joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002934c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c944
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c944
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002949c
cmp rax, 0xffffffffffffffff
je 0x14002949c
xor edi, edi
test rbp, rbp
jle 0x140029447
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f258
mov rbx, rax
test rax, rax
jne 0x1400293d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002943d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a278
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d620
cmp eax, 0xffffffff
je 0x14002941d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400293e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a278
jmp 0x14002943d
cmp byte [rsi + 0x38], dil
je 0x140029434
cmp dword [rsi + 0x34], 5
jne 0x140029434
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002943d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b00c
jmp 0x1400294b0
jns 0x1400294b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c944
cmp rax, 0xffffffffffffffff
jne 0x140029468
cmp byte [rsi + 0x30], dil
je 0x1400294b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400294b0
mov ecx, r14d
call fcn.140018730
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400294b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400294b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400294a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400294ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c944
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001ac8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b12
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b14
xor al, al
add rsp, 0x28
ret
Function at 0x140067960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x1402e6010]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm6, dword [0x1402973e8]
mov rsi, rcx
mov rdx, qword [rcx + 0x68]
movaps xmm2, xmm6
call fcn.140065d80
mov rax, qword [rsi + 0x18]
movss xmm0, dword [rax + 0x88]
addss xmm0, xmm6
movss dword [rax + 0x88], xmm0
cmp byte [rsi + 0x78], 0
mov rax, qword [rsi + 0x18]
je 0x140067abd
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rdi
movaps xmmword [rsp + 0x50], xmm7
movss xmm7, dword [0x140297388]
movaps xmmword [rsp + 0x40], xmm8
movss xmm8, dword [rax + 0x88]
movaps xmm0, xmm8
addss xmm0, xmm7
movss dword [rax + 0x88], xmm0
mov rbp, qword [rsi + 0x50]
mov rdi, qword [rsi + 0x48]
cmp rdi, rbp
je 0x140067a47
mov qword [rsp + 0x88], rbx
nop dword [rax + rax]
mov rbx, qword [rdi]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + reloc.WSOCK32.dll_htonl]
test al, al
je 0x140067a36
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test al, al
je 0x140067a36
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x48]
add rdi, 8
cmp rdi, rbp
jne 0x140067a10
mov rbx, qword [rsp + 0x88]
mov rax, qword [rsi + 0x18]
xorps xmm0, xmm0
mov rcx, qword [rsi + 0x60]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm8
movss xmm6, dword [rax + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsi + 0x70]
addss xmm6, xmm7
movss dword [rsp + 0x28], xmm0
lea rdx, [rsp + 0x20]
movss dword [rsp + 0x2c], xmm6
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [rsi + 0x18]
movaps xmm8, xmmword [rsp + 0x40]
mov rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
movss xmm0, dword [rax + 0x88]
addss xmm0, xmm7
addss xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x50]
jmp 0x140067b08
movss xmm2, dword [rax + 0x88]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsi + 0x70]
xorps xmm0, xmm0
movss xmm1, dword [rsi + 0x3c]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm2
movss dword [rsp + 0x28], xmm1
movss dword [rsp + 0x2c], xmm2
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [rsi + 0x18]
movss xmm0, dword [rax + 0x88]
addss xmm0, dword [0x140297388]
movss dword [rax + 0x88], xmm0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140241980
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rsi
ret
Function at 0x1400a2820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1402e6010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rcx + 0xe28]
movzx esi, dl
mov byte [rcx + 0xf40], dl
mov rdi, rcx
test dl, dl
je 0x1400a286d
mov rdx, qword [rcx + 0xe40]
mov rcx, r14
mov rax, qword [r14]
call qword [rax + 0x100]
jmp 0x1400a2887
mov rbx, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rbx + 0xf8]
mov rdx, rax
mov rcx, r14
call qword [rbx + 0x100]
mov rcx, qword [rdi + 0xe30]
movzx edx, sil
xor dl, 1
mov rcx, qword [rcx + 0xc0]
call fcn.140210f20
mov rcx, qword [rdi + 0xed8]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rdi + 0xe70]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rbp, qword [rdi + 0xf18]
mov rbx, qword [rdi + 0xf10]
cmp rbx, rbp
je 0x1400a28f6
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
add rbx, 8
cmp rbx, rbp
jne 0x1400a28e0
mov rcx, qword [rdi + 0xf08]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rax, qword [rdi + 0xe30]
movzx edx, sil
mov rcx, qword [rax + 0x80]
mov rbx, qword [rcx + 0x418]
mov rcx, qword [rdi + 0xe68]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
test sil, sil
je 0x1400a296b
mov r8d, 0x101
call qword [rax + 0x18]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x68]
mov rcx, qword [rdi + 0xe28]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + 0x1e0]
jmp 0x1400a297f
mov r8d, 0xc0
call qword [rax + 0x18]
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x68]
cmp byte [rdi + 0xf40], 0
mov rax, qword [rdi + 0xe30]
mov rbx, qword [rax + 0x98]
je 0x1400a29bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xa8]
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
call qword [rax + 0x190]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140241980
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c3a20
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402e6010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rdx
cmp qword [rcx + 0x48], 0
je 0x1400c3a86
mov r8d, 1
lea rdx, [0x140282a60]
mov rcx, rbx
call fcn.14002a680
mov r8d, dword [rbx + 0x10]
inc r8d
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400c3a74
mov rdx, qword [rbx]
mov rax, qword [rdi + 0x48]
xor r9d, r9d
mov rcx, qword [rax + 0x10]
call qword [sym.imp.WSOCK32.dll_send]
nop
mov rcx, rbx
call fcn.140007550
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140241980
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c4590
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.140242b90
sub rsp, rax
mov rax, qword [0x1402e6010]
xor rax, rsp
mov qword [rbp + 0xf90], rax
mov rbx, rcx
mov word [rcx + 0x11], 0x100
mov byte [rcx + 0x10], 0
cmp dword [rcx + 0x20], 0x14
jae 0x1400c474a
mov qword [rcx + 0x3c], rdx
mov rax, rdx
shr rax, 0x20
movzx ecx, ax
movzx r10d, dl
mov eax, edx
shr eax, 8
movzx r9d, al
mov eax, edx
shr eax, 0x10
movzx r8d, al
shr edx, 0x18
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r10d
lea rcx, str.Trying_to_establish_UDP_Connection_with__d._d._d._d:_d_established_n
call fcn.1400c3630
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], reloc.WSOCK32.dll_ntohs
mov byte [rsp + 0x30], dil
mov eax, dword [rbx + 0x18]
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140297e00]
movdqa xmmword [rbp - 0x80], xmm1
mov byte [rsp + 0x70], dil
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], edi
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1400075d0
mov dword [rsp + 0x6c], reloc.WSOCK32.dll_sendto
mov eax, dword [rbp - 0x80]
add eax, 0x14
mov dword [rsp + 0x68], eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400c46c0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c46b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c46b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140241c74
nop dword [rax]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rcx, [rsp + 0x50]
call fcn.1400c44b0
mov rdi, qword [rbx + 0x48]
mov esi, dword [rsp + 0x68]
cmp qword [sym.imp.WSOCK32.dll_socket], 0
je 0x1400c4732
mov eax, 2
mov word [rsp + 0x30], ax
mov ecx, dword [rbx + 0x3c]
call qword [sym.imp.WSOCK32.dll_htonl]
mov dword [rsp + 0x34], eax
movzx ecx, word [rbx + 0x40]
call qword [sym.imp.WSOCK32.dll_htons]
mov word [rsp + 0x32], ax
mov dword [rsp + 0x28], reloc.WSOCK32.dll_recv
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, esi
lea rdx, [rbp - 0x70]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WSOCK32.dll_sendto]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x24], eax
inc dword [rbx + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140007550
jmp 0x1400c474f
call fcn.1400c4780
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.140241980
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400c48d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.140242b90
sub rsp, rax
mov rax, qword [0x1402e6010]
xor rax, rsp
mov qword [rsp + 0x1050], rax
cmp byte [rcx + 0x10], 0
mov rbx, rcx
je 0x1400c49cb
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfec
jae 0x1400c49cb
mov r8d, dword [rcx + 0x18]
inc r8d
mov byte [rsp + 0x43], 0
mov eax, r8d
mov byte [rsp + 0x42], r8b
sar eax, 0x10
mov byte [rsp + 0x40], al
mov eax, r8d
sar eax, 8
cmp qword [rdx + 0x18], 0x10
mov byte [rsp + 0x41], al
jb 0x1400c4947
mov rdx, qword [rdx]
mov r8, rdi
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rbx + 0x48]
add edi, 4
cmp qword [sym.imp.WSOCK32.dll_socket], 0
mov dword [rsp + 0x1040], edi
je 0x1400c49cb
mov ecx, dword [rbx + 0x3c]
mov eax, 2
mov word [rsp + 0x30], ax
call qword [sym.imp.WSOCK32.dll_htonl]
movzx ecx, word [rbx + 0x40]
mov dword [rsp + 0x34], eax
call qword [sym.imp.WSOCK32.dll_htons]
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x40]
mov word [rsp + 0x32], ax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], reloc.WSOCK32.dll_recv
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WSOCK32.dll_sendto]
cmp eax, edi
jne 0x1400c49cb
mov eax, dword [rsp + 0x1040]
add dword [rbx + 0x38], eax
mov al, 1
jmp 0x1400c49cd
xor al, al
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140241980
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400c5850
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rax, qword [rdx]
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov word [rcx + 0x20], si
mov qword [rcx + 0x28], rsi
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rsi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x50], rsi
mov qword [rcx + 0x58], rsi
mov qword [rcx + 0x60], rsi
mov qword [rcx + 0x68], rsi
mov qword [rcx + 0x70], rsi
mov qword [rcx + 0x78], rsi
mov qword [rcx + 0x80], rsi
add rcx, 0x88
lea edx, [rsi + 2]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
nop
xor eax, eax
mov word [rdi + 0xd8], ax
lea ecx, [rsi + 0x60]
call fcn.140241c38
mov rbx, rax
mov qword [rsp + 0x50], rax
mov dword [rax + 8], 1
lea rax, vtable.ClientConnection_TCP.0
mov qword [rbx], rax
mov dword [rbx + 0x14], 0x9233
mov eax, 0x927f
mov word [rbx + 0x18], ax
mov dword [rbx + 0x24], 0x2dc6c0
xorps xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], reloc.WSOCK32.dll_ntohs
mov byte [rbx + 0x28], sil
mov dword [rbx + 0x50], esi
mov word [rbx + 0x54], si
mov byte [rsp + 0x48], sil
lea ecx, [rsi + 0x18]
call fcn.140241c38
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x48]
movzx edx, word [rbx + 0x18]
mov rcx, rax
call fcn.1400c3690
nop
mov qword [rbx + 0x48], rax
cmp byte [rsp + 0x48], sil
je 0x1400c595f
test rax, rax
je 0x1400c597f
mov rcx, qword [rax]
mov r8, qword [rcx]
lea edx, [rsi + 1]
mov rcx, rax
call r8
jmp 0x1400c597f
mov word [rbx + 0x11], 0
mov byte [rbx + 0x13], 0
mov byte [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x58], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x5c], eax
mov qword [rdi + 8], rbx
mov byte [rsp + 0x48], 0
mov ecx, 0x18
call fcn.140241c38
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rcx, rax
call fcn.1400c4180
nop
mov qword [rdi + 0x18], rax
mov eax, esi
xchg byte [rdi + 0xd8], al
xchg byte [rdi + 0xd9], sil
mov rax, rdi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401081b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
test edx, edx
je 0x1401081f0
sub edx, 1
je 0x1401081ea
sub edx, 1
je 0x1401081e2
sub edx, 1
je 0x1401081da
cmp edx, 1
jne 0x1401081f0
lea r8d, [rdx + 0xf]
jmp 0x1401081f0
mov r8d, 8
jmp 0x1401081f0
mov r8d, 4
jmp 0x1401081f0
mov r8d, 2
mov rcx, qword [rcx + 0x138]
mov edx, r8d
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rcx, qword [rbx + 0x128]
lea rdx, [rbx + 8]
mov rcx, qword [rcx + 0xb8]
add rsp, 0x20
pop rbx
jmp fcn.140104090

Function at 0x140108220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor bl, bl
mov ebp, edx
mov r14, rcx
mov edi, 0x100
test edx, edx
je 0x14010825e
sub edx, 1
je 0x140108259
cmp edx, 1
jne 0x14010825e
mov edi, 0x400
jmp 0x14010825e
mov edi, 0x200
mov rax, qword [rcx + 0x128]
mov rsi, qword [rax + 0xa8]
mov rcx, rsi
mov rax, qword [rsi]
call qword [rax + 0x60]
mov r15d, 1
mov rcx, rsi
cmp eax, edi
mov rax, qword [rsi]
cmovne ebx, r15d
call qword [rax + 0x68]
movzx ebx, bl
mov edx, edi
cmp eax, edi
mov rcx, rsi
mov rax, qword [rsi]
cmovne ebx, r15d
call qword [rax + 0x78]
mov rax, qword [rsi]
mov edx, edi
mov rcx, rsi
call qword [rax + 0x80]
test ebp, ebp
je 0x1401082c8
sub ebp, r15d
je 0x1401082c1
cmp ebp, r15d
jne 0x1401082cd
mov edi, 0x800
jmp 0x1401082cd
mov edi, 0x5e8
jmp 0x1401082cd
mov edi, 0x400
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x70]
mov edx, edi
mov rcx, rsi
cmp eax, edi
mov rax, qword [rsi]
je 0x1401082ea
call qword [rax + 0x88]
jmp 0x1401082f4
call qword [rax + 0x88]
test bl, bl
je 0x140108300
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0xa8]
mov rcx, qword [r14 + 0x128]
lea rdx, [r14 + 8]
mov rcx, qword [rcx + 0xb8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.140104090

Function at 0x140108330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rbx, rcx
movss xmm6, dword [0x140297900]
test edx, edx
je 0x140108377
sub edx, 1
je 0x14010836d
sub edx, 1
je 0x140108363
cmp edx, 1
jne 0x14010837f
movss xmm6, dword [0x1402978fc]
jmp 0x14010837f
movss xmm6, dword [0x1402978f8]
jmp 0x14010837f
movss xmm6, dword [0x1402978f4]
jmp 0x14010837f
movss xmm6, dword [0x1402978f0]
mov rax, qword [rcx + 0x128]
mov rcx, qword [rax + 0x160]
movss dword [rax + 0x4cc], xmm6
test rcx, rcx
je 0x1401083a7
movaps xmm2, xmm6
mov edx, 1
call fcn.1402194c0
mov rax, qword [rbx + 0x128]
mov rcx, qword [rax + 0x160]
movss dword [rax + 0x4d0], xmm6
test rcx, rcx
je 0x1401083cf
movaps xmm2, xmm6
mov edx, 2
call fcn.1402194c0
mov rcx, qword [rbx + 0x128]
lea rdx, [rbx + 8]
mov rcx, qword [rcx + 0xb8]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
jmp fcn.140104090
Function at 0x1401083f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
movss xmm2, dword [0x1402978a0]
mov rbx, rcx
test edx, edx
je 0x140108421
sub edx, 1
je 0x140108419
cmp edx, 1
jne 0x140108421
movss xmm2, dword [0x1402978b4]
jmp 0x140108421
movss xmm2, dword [0x1402978ac]
mov rax, qword [rcx + 0x128]
mov rcx, qword [rax + 0x160]
movss dword [rax + 0x4d4], xmm2
test rcx, rcx
je 0x140108446
mov edx, 3
call fcn.1402194c0
mov rcx, qword [rbx + 0x128]
lea rdx, [rbx + 8]
mov rcx, qword [rcx + 0xb8]
add rsp, 0x20
pop rbx
jmp fcn.140104090
Function at 0x140108740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [rcx + 0x128]
mov rsi, qword [rax + 0x158]
test edx, edx
setne r8b
lea rbx, [rsi + 0x70]
mov rcx, qword [rbx]
test rcx, rcx
setne al
cmp al, r8b
je 0x1401087d5
test edx, edx
je 0x1401087bf
mov ecx, 0xa0
call fcn.140241c38
mov qword [rsp + 0x40], rax
movss xmm2, dword [0x140297238]
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call fcn.140009f00
mov rcx, rax
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1401087c6
mov r8, qword [rbx]
mov qword [rbx], rcx
test r8, r8
je 0x1401087d5
mov rax, qword [r8]
mov rcx, r8
jmp 0x1401087ce
mov qword [rbx], 0
test rcx, rcx
je 0x1401087d5
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rdx, [rdi + 8]
mov rcx, qword [rdi + 0x128]
mov rcx, qword [rcx + 0xb8]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140104090

Function at 0x140108800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [rcx + 0x128]
mov rsi, qword [rax + 0x158]
test edx, edx
setne r8b
lea rbx, [rsi + 0x30]
mov rcx, qword [rbx]
test rcx, rcx
setne al
cmp al, r8b
je 0x14010888d
test edx, edx
je 0x140108877
mov ecx, 0x98
call fcn.140241c38
mov qword [rsp + 0x40], rax
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call fcn.14000e7e0
mov rcx, rax
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x14010887e
mov r8, qword [rbx]
mov qword [rbx], rcx
test r8, r8
je 0x14010888d
mov rax, qword [r8]
mov rcx, r8
jmp 0x140108886
mov qword [rbx], 0
test rcx, rcx
je 0x14010888d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rdx, [rdi + 8]
mov rcx, qword [rdi + 0x128]
mov rcx, qword [rcx + 0xb8]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140104090
Function at 0x140122370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx ebx, dl
mov rdi, rcx
mov edx, ebx
mov byte [rcx + 0x173], bl
call fcn.14011d410
mov rcx, qword [rdi + 0x1c0]
movzx edx, bl
call fcn.14010e420
mov rcx, qword [rdi + 0x188]
movss xmm1, dword [0x140297414]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov rcx, qword [rdi + 0x230]
movzx esi, bl
xor sil, 1
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rax, qword [rdi + 0x178]
mov byte [rdi + 0x290], 1
mov rax, qword [rax + 0x158]
mov rcx, qword [rax + 0x90]
test bl, bl
je 0x14012244b
xor ebx, ebx
mov dword [rcx + 0x78], ebx
mov rcx, qword [rdi + 0x1d8]
mov rax, qword [rdi + 0x1e0]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x14012245e
mov rcx, qword [rcx + rbx*8]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rdi + 0x1d8]
inc rbx
mov rax, qword [rdi + 0x1e0]
sub rax, rcx
sar rax, 3
cmp rbx, rax
jb 0x140122410
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rcx + 0x78], 0x40a00000
movzx edx, sil
mov rcx, rdi
call fcn.14011d0a0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140242594
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402425de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402425de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402425de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402425de
cmp dword [rcx + 0x84], 0xe
jbe 0x1402425de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402425e0
xor al, al
add rsp, 0x28
ret