joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001d814
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, qword [r8 + 0x60]
xor ebx, ebx
mov r13, r9
mov r12, rdx
mov r14, rcx
test rsi, rsi
je 0x10001d9a7
xor eax, eax
mov dword [rsp + 0x30], eax
test rcx, rcx
je 0x10001d866
cmp qword [rcx + 0x40], rbx
mov rax, rcx
cmovne rax, qword [rcx + 0x40]
mov eax, dword [rax + 0x28]
bt eax, 0x12
jae 0x10001d9a7
mov edx, 0x80
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r15d, r15d
cmp rsi, r15
je 0x10001d98e
mov r9, qword [rsi]
mov rdi, r15
mov qword [rsp + 0x30], r15
mov rbp, r15
cmp word [r9], r15w
je 0x10001d8b7
lea rdx, [0x10000ee80]
lea rcx, [rsp + 0x30]
mov r8, r12
call fcn.1000132ac
mov r13, r15
jmp 0x10001d8d7
cmp r13, r15
je 0x10001d8de
cmp qword [r13], 0xffffffffffffffff
je 0x10001d8de
lea rdx, [0x10000ee8c]
lea rcx, [rsp + 0x30]
mov r8, r12
call fcn.1000132ac
mov rdi, qword [rsp + 0x30]
mov ebx, eax
cmp ebx, r15d
jl 0x10001d94f
cmp rdi, r15
je 0x10001d90f
xor edx, edx
mov rcx, rdi
call fcn.100016f54
mov rbp, rax
cmp rax, r15
jne 0x10001d90f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp ebx, r15d
jl 0x10001d94f
cmp rbp, r15
je 0x10001d94f
lea rdx, [rsi + 0x18]
xor r9d, r9d
mov r8, rbp
mov rcx, r14
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
call fcn.100020024
cmp eax, r15d
jne 0x10001d94f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r15d
cmovle ebx, eax
cmp rdi, r15
je 0x10001d968
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbp, r15
je 0x10001d981
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, r15d
mov rsi, qword [rsi + 0x30]
jge 0x10001d881
mov r15, qword [rsp + 0x80]
mov rcx, r12
mov edx, dword [r15 + 0x1c]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, ebx
jmp 0x10001d9a9
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x10001e7a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x60
xor eax, eax
mov rbp, rcx
xor r14d, r14d
mov word [r11 - 0x38], r14w
mov qword [r11 - 0x36], rax
mov rcx, r9
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov rdi, r9
mov r13, r8
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10001e7f6
mov rcx, rdi
call fcn.1000177b8
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
cmp al, r14b
je 0x10001e94b
movzx ebx, word [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx + 0x18]
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, r14
je 0x10001e8e7
movzx r8d, word [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
xor eax, eax
lea rcx, [rsi + 0x14]
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
call fcn.10003974c
mov byte [rsi], r14b
mov qword [rsi + 8], r14
movzx eax, word [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov dword [rsi + 0x10], eax
movzx r9d, word [rsp + 0x40]
mov r8, rsi
mov rcx, r13
add r9d, 0x18
mov dword [rsp + 0x20], 0xb
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
cmp eax, r14d
mov ebx, eax
jl 0x10001e89e
mov ebx, r14d
jmp 0x10001e8d1
lea rax, [0x10000f1e0]
bts ebx, 0x1c
mov dword [rsp + 0x30], 0x13f5
mov qword [rsp + 0x28], rax
lea r9, [0x10000f200]
mov r8, r12
mov rdx, rbp
mov ecx, 1
mov dword [rsp + 0x20], ebx
call fcn.100018010
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10001e92b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], 0x13ff
lea r9, [0x10000ef60]
movzx ebx, ax
mov r8, rdi
mov rdx, rbp
or ebx, 0x80070000
cmp eax, r14d
mov ecx, 1
cmovle ebx, eax
lea rax, [0x10000f1e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.100018010
mov rax, qword gs:[0x30]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x10001e97f
lea rax, [0x10000f1e0]
mov dword [rsp + 0x30], 0x1409
lea r9, [0x10000f230]
mov qword [rsp + 0x28], rax
mov ebx, 0x80070003
mov r8, rdi
mov rdx, rbp
mov ecx, 1
mov dword [rsp + 0x20], ebx
call fcn.100018010
lea r11, [rsp + 0x60]
cmp ebx, r14d
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
cmovge ebx, r14d
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x10001f490
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor ebx, ebx
mov edi, 0xffffffff
mov r13, r8
mov dword [rax - 0x38], ebx
mov rax, qword [rax + 0x28]
mov r12, rdx
mov rbp, rbx
cmp rax, rdi
ja 0x10001f4c9
mov edi, eax
mov r9d, ebx
jmp 0x10001f4cf
mov r9d, 0x80070216
cmp rcx, rbx
je 0x10001f643
cmp r8, rbx
jne 0x10001f4e7
cmp rdx, 0xffffffffffffffff
je 0x10001f643
cmp r9d, ebx
jl 0x10001f643
cmp rax, rbx
je 0x10001f643
mov rsi, qword [rcx + 0x1d0]
cmp rsi, rbx
je 0x10001f643
mov rcx, rsi
call fcn.1000302f8
cmp r12, 0xffffffffffffffff
jne 0x10001f51f
mov r8d, edi
mov rdx, r13
jmp 0x10001f595
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x70], ebx
mov r13d, edi
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
cmp rax, rbx
je 0x10001f5a1
mov edx, dword [rsp + 0x88]
lea r8, [rsp + 0x34]
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, ebx
je 0x10001f5a1
lea r9, [rsp + 0x70]
mov r8d, edi
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x10001f5a1
cmp dword [rsp + 0x70], edi
jne 0x10001f5a1
mov r8, r13
mov rdx, rbp
mov rcx, rsi
call fcn.1000301ac
mov edi, eax
jmp 0x10001f5d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, 0x80070000
mov r11d, eax
movzx eax, ax
or eax, r12d
cmp r11d, ebx
cmovle eax, r11d
cmp eax, ebx
jge 0x10001f5d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, r12d
cmp eax, ebx
cmovle edi, eax
jmp 0x10001f5d9
mov edi, 0x80004005
cmp edi, ebx
jl 0x10001f60a
lea r8, [rsp + 0x30]
lea rdx, [0x10000f5f8]
mov rcx, rsi
call fcn.1000303b4
cmp eax, ebx
mov edi, eax
jl 0x10001f60a
mov rcx, qword [rsp + 0x98]
cmp rcx, rbx
je 0x10001f60a
mov eax, dword [rsp + 0x30]
mov dword [rcx], eax
cmp rbp, rbx
je 0x10001f623
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp edi, ebx
jge 0x10001f63c
movzx edx, di
mov ecx, 0x1f
cmp edx, ebx
cmovne ecx, edx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
setge bl
mov eax, ebx
jmp 0x10001f650
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1000225ec
Capabilities:
Get file size

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x80
mov rax, qword [0x10005c100]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r13d, r13d
xor eax, eax
mov rbx, r9
mov byte [r11 - 0x50], r13b
mov qword [r11 - 0x4f], rax
mov qword [r11 - 0x47], rax
mov dword [r11 - 0x60], r13d
mov word [rsp + 0x69], ax
mov byte [rsp + 0x6b], al
mov dword [rsp + 0x4c], eax
mov rsi, r8
mov rbp, rdx
mov r12, rcx
mov edi, r13d
mov qword [r11 - 0x58], r13
mov dword [r11 - 0x68], r13d
cmp rcx, r13
je 0x1000227bc
cmp rdx, 0xffffffffffffffff
je 0x1000227bc
cmp r8, r13
je 0x1000227bc
cmp word [r8], r13w
je 0x1000227bc
cmp rbx, r13
je 0x1000227bc
lea rdx, [r11 - 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, r13d
je 0x10002277a
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0x48]
cmp rcx, r13
je 0x1000226a9
cmp rax, qword [rcx]
jne 0x10002277a
mov r8, qword [rbx]
lea rdx, [0x10005d5e0]
cmp r8, qword [rdx]
jne 0x1000226d1
mov r8, qword [rbx + 8]
cmp r8, qword [rdx + 8]
jne 0x1000226d1
mov r8d, dword [rbx + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1000226d1
mov ecx, r13d
jmp 0x1000226d6
sbb ecx, ecx
sbb ecx, 0xffffffff
cmp ecx, r13d
jne 0x1000226ea
cmp rax, r13
jne 0x1000226ea
mov edi, 1
jmp 0x1000227b8
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
call fcn.1000199ec
cmp eax, r13d
je 0x100022773
mov eax, dword [rsp + 0x40]
mov r9, qword [0x10005d610]
mov r8, qword [rsp + 0x48]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov rdx, rbp
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.100024efc
cmp eax, r13d
je 0x100022773
mov rcx, qword [rbx]
lea rax, [rsp + 0x58]
cmp rcx, qword [rax]
jne 0x100022765
mov rcx, qword [rbx + 8]
cmp rcx, qword [rax + 8]
jne 0x100022765
mov ecx, dword [rbx + 0x10]
cmp ecx, dword [rax + 0x10]
jne 0x100022765
mov eax, r13d
jmp 0x10002276a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, r13d
je 0x1000226e0
mov ebx, 0x241
jmp 0x1000227b0
lea rax, [0x10000f6d8]
mov dword [rsp + 0x30], 0x1017
mov ebx, 0xd
mov qword [rsp + 0x28], rax
lea r9, [0x10000f700]
lea ecx, [rbx - 0xc]
mov r8, rsi
mov rdx, r12
mov dword [rsp + 0x20], 0x8007000d
call fcn.100018010
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x1000227c9
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1000391d0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x100022e40
Capabilities:
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x40
or qword [r11 + 8], 0xffffffffffffffff
mov rsi, r9
mov r13, r8
mov rbp, rdx
mov r12, rcx
test rcx, rcx
je 0x100022f25
test rdx, rdx
je 0x100022f25
test r9, r9
je 0x100022f25
lea rcx, [r8 + 0x18]
mov rax, r8
mov r8, qword [rsp + 0x80]
neg rax
lea rax, [r11 + 8]
mov dword [rsp + 0x30], 1
sbb rdx, rdx
mov qword [r11 - 0x30], rax
mov r9d, 0x4a200000
and rdx, rcx
mov rcx, r12
mov qword [r11 - 0x38], rdx
mov rdx, rsi
call fcn.1000227f4
mov rbx, qword [rsp + 0x60]
mov edi, eax
test eax, eax
je 0x100022f05
mov eax, dword [rsp + 0x90]
mov r9, rbx
mov r8, r13
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov rcx, r12
mov qword [rsp + 0x20], rsi
call fcn.100022abc
mov edi, eax
test eax, eax
je 0x100022f05
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x100022f05
mov qword [rax], rbx
jmp 0x100022f21
cmp rbx, 0xffffffffffffffff
je 0x100022f21
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x100022f21
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
jmp 0x100022f32
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x100024dec
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
and dword [rax - 0x18], 0
xor ebx, ebx
mov rsi, r9
mov r12d, r8d
mov rbp, rcx
cmp dword [rsp + 0x70], ebx
je 0x100024e39
cmp rcx, qword [0x10005c4b0]
mov qword [rax - 0x28], r9
lea r9, [rax - 0x18]
cmove rcx, qword [0x10005c4b8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100024e81
mov rax, qword [0x10005c4b0]
cmp rcx, rax
jne 0x100024e66
cmp dword [0x10005d5f4], ebx
je 0x100024e66
mov rcx, qword [0x10005c4b8]
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x30]
call qword [0x10005d630]
jmp 0x100024e81
cmp rbp, rax
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x30]
cmove rcx, qword [0x10005c4b8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
test eax, eax
jne 0x100024eba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rsi, rsi
je 0x100024ec3
cmp eax, 0x3e5
jne 0x100024ec3
lea ebx, [rdi + 1]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov r9d, ebx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x100024eec
mov edi, ebx
xor ebx, ebx
cmp r12d, dword [rsp + 0x30]
je 0x100024ecf
xor edi, edi
test ebx, ebx
je 0x100024ecf
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100024ec3
Function at 0x100026324
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x10005c100]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebx, ebx
call fcn.1000193d4
test rcx, rcx
je 0x1000263ff
mov r8d, 0xfeedf001
mov edx, 0xfeedf002
cmp eax, r8d
je 0x100026367
cmp eax, edx
jne 0x1000263ff
call fcn.1000193d4
cmp eax, r8d
je 0x100026381
cmp eax, edx
jne 0x1000263fa
call fcn.100019360
mov rcx, rax
test rcx, rcx
je 0x1000263fa
mov rcx, qword [rcx + 0x208]
test rcx, rcx
je 0x1000263fa
lea r9, [rsp + 0x20]
lea rdx, [0x10000ea78]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1000263fa
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rbx, eax
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1000263fa
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, [rsp + 0x20]
mov rcx, rbx
inc eax
movsxd rdx, eax
call fcn.100012fb4
mov rax, rbx
jmp 0x10002640e
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_SetLastError]
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1000391d0
add rsp, 0x240
pop rbx
ret
Function at 0x1000264d8
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov rsi, rdx
mov r14, rcx
xor edi, edi
mov qword [rax - 0x48], rdi
xor ebx, ebx
mov dword [rax - 0x58], ebx
and dword [rax - 0x54], ebx
test rcx, rcx
je 0x1000266e7
cmp rdx, 0xffffffffffffffff
je 0x1000266e7
lea rdx, [rax + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x100026530
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1000266ec
cmp dword [rsp + 0x94], ebx
je 0x100026543
mov ebx, 0xd
jmp 0x1000266ec
and qword [rsp + 0x28], rbx
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x100026582
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1000266ec
and qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
mov qword [rsp + 0xa8], rax
test rax, rax
jne 0x1000265c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000266ec
mov rdx, r14
mov rcx, rax
call fcn.100027228
mov r13, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x10002665f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8d, 0xb0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x100026651
xor edx, edx
mov r8d, 0xb0
mov rcx, rax
call fcn.100039740
mov dword [rdi + 0x1c], 0x10
mov qword [rsp + 0x20], rdi
mov r9, rdi
mov r8, r13
mov rdx, r12
mov rcx, r14
call fcn.100026714
test eax, eax
jne 0x10002666b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x30], eax
mov rcx, rdi
call fcn.100025630
xor edi, edi
mov qword [rsp + 0x40], rdi
jmp 0x10002666b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x10002666b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x30], eax
jmp 0x1000266c4
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1000266e2
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x1000266f6
mov ebx, 0x57
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x100027430
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp dword [0x10005d648], 0
jne 0x1000274f2
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp], rdi
mov esi, 0x7fff
mov edx, 0x13579bdf
mov r8d, 0x87654321
lea r9, [0x10005cf10]
lea rbp, [0x10005d510]
xor r10d, r10d
mov r11d, r8d
mov ebx, edx
lea edi, [r10 + 0x20]
nop
sub r10d, 0x61c88647
mov ecx, r8d
sar ecx, 5
add r11d, r10d
add ebx, r10d
add ecx, ebx
lea eax, [r11 + r8*8]
xor ecx, eax
lea eax, [r10 + r8]
xor ecx, eax
add edx, ecx
mov eax, edx
sar eax, 5
lea ecx, [rbx + rdx*8]
add eax, r11d
xor ecx, eax
lea eax, [r10 + rdx]
xor ecx, eax
add r8d, ecx
sub edi, 1
jne 0x100027480
add edx, r8d
add r9, 2
movzx eax, dx
and ax, si
mov word [r9 - 2], ax
cmp r9, rbp
jb 0x100027472
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov dword [0x10005d648], 1
add rsp, 8
ret

Function at 0x100027500
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9, qword [rcx - 0x20]
mov rdx, qword [rcx - 0x28]
xor ebx, ebx
sub r9, 2
mov r11, rcx
mov r10d, ebx
cmp rdx, r9
jae 0x100027584
mov qword [rsp + 0x10], rdi
lea rdi, [0x10005cf10]
nop word [rax + rax]
movzx eax, byte [rdx + 2]
lea r8, [rdx + 1]
movzx ecx, word [rdi + rax*2 + 0x400]
movzx eax, byte [rdx]
movzx eax, word [rdi + rax*2]
xor ecx, eax
movzx eax, byte [r8]
movzx eax, word [rdi + rax*2 + 0x200]
xor ecx, eax
movsxd rdx, ecx
movsxd rcx, r10d
movzx eax, word [r11 + rdx*2 - 0x18288]
mov word [r11 + rcx*2], ax
mov word [r11 + rdx*2 - 0x18288], r10w
inc r10d
mov rdx, r8
cmp r8, r9
jb 0x100027530
mov rdi, qword [rsp + 0x10]
add r9, 2
cmp rdx, r9
jae 0x1000275a1
sub r9, rdx
movsxd rax, r10d
inc r10d
sub r9, 1
mov word [r11 + rax*2], bx
jne 0x100027590
pop rbx
ret
Function at 0x100029efc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x10
mov rax, qword [0x10005c100]
xor rax, rsp
mov qword [rsp + 8], rax
cmp r8d, 6
mov r9, rcx
jg 0x100029f26
add dword [rcx + 0x2ed8], r8d
jmp 0x10002a000
lea rcx, [rsp]
movsxd r10, r8d
add r10, rdx
mov eax, dword [r10 - 6]
mov dword [rcx], eax
movzx eax, word [r10 - 2]
mov word [rcx + 4], ax
lea eax, [r8 - 6]
movsxd rcx, eax
movabs rax, 0xe8e8e8e8e8e8e8e8
mov dword [rcx + rdx], eax
mov word [rcx + rdx + 4], ax
mov eax, dword [r9 + 0x2ed8]
lea r11d, [rax + r8 - 0xa]
jmp 0x100029f70
inc rdx
inc dword [r9 + 0x2ed8]
cmp byte [rdx], 0xe8
jne 0x100029f66
mov r8d, dword [r9 + 0x2ed8]
cmp r8d, r11d
jae 0x100029fe2
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 4]
mov ebx, dword [r9 + 0x2ed4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
cmp ecx, ebx
jae 0x100029fb0
sub ecx, r8d
jmp 0x100029fbb
mov eax, ecx
neg eax
cmp eax, r8d
ja 0x100029fd4
add ecx, ebx
mov eax, ecx
mov byte [rdx + 1], cl
shr eax, 8
mov byte [rdx + 2], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rdx + 4], cl
mov byte [rdx + 3], al
add rdx, 5
add dword [r9 + 0x2ed8], 5
jmp 0x100029f70
lea eax, [r11 + 0xa]
lea rcx, [rsp]
mov dword [r9 + 0x2ed8], eax
mov eax, dword [rcx]
mov dword [r10 - 6], eax
movzx eax, word [rcx + 4]
mov word [r10 - 2], ax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1000391d0
add rsp, 0x10
pop rbx
ret
Function at 0x10002d350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x10
mov rax, qword [0x10005c100]
xor rax, rsp
mov qword [rsp + 8], rax
cmp r8d, 9
mov r9, rcx
jg 0x10002d37e
add dword [rcx + 0x9d4], r8d
jmp 0x10002d45d
lea rcx, [rsp]
movsxd r11, r8d
add r11, rdx
mov eax, dword [r11 - 6]
mov dword [rcx], eax
movzx eax, word [r11 - 2]
mov word [rcx + 4], ax
lea eax, [r8 - 6]
movsxd rcx, eax
movabs rax, 0xe8e8e8e8e8e8e8e8
mov dword [rcx + rdx], eax
mov word [rcx + rdx + 4], ax
mov eax, dword [r9 + 0x9d4]
lea edi, [rax + r8 - 0xa]
jmp 0x10002d3c8
inc rdx
inc dword [r9 + 0x9d4]
cmp byte [rdx], 0xe8
jne 0x10002d3be
mov r8d, dword [r9 + 0x9d4]
cmp r8d, edi
jae 0x10002d440
movzx eax, byte [rdx + 3]
movzx ebx, byte [rdx + 4]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 1]
shl ebx, 8
or ebx, eax
lea ecx, [r8 + rbx]
test ecx, ecx
js 0x10002d432
mov r10d, dword [r9 + 0x8a4]
lea eax, [r10 + r8]
cmp ecx, eax
jae 0x10002d432
cmp ecx, r10d
jb 0x10002d419
mov ecx, ebx
sub ecx, r10d
mov eax, ecx
mov byte [rdx + 1], cl
shr eax, 8
mov byte [rdx + 2], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rdx + 4], cl
mov byte [rdx + 3], al
add rdx, 5
add dword [r9 + 0x9d4], 5
jmp 0x10002d3c8
lea rcx, [rsp]
mov eax, dword [rcx]
mov dword [r11 - 6], eax
movzx eax, word [rcx + 4]
mov word [r11 - 2], ax
lea eax, [rdi + 0xa]
mov dword [r9 + 0x9d4], eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1000391d0
mov rbx, qword [rsp + 0x38]
add rsp, 0x10
pop rdi
ret