11d, 0x20b
je 0x140009cb4
mov r9b, 5
cmp r11d, 0x10b
jne 0x140009c3d
mov r9d, dword [rdx + rax + 0x54]
cmp r9, r8
ja 0x140009c7d
cmp r9d, dword [rdx + rax + 0x50]
ja 0x140009c62
movzx r9d, r11w
cmp r9d, 0x20b
jne 0x140009d43
mov r9d, dword [rdx + rax + 0x84]
cmp r9d, 0x10
mov r11d, 0x10
cmovb r11d, r9d
lea r9, [r10 + r11*8]
cmp r9, r8
ja 0x140009c7d
movzx r10d, word [rdx + rax + 6]
mov r9b, 7
cmp r10, 0x60
ja 0x140009c3d
lea r9, [r10 + r10*4]
lea r9, [rax + r9*8]
movzx eax, word [rdx + rax + 0x14]
add rax, r9
add rax, 0x18
mov r9b, 1
cmp rax, r8
ja 0x140009c3d
mov qword [rcx], 1
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], r8
ret
mov r9b, 5
mov byte [rcx + 8], r9b
mov qword [rcx], 2
ret
lea r10, [rax + 0x78]
cmp r10, r8
ja 0x140009c7d
cmp r11d, 0x20b
je 0x140009dcc
mov r9b, 5
cmp r11d, 0x10b
jne 0x140009c3d
mov r9d, dword [rdx + rax + 0x74]
cmp r9d, 0x10
mov r11d, 0x10
cmovb r11d, r9d
lea r9, [r10 + r11*8]
cmp r9, r8
ja 0x140009c7d
movzx r10d, word [rdx + rax + 6]
mov r9b, 7
cmp r10, 0x60
ja 0x140009c3d
lea r9, [r10 + r10*4]
lea r9, [rax + r9*8]
movzx eax, word [rdx + rax + 0x14]
add rax, r9
add rax, 0x18
mov r9b, 1
cmp rax, r8
ja 0x140009c3d
mov qword [rcx], 0
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], r8
ret
mov r9b, 6
mov byte [rcx + 8], r9b
mov qword [rcx], 2
ret
Function at 0x14000bcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test byte [rdx], 1
je 0x14000bd10
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x14000be32
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x14000be41
cmp byte [rdx + 0x1a], 0
jne 0x14000be68
mov r8, qword [rdx + 8]
mov rax, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
movzx r10d, byte [rdx + 0x18]
jmp 0x14000bd37
add r8, r11
mov qword [rdx + 8], r8
mov r11d, r10d
xor r10b, 1
test r8, r8
je 0x14000bd66
cmp r8, r9
jae 0x14000bd60
cmp byte [rax + r8], 0xbf
jg 0x14000bd66
jmp 0x14000be76
jne 0x14000be76
cmp r8, r9
je 0x14000be4b
movzx ebx, byte [rax + r8]
movzx esi, bl
test sil, sil
js 0x14000bdc0
test r11b, 1
jne 0x14000be29
mov r11d, 1
cmp esi, 0x80
jb 0x14000bd30
mov r11d, 2
cmp esi, 0x800
jb 0x14000bd30
cmp esi, 0x10000
mov r11d, 4
sbb r11, 0
jmp 0x14000bd30
mov edi, esi
and edi, 0x1f
movzx ebp, byte [rax + r8 + 1]
and ebp, 0x3f
cmp sil, 0xdf
jbe 0x14000be07
movzx esi, byte [rax + r8 + 2]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp bl, 0xf0
jb 0x14000be1a
movzx ebx, byte [rax + r8 + 3]
and edi, 7
shl edi, 0x12
shl esi, 6
and ebx, 0x3f
or ebx, esi
or ebx, edi
mov esi, ebx
test r11b, 1
je 0x14000bd86
jmp 0x14000be29
shl edi, 6
or edi, ebp
mov esi, edi
test r11b, 1
je 0x14000bd86
jmp 0x14000be29
shl edi, 0xc
or esi, edi
test r11b, 1
je 0x14000bd86
mov byte [rdx + 0x18], r10b
mov r9, r8
jmp 0x14000be55
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
mov rdx, rax
call fcn.140004ab0
jmp 0x14000be6d
mov byte [rdx + 0x18], r10b
test r11b, 1
je 0x14000be64
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov eax, 1
jmp 0x14000be6a
mov byte [rdx + 0x1a], 1
xor eax, eax
mov qword [rcx], rax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov byte [rdx + 0x18], r10b
lea rcx, str._rustc_f6e511eec7342f59a25f7c0534f1dbea00d01b14librarycore_src_strpattern.rs
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, r9
call fcn.1400b1a40
int3
Function at 0x14004d2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rsi, rcx
movzx eax, byte [rsp + 0x100]
cmp r8d, 4
jae 0x14004d303
mov ecx, r8d
movzx r10d, byte [rdx + rcx + 0x10]
mov dword [rsp + 0x34], r8d
test r10d, r10d
je 0x14004d42c
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], r10d
jmp 0x14004d321
jne 0x14004d3db
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 6
lea rax, [rsp + 0x34]
mov qword [rsp + 0x58], rax
lea rax, [0x140029de0]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x3c]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
lea rax, str.Operand_:_expected_OpKind__OpKind::MemorySegDI__OpKind::MemorySegEDI_or_OpKind::MemorySegRDI
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 3
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 3
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x88]
call fcn.140025950
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp qword [rsi + 0x28], 0
je 0x14004d3ff
test rbx, rbx
je 0x14004d4a6
mov rcx, qword [0x14021f8e0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14004d4a6
mov byte [rsp + 0x20], al
mov rcx, rsi
mov edx, r8d
xor r8d, r8d
mov ebx, r9d
call fcn.14004d4c0
test al, al
je 0x14004d4a6
movzx eax, bl
neg eax
jmp 0x14004d478
mov r14, qword [rsp + 0x50]
cmp qword [rsi + 0x18], 0
je 0x14004d41e
mov r8, qword [rsi + 0x20]
mov rcx, qword [0x14021f8e0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsi + 0x18], rbx
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x28], r14
jmp 0x14004d4a6
movzx ebx, byte [rdx + rcx + 0x1c]
mov byte [rsp + 0x20], al
mov rcx, rsi
mov edx, r8d
mov r8d, ebx
mov edi, r9d
call fcn.14004d4c0
test al, al
je 0x14004d4a6
movzx eax, bl
movzx ecx, dil
sub eax, ecx
cmp dil, 1
jne 0x14004d478
cmp bl, 8
jbe 0x14004d468
add eax, 0xfffffffc
mov ecx, 0x40
jmp 0x14004d472
mov ecx, 0x800
cmp bl, 4
jbe 0x14004d478
or dword [rsi + 0x90], ecx
lea ecx, [rax*8]
and cl, 0x38
or byte [rsi + 0x96], cl
mov ecx, eax
shr ecx, 1
and ecx, 4
and eax, 0x10
shl eax, 5
or eax, ecx
or eax, dword [rsi + 0x90]
or eax, 0x10
mov dword [rsi + 0x90], eax
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140070da0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsp

Function at 0x1400749f0
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
Function at 0x140078c50
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140078c75
cmp rax, rcx
je 0x140078c7b
cmp rdx, 4
jae 0x140078c7f
xor eax, eax
xor r8d, r8d
jmp 0x140078d10
pop rbp
jmp fcn.140029180
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400b79b0]
movdqa xmm3, xmmword [0x1400b79c0]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140078ca0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140078d27
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140078d10
pop rbp
ret
Function at 0x14007fc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x14007fc67
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
pop rdx
jl 0x14007fc2c
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
setae cl
cmovb eax, edi
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
xor eax, eax
shr eax, 0x11
add eax, ecx
inc al
cmp al, 8
jbe 0x14007fc69
xor r15d, r15d
jmp case.0x140049404.935
mov al, 1
xor r15d, r15d
mov cl, 9
sub cl, al
movzx eax, cl
cmovb eax, r15d
movzx r12d, al
lea r14, [0x14020ad38]
mov ebx, 1
nop word [rax + rax]
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.14007f570
test rax, rax
jne 0x14007fdbe
inc r15
cmp r15, r12
jb 0x14007fc90
mov ecx, 0xa
lea rax, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
add eax, 0x18ac9a
cmp edi, 0x2710
jb 0x14007fd7d
mov r9d, 0xa
mov edx, 0xd1b71759
nop word cs:[rax + rax]
mov r8d, edi
imul r8, rdx
shr r8, 0x2d
imul ecx, r8d, 0x2710
mov r10d, edi
sub r10d, ecx
imul r11d, r10d, 0x147b
shr r11d, 0x13
imul ecx, r11d, 0x64
retf
sub r10d, ecx
movzx r10d, r10w
lea rcx, [r9 - 4]
movzx r11d, word [rax + r11*2]
mov word [rsp + r9 + 0x1c], r11w
sbb al, 0x46
movzx edx, word [rax + rdx*2]
mov word [rsp + r9 + 0x1e], r10w
mov r9, rcx
cmp edi, 0x5f5e0ff
mov edi, r8d
ja 0x14007fce0
mov edx, r8d
cmp r8d, 0x63
jbe 0x14007fd6c
movzx r8d, dx
shr r8d, 2
imul r8d, r8d, 0x147b
shr r8d, 0x11
imul r9d, r8d, 0x64
sub edx, r9d
movzx edx, dx
movzx edx, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], dx
add rcx, 0xfffffffffffffffe
mov rdx, r8
cmp edx, 0xa
jae 0x14007fd8b
or dl, 0x30
mov byte [rsp + rcx + 0x1f], dl
dec rcx
jmp 0x14007fd98
mov r8d, edi
mov edx, r8d
cmp r8d, 0x63
ja 0x14007fd3f
jmp 0x14007fd6c
movzx eax, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], ax
invalid
add rcx, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.14007f570
test rax, rax
je 0x14007fdc3
mov ebx, 1
mov rsi, rax
jmp 0x14007fdc8
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14007fde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x14007fe47
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
xchg byte [rcx], al
add byte [rdi], cl
xchg ebx, eax
ror dword [rdi], 0x42
invalid
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 7
jbe 0x14007fe49
xor r15d, r15d
jmp 0x14007fe82
mov al, 1
mov cl, 8
sub cl, al
movzx r12d, cl
xor r15d, r15d
lea r14, [0x14020ad38]
mov ebx, 1
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.14007f570
test rax, rax
jne case.0x140049404.965
inc r15
cmp r15, r12
jb 0x14007fe60
mov eax, 0xa
cmp edi, 0x270f
ja 0x14007feae
mov ecx, edi
cmp edi, 0x63
ja 0x14007feff
cmp ecx, 0xa
jae 0x14007ff39
or cl, 0x30
mov byte [rsp + rax + 0x1f], cl
dec rax
jmp 0x14007ff4d
mov eax, edi
mov ecx, 0xd1b71759
imul rcx, rax
shr rcx, 0x2d
imul eax, ecx, 0x2710
sub edi, eax
imul eax, edi, 0x147b
shr eax, 0x13
imul edx, eax, 0x64
sub edi, edx
movzx edx, di
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [r8 + rax*2]
mov word [rsp + 0x26], ax
movzx eax, word [r8 + rdx*2]
mov word [rsp + 0x28], ax
mov eax, 6
mov edi, ecx
mov ecx, edi
cmp edi, 0x63
jbe 0x14007fe96
movzx edx, cx
shr edx, 2
imul edx, edx, 0x147b
shr edx, 0x11
imul r8d, edx, 0x64
sub ecx, r8d
movzx ecx, cx
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [r8 + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov rcx, rdx
cmp ecx, 0xa
jb 0x14007fe9f
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
add eax, 0xfffffffe
Function at 0x14007ffa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x140080007
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
or cl, byte [rax - 0x3f]
call 0xc1d130f0
jmp qword [rax + 0xf000186]
xchg ebx, eax
ror dword [rdi], 0x42
invalid
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 6
jbe 0x140080009
xor r15d, r15d
jmp 0x140080042
mov al, 1
mov cl, 7
sub cl, al
movzx r12d, cl
xor r15d, r15d
lea r14, [0x14020ad38]
mov ebx, 1
Function at 0x140080160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x1400801c7
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
movabs al, byte [0x420fc1930f000186]
invalid
lea ecx, [rcx + rcx*4]
mov dword [rbp + 0x5fff690], ecx
add byte [rbp + rcx*4 - 0x80], al
pushfq
inc dword [rdi]
add byte [rcx + 0x21], al
ror byte [rbp + 0xdfc1890], 1
or eax, 0xd8f00500
invalid
invalid
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 5
jbe 0x1400801c9
xor r15d, r15d
jmp 0x140080212
mov al, 1
xor r15d, r15d
mov cl, 6
sub cl, al
movzx eax, cl
cmovb eax, r15d
movzx r12d, al
lea r14, [0x14020ad38]
mov ebx, 1
nop word [rax + rax]
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.14007f570
test rax, rax
jne 0x140080303
inc r15
cmp r15, r12
jb 0x1400801f0
mov eax, 0xa
cmp edi, 0x270f
ja 0x14008023e
mov ecx, edi
cmp edi, 0x63
ja 0x14008028f
cmp ecx, 0xa
jae 0x1400802c9
or cl, 0x30
mov byte [rsp + rax + 0x1f], cl
dec rax
jmp 0x1400802dd
add byte [rax], al
invalid
mov eax, edi
mov ecx, 0xd1b71759
imul rcx, rax
shr rcx, 0x2d
imul eax, ecx, 0x2710
sub edi, eax
imul eax, edi, 0x147b
shr eax, 0x13
imul edx, eax, 0x64
sub edi, edx
movzx edx, di
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [r8 + rax*2]
mov word [rsp + 0x26], ax
and al, 0x26
movzx eax, word [r8 + rdx*2]
mov word [rsp + 0x28], ax
and al, 0x28
mov eax, 6
mov edi, ecx
mov ecx, edi
cmp edi, 0x63
jmp qword [rbx + 0x76]
xchg edi, eax
movzx edx, cx
shr edx, 2
imul edx, edx, 0x147b
shr edx, 0x11
imul r8d, edx, 0x64
sub ecx, r8d
movzx ecx, cx
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [r8 + rcx*2]
mov word [rsp + rax + 0x1e], cx
mov dword [rsp + rax + 0x1e], ecx
add rax, 0xfffffffffffffffe
mov rcx, rdx
cmp ecx, 0xa
jb 0x14008022f
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rax
lea rdx, [rsp + rax]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.14007f570
test rax, rax
je 0x140080308
mov ebx, 1
mov rsi, rax
jmp 0x14008030d
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140080330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
in al, dx
mov rdi, rdx
Function at 0x140080500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
Function at 0x140084300
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14020d708]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140084371
invalid
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14008439e
test eax, eax
js 0x14008437d
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140084394
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x14020d770]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140083960
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140083af0
mov ecx, 7
int 0x29
ud2
Function at 0x14008b2c0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x50]
call fcn.14008b950
mov rcx, qword [rbp - 0x50]
mov rax, rcx
neg rax
jno 0x14008b399
mov rax, qword [rbp - 0x48]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x14008b387
lea rcx, [rax - 1]
mov qword [rbp + 0x400], rcx
mov rcx, qword [rax - 1]
mov qword [rbp + 0x410], rcx
mov rax, qword [rax + 7]
mov qword [rbp + 0x418], rax
mov rax, qword [rax]
test rax, rax
je 0x14008b342
mov rcx, qword [rbp + 0x410]
mov qword [rbp + 0x408], rsi
mov qword [rbp + 0x400], rcx
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x3e8], 0
mov dword [rbp + 0x3e8], 0

Function at 0x14008d0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
movdqa xmmword [rbp - 0x10], xmm6
mov rdi, r8
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov rbx, qword [rsi + 0x10]
xor r14d, r14d
mov eax, 0
cmp rbx, 3
jb 0x14008d131
movzx r8d, byte [rbx + rcx - 2]
mov r9d, r8d
and r9b, 0xf0
and cl, 0xf0
Function at 0x14009a7d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x40]
call fcn.14008b950
mov rax, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
mov rcx, rax
neg rcx
jno 0x14009a81d
mov qword [rbp - 0x20], rdi
movabs rax, 0x8000000000000000
mov qword [rbp - 0x28], rax
jmp 0x14009a84e
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x58]
call fcn.14009a6e0
mov rbx, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
mov rax, rbx
neg rax
jno 0x14009a8d5
mov eax, edi
and eax, 3
cmp eax, 1
jne 0x14009a8ba
lea rax, [rdi - 1]
mov qword [rbp - 0x10], rax
mov rax, qword [rdi - 1]
mov qword [rbp - 8], rax
mov rax, qword [rdi + 7]
mov qword [rbp], rax
mov rax, qword [rax]
test rax, rax
je 0x14009a87e
mov rcx, qword [rbp - 8]
call rax
mov r8, qword [rbp - 8]
mov rax, qword [rbp]
cmp qword [rax + 8], 0
je 0x14009a8a7
cmp qword [rax + 0x10], 0x11
jb 0x14009a898
mov r8, qword [r8 - 8]
mov rcx, qword [0x14021f8e0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x14021f8e0]
xor edx, edx
mov r8, qword [rbp - 0x10]
call qword [sym.imp.kernel32.dll_HeapFree]
movabs rax, 0x8000000000000000
mov qword [rsi], rax
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov r14, qword [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14009a8f4
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x14009a8c7
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
je 0x14009a8c7
mov rcx, qword [0x14021f8e0]
xor edx, edx
mov r8, rdi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp qword [sym.imp.kernel32.dll_HeapFree]