joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e480f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14010a4e0]
jne 0x1400da30a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400da306
repz ret
ror rcx, 0x10
jmp 0x1400e4768
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14010dc30]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14010dd28]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400e47ed
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14010dc30]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400e480f
mov rax, qword [rsp + 0x88]
mov qword [0x14010dd28], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14010dcc8], rax
mov rax, qword [0x14010dd28]
mov qword [0x14010dba0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14010dcb0], rax
mov dword [0x14010db90], 0xc0000409
mov dword [0x14010db94], 1
mov rax, qword [0x14010a4e0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14010a4e8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14010dc28], eax
mov ecx, 1
call fcn.1400e3954
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400ffd60]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14010dc28], 0
jne 0x1400e4896
mov ecx, 1
call fcn.1400e3954
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400e5ec8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400d78c8
xor ebx, ebx
mov rdi, rax
cmp qword [0x14010e108], rbx
jne 0x1400e5fce
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400e60a3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400e60a3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1400ffdc0]
mov rcx, rsi
mov qword [0x14010e108], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14010e110], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14010e118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14010e128], rax
test rax, rax
je 0x1400e5fc5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14010e120], rax
jmp 0x1400e5fd5
mov rax, qword [0x14010e120]
jmp 0x1400e5fdc
mov rax, qword [0x14010e120]
mov r11, qword [0x14010e128]
cmp rax, rdi
je 0x1400e6044
cmp r11, rdi
je 0x1400e6044
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14010e128]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400e6044
test rax, rax
je 0x1400e6044
call rsi
test rax, rax
je 0x1400e603e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400e603e
test byte [rsp + 0x38], 1
jne 0x1400e6044
bts ebp, 0x15
jmp 0x1400e6082
mov rcx, qword [0x14010e110]
cmp rcx, rdi
je 0x1400e6082
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400e6082
call rax
mov rbx, rax
test rax, rax
je 0x1400e6082
mov rcx, qword [0x14010e118]
cmp rcx, rdi
je 0x1400e6082
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400e6082
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14010e108]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400e60a3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400e60a5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140017510]
mov dword [rax], 1
mov rax, qword [0x140017520]
mov dword [rax], 1
mov rax, qword [0x140017530]
mov dword [rax], 1
mov rax, qword [0x1400174c0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001634
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov dword [rbp - 0x10], 0
mov rax, qword [rbp + 0x28]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::size() const
mov ebx, eax
mov rax, qword [rbp + 0x28]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::data() const
mov rcx, rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0x40000001
mov edx, ebx
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
lea rax, [rbp - 9]
mov qword [rbp - 8], rax
nop
nop
mov eax, dword [rbp - 0x10]
mov ecx, eax
lea rdx, [rbp - 9]
mov rax, qword [rbp + 0x20]
mov r9, rdx
mov r8d, 0
mov rdx, rcx
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::basic_string<std::allocator<wchar_t> >(unsigned long long, wchar_t, std::allocator<wchar_t> const&)
nop
mov rax, qword [rbp + 0x20]
mov edx, 0
mov rcx, rax
call dbg.std::__cxx11::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >::operator[](unsigned long long)
mov rbx, rax
mov rax, qword [rbp + 0x28]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::size() const
mov esi, eax
mov rax, qword [rbp + 0x28]
mov rcx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::data() const
mov rcx, rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8d, 0x40000001
mov edx, esi
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
call rax
nop
mov rax, qword [rbp + 0x20]
add rsp, 0x40
pop rbx
pop rsi
pop rbp
ret
Function at 0x140002c7e
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
lea rax, [dbg.e_start()]
mov qword [rbp - 0x28], rax
lea rax, [dbg.e_end()]
mov qword [rbp - 0x30], rax
lea rdx, [dbg.e_end()]
lea rax, [dbg.e_start()]
sub rdx, rax
mov rcx, rdx
lea rdx, [dbg.e_end()]
lea rax, [dbg.e_start()]
mov r9, rcx
mov r8, rdx
mov rdx, rax
lea rax, str._info__Encoded_data_at_0x_llx:0x_llx___llu_bytes__n
mov rcx, rax
call dbg.printf(char const*, ::)
mov rax, qword [rbp + 0x10]
pxor xmm0, xmm0
movups xmmword [rax], xmm0
movq qword [rax + 0x10], xmm0
lea rax, [dbg.e_start()]
mov qword [rbp - 8], rax
jmp 0x140002e4c
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
mov byte [rbp - 9], al
mov qword [rbp - 0x18], 4
cmp byte [rbp - 9], 0x55
jne 0x140002d1c
add qword [rbp - 8], 4
jmp 0x140002e4c
cmp byte [rbp - 9], 0x5d
jne 0x140002d2c
add qword [rbp - 8], 2
jmp 0x140002e4c
cmp byte [rbp - 9], 0x90
jne 0x140002d3c
add qword [rbp - 8], 1
jmp 0x140002e4c
cmp byte [rbp - 9], 0x66
jne 0x140002d59
mov qword [rbp - 0x18], 2
add qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
mov byte [rbp - 9], al
cmp byte [rbp - 9], 0xf
jne 0x140002d6e
add qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
mov byte [rbp - 9], al
cmp byte [rbp - 9], 4
je 0x140002d9a
cmp byte [rbp - 9], 0xaf
jbe 0x140002d80
cmp byte [rbp - 9], 0xb7
jbe 0x140002d9a
cmp byte [rbp - 9], 0xeb
je 0x140002d9a
cmp byte [rbp - 9], 0x6f
jbe 0x140002d94
movzx eax, byte [rbp - 9]
test al, al
jns 0x140002d9a
cmp byte [rbp - 9], 0xa8
jne 0x140002da4
mov qword [rbp - 0x18], 1
jmp 0x140002e17
cmp byte [rbp - 9], 5
je 0x140002e17
cmp byte [rbp - 9], 0xb8
je 0x140002e17
cmp byte [rbp - 9], 0xb9
je 0x140002e17
cmp byte [rbp - 9], 0xb9
jbe 0x140002dc2
cmp byte [rbp - 9], 0xbf
jbe 0x140002e17
cmp byte [rbp - 9], 0xe9
je 0x140002e17
movzx eax, byte [rbp - 9]
test al, al
jns 0x140002dd6
cmp byte [rbp - 9], 0x8f
jbe 0x140002e17
cmp byte [rbp - 9], 0xe8
je 0x140002e17
cmp byte [rbp - 9], 0xa9
je 0x140002e17
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x11
mov edx, 1
lea rax, str.Unexpected_opcode
mov rcx, rax
call sym.fwrite
mov ecx, 1
call sym.exit
add qword [rbp - 8], 1
mov dword [rbp - 0x1c], 0
jmp 0x140002e41
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov qword [rbp - 8], rdx
mov rcx, qword [rbp + 0x10]
mov rdx, rax
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::push_back(unsigned char const&)
add dword [rbp - 0x1c], 1
mov eax, dword [rbp - 0x1c]
cdqe
cmp rax, qword [rbp - 0x18]
jb 0x140002e25
lea rax, [dbg.e_end()]
cmp qword [rbp - 8], rax
jb 0x140002cfa
nop
mov rax, qword [rbp + 0x10]
add rsp, 0x50
pop rbp
ret
Function at 0x140004588
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x10], 0
jne 0x1400045b1
mov eax, 0
jmp 0x1400046c0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rbp - 0x38], rax
mov dword [rbp - 0xc], 0
jmp 0x1400046aa
mov eax, dword [rbp - 0xc]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x38]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rbp - 0x40], rax
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp + 0x18]
mov rcx, rax
call dbg.bool std::operator==<char, std::char_traits<char>, std::allocator<char> >(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, char const*)
test al, al
je 0x1400046a6
mov eax, dword [rbp - 0xc]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x24]
mov ecx, eax
mov rax, qword [rbp - 0x18]
add rax, rcx
add rax, rdx
movzx eax, word [rax]
mov word [rbp - 0x42], ax
movzx eax, word [rbp - 0x42]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x1c]
mov ecx, eax
mov rax, qword [rbp - 0x18]
add rax, rcx
add rax, rdx
mov eax, dword [rax]
mov dword [rbp - 0x48], eax
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x18]
mov eax, dword [rbp - 0x48]
mov r8, rcx
mov ecx, eax
call dbg.LookupProcAddress(unsigned int, unsigned long long, _IMAGE_NT_HEADERS64*)
mov qword [rbp - 8], rax
jmp 0x1400046bc
add dword [rbp - 0xc], 1
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x18]
mov edx, dword [rbp - 0xc]
cmp edx, eax
jb 0x14000460d
mov rax, qword [rbp - 8]
add rsp, 0x70
pop rbp
ret
Function at 0x140005154
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
mov dword [rbp - 0x1c], 0
mov dword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov eax, dword [rbp + 0x10]
movzx eax, ax
mov r8d, 0xa
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x1400051d7
lea rax, str._error__FindResource_n
mov rcx, rax
call fcn.140005100
call dbg.PrintError()
mov eax, 0
jmp 0x14000535d
mov rax, qword [rbp - 0x10]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140005215
lea rax, str._error__LoadResource_n
mov rcx, rax
call fcn.140005100
call dbg.PrintError()
mov eax, 0
jmp 0x14000535d
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x14000524e
lea rax, str._error__LockResource_n
mov rcx, rax
call fcn.140005100
call dbg.PrintError()
mov eax, 0
jmp 0x14000535d
mov rax, qword [rbp - 0x10]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x1c], 0
jne 0x14000528a
lea rax, str._error__SizeOfResource_n
mov rcx, rax
call fcn.140005100
call dbg.PrintError()
mov eax, 0
jmp 0x14000535d
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0xffffffffffffffff
jne 0x1400052ea
lea rax, str._error__WriteResourceToDisk.CreateFile_n
mov rcx, rax
call fcn.140005100
call dbg.PrintError()
mov eax, 0xffffffff
jmp 0x14000535d
lea r8, [rbp - 0x30]
mov ecx, dword [rbp - 0x1c]
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp - 0x2c], eax
cmp dword [rbp - 0x2c], 0
jne 0x140005338
lea rax, str._error__WriteResourceToDisk.WriteFile_n
mov rcx, rax
call fcn.140005100
call dbg.PrintError()
mov eax, 0
jmp 0x14000535d
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeResource]
call rax
mov eax, 1
add rsp, 0x70
pop rbp
ret

Function at 0x140005429
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x11
mov edx, 1
lea rax, str.__throw_bad_alloc
mov rcx, rax
call sym.fwrite
call sym.abort
nop
Function at 0x140005462
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x11
mov edx, 1
lea rax, str.__throw_bad_alloc
mov rcx, rax
call sym.fwrite
call sym.abort
nop

Function at 0x14000549f
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x13
mov edx, 1
lea rax, str.__throw_logic_error
mov rcx, rax
call sym.fwrite
call sym.abort
nop

Function at 0x1400054dc
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x14
mov edx, 1
lea rax, str.__throw_length_error
mov rcx, rax
call sym.fwrite
call sym.abort
nop

Function at 0x140005519
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rax, str.__throw_bad_array_new_length
mov rcx, rax
call sym.fwrite
call sym.abort
nop
Function at 0x140005c7d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0
jmp 0x140005d3e
mov eax, dword [rbp - 4]
add eax, 1
and eax, 0xff
mov dword [rbp - 4], eax
mov edx, dword [rbp - 4]
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, byte [rax]
movzx edx, al
mov eax, dword [rbp - 8]
add eax, edx
and eax, 0xff
mov dword [rbp - 8], eax
mov edx, dword [rbp - 8]
mov rax, qword [rbp + 0x10]
add rdx, rax
mov ecx, dword [rbp - 4]
mov rax, qword [rbp + 0x10]
add rax, rcx
mov rcx, rax
call dbg.Rc4Swap(unsigned char*, unsigned char*)
mov edx, dword [rbp - 0xc]
mov rax, qword [rbp + 0x18]
add rax, rdx
movzx r8d, byte [rax]
mov edx, dword [rbp - 4]
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx ecx, byte [rax]
mov edx, dword [rbp - 8]
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, byte [rax]
add eax, ecx
movzx edx, al
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx ecx, byte [rax]
mov edx, dword [rbp - 0xc]
mov rax, qword [rbp + 0x18]
add rax, rdx
mov edx, r8d
xor edx, ecx
mov byte [rax], dl
add dword [rbp - 0xc], 1
mov eax, dword [rbp - 0xc]
cmp eax, dword [rbp + 0x20]
jb 0x140005cab
nop
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140006170
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140006e42
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x14001d2e8]
test eax, eax
je 0x140006eda
lea rax, [0x14001d2c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x14001d2f0]
mov qword [rbp - 8], rax
jmp 0x140006ebe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140006eb2
cmp qword [rbp - 0x10], 0
je 0x140006eb2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140006e78
lea rax, [0x14001d2c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140006edb
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140006fe0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140007008
mov eax, 0
jmp 0x140007056
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140007031
mov eax, 0
jmp 0x140007056
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140007051
mov eax, 0
jmp 0x140007056
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14000705c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400070da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400070d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400070d1
mov rax, qword [rbp - 8]
jmp 0x1400070ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400070a4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140007520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
cmp qword [rbp + 0x20], 0
je 0x140007541
mov rax, qword [rbp + 0x10]
cmp rax, qword [rbp + 0x18]
jne 0x140007548
mov eax, 0
jmp 0x1400075c2
cmp qword [rbp + 0x10], 0
setne dl
cmp qword [rbp + 0x18], 0
setne al
xor eax, edx
test al, al
je 0x1400075b6
cmp qword [rbp + 0x18], 0
jne 0x14000756c
mov eax, 1
jmp 0x1400075c2
mov eax, 0xffffffff
jmp 0x1400075c2
mov rax, qword [rbp + 0x10]
movzx edx, word [rax]
mov rax, qword [rbp + 0x18]
movzx eax, word [rax]
cmp dx, ax
je 0x1400075a7
mov rax, qword [rbp + 0x10]
movzx edx, word [rax]
mov rax, qword [rbp + 0x18]
movzx eax, word [rax]
cmp dx, ax
jae 0x1400075a0
mov eax, 0xffffffff
jmp 0x1400075c2
mov eax, 1
jmp 0x1400075c2
add qword [rbp + 0x10], 2
add qword [rbp + 0x18], 2
sub qword [rbp + 0x20], 1
cmp qword [rbp + 0x20], 0
jne 0x140007573
mov eax, 0
pop rbp
ret