joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180070d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x40
mov eax, 0x6c1af97e
mov r8d, 0xca13c4d4
jmp 0x180070d40
mov rax, qword [rsp + 0x20]
movzx edx, word [rsp + 8]
mov word [rax], dx
mov eax, 0xea774f4b
mov r9, qword [rsp + 0x18]
nop dword [rax + rax]
cmp eax, 0xea774f4a
jg 0x180070d70
cmp eax, 0xc78c0751
jg 0x180070df0
cmp eax, 0x993a5301
je 0x180070d21
cmp eax, 0xc17acc12
jne 0x180070ee7
mov eax, 0xea774f4b
xor r9d, r9d
jmp 0x180070d40
cmp eax, 0x66816cd2
jg 0x180070e30
cmp eax, 0xea774f4b
je 0x180070e50
cmp eax, 0xd078794
jne 0x180070d40
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x18]
lea rax, [rax + rdx*2]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
mov dword [rsp + 0xc], eax
mov eax, 0x6cbc4122
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp eax, 0x8d8460a7
je 0x180070e6c
cmp eax, 0x6cbc4122
jne 0x180070dc0
movzx eax, word [rcx]
mov word [rsp + 4], ax
mov eax, 0x8d8460a7
jmp 0x180070dc0
cmp eax, 0xc78c0752
je 0x180070ea2
cmp eax, 0xca13c4d4
jne 0x180070d40
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x18], rax
mov eax, 0xd078794
jmp 0x180070d40
cmp eax, 0x66816cd3
je 0x180070ec5
cmp eax, 0x6c1af97e
jne 0x180070d40
mov eax, 0xc17acc12
jmp 0x180070d40
mov qword [rsp + 0x28], r9
mov rax, qword [rsp + 0x28]
cmp rax, 2
mov eax, 0x66816cd3
cmovb eax, r8d
jmp 0x180070d40
movzx eax, word [rsp + 4]
mov word [rsp + 0xa], ax
mov eax, 0x1d0c7a05
nop dword [rax + rax]
cmp eax, 0xc5f8a757
je 0x180070ed4
cmp eax, 0x1d0c7a05
jne 0x180070e80
movzx eax, word [rsp + 0xa]
xor eax, dword [rsp + 0xc]
mov dword [rsp + 4], eax
mov eax, 0xc5f8a757
jmp 0x180070e80
mov rax, qword [rsp + 0x10]
mov word [rax + 6], 0
mov rax, qword [rsp + 0x10]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, 0xa8a7f3d5
jmp 0x180070d40
mov qword [rsp + 0x10], rcx
mov eax, 0xc78c0752
jmp 0x180070d40
mov eax, dword [rsp + 4]
mov word [rsp + 8], ax
mov eax, 0x993a5301
jmp 0x180070d40
cmp eax, 0xa8a7f3d5
jne 0x180070d40
mov rax, qword [rsp + 0x30]
add rsp, 0x40
ret
Function at 0x180071bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov eax, 0xaa320b49
mov r8d, 0x259c302a
jmp 0x180071be0
mov eax, 0x9bc6bb3f
mov r9, qword [rsp + 8]
nop dword [rax + rax]
cmp eax, 0x15494acf
jg 0x180071c10
cmp eax, 0xcd1c2a77
jle 0x180071c40
cmp eax, 0xd8f36f62
je 0x180071bd1
cmp eax, 0xbbb0eb9
jne 0x180071d6f
mov eax, 0x9bc6bb3f
xor r9d, r9d
jmp 0x180071be0
cmp eax, 0x259c3029
jg 0x180071c60
cmp eax, 0x15494ad0
je 0x180071c7c
cmp eax, 0x1fd75c16
jne 0x180071be0
mov rax, qword [rsp + 0x18]
add rax, 2
mov qword [rsp + 0x20], rax
mov eax, 0xcd1c2a78
jmp 0x180071be0
cmp eax, 0x9bc6bb3f
je 0x180071c91
cmp eax, 0xaa320b49
jne 0x180071be0
mov eax, 0xbbb0eb9
jmp 0x180071be0
cmp eax, 0x259c302a
je 0x180071cad
cmp eax, 0x5dc2dc08
jne 0x180071be0
mov eax, 0xd8f36f62
jmp 0x180071be0
mov word [rcx + 0x5c], 0
mov qword [rsp + 0x18], rcx
mov eax, 0x1fd75c16
jmp 0x180071be0
mov qword [rsp + 0x10], r9
mov rax, qword [rsp + 0x10]
cmp rax, 0x2d
mov eax, 0x15494ad0
cmovb eax, r8d
jmp 0x180071be0
mov rax, qword [rsp + 0x10]
add rax, 1
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movzx r10d, word [rcx + rax*2]
mov edx, 0x2bf6cdf0
nop word [rax + rax]
cmp edx, 0x64300212
je 0x180071d5d
cmp edx, 0x2bf6cdf0
jne 0x180071cd0
mov edx, 0x2dfd4f46
nop dword [rax]
cmp edx, 0x36642f7
je 0x180071d4b
cmp edx, 0x2dfd4f46
jne 0x180071cf0
mov qword [rsp + 0x28], rcx
mov edx, 0x18793e71
nop word [rax + rax]
cmp edx, 0xe895f03a
je 0x180071d34
cmp edx, 0x18793e71
jne 0x180071d10
mov rdx, qword [rsp + 0x28]
movzx edx, word [rdx]
mov word [rsp + 2], dx
mov edx, 0xe895f03a
jmp 0x180071d10
movzx edx, word [rsp + 2]
xor dx, r10w
movzx edx, dx
mov dword [rsp + 4], edx
mov edx, 0x36642f7
jmp 0x180071cf0
mov edx, dword [rsp + 4]
mov word [rsp], dx
mov edx, 0x64300212
jmp 0x180071cd0
movzx edx, word [rsp]
mov word [rcx + rax*2], dx
mov eax, 0x5dc2dc08
jmp 0x180071be0
cmp eax, 0xcd1c2a78
jne 0x180071be0
mov rax, qword [rsp + 0x20]
add rsp, 0x30
ret
Function at 0x180071f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x40
mov eax, 0x6c5e55a5
mov r8d, 0x66069205
jmp 0x180071fc0
movzx eax, word [rsp + 4]
mov edx, dword [rsp + 0x14]
xor dx, ax
mov rax, qword [rsp + 0x28]
mov word [rax], dx
mov eax, 0x7675293b
mov rdx, qword [rsp + 0x20]
nop
cmp eax, 0x53600b5c
jg 0x180072010
cmp eax, 0xfdb64e19
jg 0x180072050
cmp eax, 0x988cbf5c
je 0x1800720a0
cmp eax, 0xb897d376
jne 0x180072158
mov rax, qword [rsp + 0x18]
mov word [rax + 0x10], 0
mov rax, qword [rsp + 0x18]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, 0x8f1a3320
jmp 0x180071fc0
cmp eax, 0x6c5e55a4
jg 0x180072080
cmp eax, 0x53600b5d
je 0x180072116
cmp eax, 0x66069205
jne 0x180071fc0
mov rax, qword [rsp + 8]
add rax, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x28], rax
mov eax, 0xfdb64e1a
jmp 0x180071fc0
cmp eax, 0xfdb64e1a
je 0x180072125
cmp eax, 0xfa11276
jne 0x180071fc0
mov eax, 0x7675293b
xor edx, edx
jmp 0x180071fc0
cmp eax, 0x7675293b
je 0x18007213c
cmp eax, 0x6c5e55a5
jne 0x180071fc0
mov eax, 0xfa11276
jmp 0x180071fc0
movzx r9d, word [rsp + 2]
mov rdx, qword [rsp + 8]
mov eax, 0x68077d15
cmp eax, 0x72414454
je 0x180071fa1
cmp eax, 0x68077d15
jne 0x1800720b0
mov dword [rsp + 0x14], r9d
mov qword [rsp + 0x38], rcx
mov eax, 0xc0f2eaca
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp eax, 0xe36de240
je 0x180072102
cmp eax, 0xc0f2eaca
jne 0x1800720e0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
mov word [rsp + 6], ax
mov eax, 0xe36de240
jmp 0x1800720e0
movzx eax, word [rsp + 6]
add ax, dx
mov word [rsp + 4], ax
mov eax, 0x72414454
jmp 0x1800720b0
mov qword [rsp + 0x18], rcx
mov eax, 0xb897d376
jmp 0x180071fc0
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
mov word [rsp + 2], ax
mov eax, 0x988cbf5c
jmp 0x180071fc0
mov qword [rsp + 8], rdx
mov rax, qword [rsp + 8]
cmp rax, 7
mov eax, 0x53600b5d
cmovb eax, r8d
jmp 0x180071fc0
cmp eax, 0x8f1a3320
jne 0x180071fc0
mov rax, qword [rsp + 0x30]
add rsp, 0x40
ret
Function at 0x180072330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov eax, 0x340d5d45
mov r8d, 0x4ba6654f
jmp 0x180072360
mov rax, qword [rsp + 0x18]
movzx edx, word [rsp]
mov word [rax], dx
mov eax, 0xc180f038
mov r9, qword [rsp + 0x10]
nop word [rax + rax]
cmp eax, 0xe7745e37
jle 0x180072390
cmp eax, 0x4720062f
jg 0x1800723d0
cmp eax, 0x2237810c
je 0x180072433
cmp eax, 0x340d5d45
jne 0x180072507
mov eax, 0xc8682733
jmp 0x180072360
cmp eax, 0xc180f037
jg 0x180072410
cmp eax, 0xb42633f4
je 0x180072442
cmp eax, 0xb6566c00
jne 0x180072360
mov rax, qword [rsp + 8]
mov word [rax + 0x10], 0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x28], rax
mov eax, 0xe7745e38
jmp 0x180072360
cmp eax, 0x47200630
je 0x180072341
cmp eax, 0x4ba6654f
jne 0x180072360
mov rax, qword [rsp + 0x20]
add rax, 1
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x18], rax
mov eax, 0xb42633f4
jmp 0x180072360
cmp eax, 0xc180f038
je 0x1800724d8
cmp eax, 0xc8682733
jne 0x180072360
mov eax, 0xc180f038
xor r9d, r9d
jmp 0x180072360
mov qword [rsp + 8], rcx
mov eax, 0xb6566c00
jmp 0x180072360
mov rax, qword [rsp + 0x18]
movzx eax, word [rax]
mov edx, 0xe3431fe8
nop
cmp edx, 0x5c3b4d7a
je 0x1800724f4
cmp edx, 0xe3431fe8
jne 0x180072450
mov edx, 0xd3a0b5ba
nop dword [rax]
cmp edx, 0x10c26fb3
je 0x1800724c5
cmp edx, 0xd3a0b5ba
jne 0x180072470
mov edx, 0x8ba22fa5
nop word cs:[rax + rax]
nop
cmp edx, 0x9a654cea
je 0x1800724ac
cmp edx, 0x8ba22fa5
jne 0x180072490
mov qword [rsp + 0x30], rcx
mov edx, 0x9a654cea
jmp 0x180072490
mov rdx, qword [rsp + 0x30]
movzx edx, word [rdx]
xor dx, ax
movzx edx, dx
mov dword [rsp + 4], edx
mov edx, 0x10c26fb3
jmp 0x180072470
mov edx, dword [rsp + 4]
mov word [rsp + 2], dx
mov edx, 0x5c3b4d7a
jmp 0x180072450
mov qword [rsp + 0x20], r9
mov rax, qword [rsp + 0x20]
cmp rax, 7
mov eax, 0x2237810c
cmovb eax, r8d
jmp 0x180072360
movzx eax, word [rsp + 2]
mov word [rsp], ax
mov eax, 0x47200630
jmp 0x180072360
cmp eax, 0xe7745e38
jne 0x180072360
mov rax, qword [rsp + 0x28]
add rax, 2
add rsp, 0x38
ret
Function at 0x180083b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x48
mov eax, 0x3515cafa
mov r8d, 0xf4d41f04
jmp 0x180083bb0
mov eax, 0xf46d6fb9
mov r9, qword [rsp + 0x18]
nop dword [rax + rax]
cmp eax, 0xfe14217f
jle 0x180083be0
cmp eax, 0x53fc407d
jg 0x180083ca0
cmp eax, 0x31c6c8fd
je 0x180083d15
cmp eax, 0x3515cafa
jne 0x180083d6f
mov eax, 0x31c6c8fd
jmp 0x180083bb0
cmp eax, 0xf46d6fb8
jg 0x180083cd0
cmp eax, 0x810adca0
je 0x180083d22
cmp eax, 0xb1ebff55
jne 0x180083bb0
movzx r10d, word [rsp + 6]
mov edx, 0x22edfa55
nop dword [rax + rax]
cmp edx, 0x91111cf
je 0x180083d3c
cmp edx, 0x22edfa55
jne 0x180083c10
mov dword [rsp + 0xc], r10d
mov edx, 0x1f16ce5f
nop
cmp edx, 0xba6a8021
je 0x180083c85
cmp edx, 0x1f16ce5f
jne 0x180083c30
mov qword [rsp + 0x38], rcx
mov edx, 0x393f85b1
nop word [rax + rax]
cmp edx, 0xd0bddfd4
je 0x180083c71
cmp edx, 0x393f85b1
jne 0x180083c50
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rdx
mov edx, 0xd0bddfd4
jmp 0x180083c50
mov rdx, qword [rsp + 0x40]
movzx edx, word [rdx]
mov word [rsp + 0xa], dx
mov edx, 0xba6a8021
jmp 0x180083c30
movzx edx, word [rsp + 0xa]
mov eax, dword [rsp + 0xc]
xor ax, dx
mov word [rsp + 8], ax
mov edx, 0x91111cf
jmp 0x180083c10
cmp eax, 0x53fc407e
je 0x180083ba1
cmp eax, 0x58f9a67d
jne 0x180083bb0
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x30], rax
mov eax, 0xfe142180
jmp 0x180083bb0
cmp eax, 0xf46d6fb9
je 0x180083d53
cmp eax, 0xf4d41f04
jne 0x180083bb0
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
mov word [rsp + 6], ax
mov eax, 0xb1ebff55
jmp 0x180083bb0
mov eax, 0xf46d6fb9
xor r9d, r9d
jmp 0x180083bb0
mov qword [rsp + 0x10], rcx
mov rax, qword [rsp + 0x10]
mov word [rax + 0xa], 0
mov eax, 0x58f9a67d
jmp 0x180083bb0
movzx eax, word [rsp + 8]
mov rdx, qword [rsp + 0x20]
mov word [rdx], ax
mov eax, 0x53fc407e
jmp 0x180083bb0
mov qword [rsp + 0x28], r9
mov rax, qword [rsp + 0x28]
cmp rax, 4
mov eax, 0x810adca0
cmovb eax, r8d
jmp 0x180083bb0
cmp eax, 0xfe142180
jne 0x180083bb0
mov rax, qword [rsp + 0x30]
add rax, 2
add rsp, 0x48
ret
Function at 0x180084060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x40
mov eax, 0xd7dc709b
mov r8d, 0x1778f9e2
jmp 0x180084080
mov eax, 0x22d33371
mov r9, qword [rsp + 0x20]
nop dword [rax + rax]
cmp eax, 0xfbe878e9
jle 0x1800840d0
cmp eax, 0x1778f9e1
jle 0x180084190
cmp eax, 0x1778f9e2
je 0x1800841dc
cmp eax, 0x22d33371
jne 0x180084250
mov qword [rsp + 0x30], r9
mov rax, qword [rsp + 0x30]
cmp rax, 0x7c
mov eax, 0xb836e52d
cmovb eax, r8d
jmp 0x180084080
cmp eax, 0xb836e52c
jg 0x1800841c0
cmp eax, 0x8d4f1258
je 0x18008420f
cmp eax, 0x92b02d76
jne 0x180084080
movzx eax, word [rsp + 4]
mov edx, 0x2794d894
nop word [rax + rax]
cmp edx, 0x8728a89c
je 0x18008421c
cmp edx, 0x2794d894
jne 0x180084100
mov dword [rsp + 0x10], eax
mov edx, 0x7d37b2cf
nop dword [rax]
cmp edx, 0xd06f174e
je 0x18008413c
cmp edx, 0x7d37b2cf
jne 0x180084120
mov qword [rsp + 8], rcx
mov edx, 0xd06f174e
jmp 0x180084120
mov rdx, qword [rsp + 8]
movzx edx, word [rdx]
mov dword [rsp + 0x14], edx
mov edx, 0xc25f9f7e
nop dword [rax]
cmp edx, 0x7933f360
je 0x180084173
cmp edx, 0xc25f9f7e
jne 0x180084150
mov edx, dword [rsp + 0x10]
xor edx, dword [rsp + 0x14]
mov dword [rsp + 8], edx
mov edx, 0x7933f360
jmp 0x180084150
mov edx, dword [rsp + 8]
mov word [rsp + 6], dx
mov edx, 0x8728a89c
jmp 0x180084100
cmp eax, 0xfbe878ea
je 0x180084071
cmp eax, 0x46d89bb
jne 0x180084080
mov rax, qword [rsp + 0x18]
add rax, 2
mov qword [rsp + 0x38], rax
mov eax, 0x4642320b
jmp 0x180084080
cmp eax, 0xb836e52d
je 0x180084233
cmp eax, 0xd7dc709b
jne 0x180084080
mov eax, 0x8d4f1258
jmp 0x180084080
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
mov word [rsp + 4], ax
mov eax, 0x92b02d76
jmp 0x180084080
mov eax, 0x22d33371
xor r9d, r9d
jmp 0x180084080
movzx eax, word [rsp + 6]
mov rdx, qword [rsp + 0x28]
mov word [rdx], ax
mov eax, 0xfbe878ea
jmp 0x180084080
mov qword [rsp + 0x18], rcx
mov rax, qword [rsp + 0x18]
mov word [rax + 0xfa], 0
mov eax, 0x46d89bb
jmp 0x180084080
cmp eax, 0x4642320b
jne 0x180084080
mov rax, qword [rsp + 0x38]
add rsp, 0x40
ret
Function at 0x180092b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x50
mov eax, 0x7ce66432
mov r8d, 0xf9be8e0d
jmp 0x180092bb0
movzx eax, word [rsp + 0xa]
mov word [rsp + 8], ax
mov eax, 0xfc9cf9d6
cmp eax, 0x12867bc4
jle 0x180092c00
cmp eax, 0x4739de9a
jg 0x180092cc0
cmp eax, 0x390d8342
je 0x180092d0e
cmp eax, 0x42ea3bd9
jne 0x180092d87
mov rax, qword [rsp + 0x30]
mov word [rax], 0
mov rax, qword [rsp + 0x10]
add rax, 2
mov qword [rsp + 0x38], rax
mov eax, 0x12867bc5
jmp 0x180092bb0
cmp eax, 0xf9be8e0c
jg 0x180092ce0
cmp eax, 0xb87036e3
je 0x180092d1b
cmp eax, 0xc9d145da
jne 0x180092bb0
movzx eax, word [rsp + 6]
mov edx, 0xac0b1978
nop word [rax + rax]
cmp edx, 0x4b35856c
je 0x180092ba1
cmp edx, 0xac0b1978
jne 0x180092c30
mov edx, 0xe2f739e3
nop dword [rax]
cmp edx, 0xe41507a0
je 0x180092caa
cmp edx, 0xe2f739e3
jne 0x180092c50
mov qword [rsp + 0x40], rcx
mov edx, 0x7b81156
nop word [rax + rax]
cmp edx, 0xe4c274a7
je 0x180092c91
cmp edx, 0x7b81156
jne 0x180092c70
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rdx
mov edx, 0xe4c274a7
jmp 0x180092c70
mov rdx, qword [rsp + 0x48]
movzx edx, word [rdx]
xor dx, ax
movzx edx, dx
mov dword [rsp + 0xc], edx
mov edx, 0xe41507a0
jmp 0x180092c50
mov edx, dword [rsp + 0xc]
mov word [rsp + 0xa], dx
mov edx, 0x4b35856c
jmp 0x180092c30
cmp eax, 0x4739de9b
je 0x180092d38
cmp eax, 0x7ce66432
jne 0x180092bb0
mov eax, 0x390d8342
jmp 0x180092bb0
cmp eax, 0xf9be8e0d
je 0x180092d54
cmp eax, 0xfc9cf9d6
jne 0x180092bb0
mov rax, qword [rsp + 0x20]
movzx edx, word [rsp + 8]
mov word [rax], dx
mov eax, 0x4739de9b
mov r9, qword [rsp + 0x18]
jmp 0x180092bb0
mov eax, 0x4739de9b
xor r9d, r9d
jmp 0x180092bb0
mov qword [rsp + 0x10], rcx
mov rax, qword [rsp + 0x10]
add rax, 0x60
mov qword [rsp + 0x30], rax
mov eax, 0x42ea3bd9
jmp 0x180092bb0
mov qword [rsp + 0x28], r9
mov rax, qword [rsp + 0x28]
cmp rax, 0x2f
mov eax, 0xb87036e3
cmovb eax, r8d
jmp 0x180092bb0
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
mov word [rsp + 6], ax
mov eax, 0xc9d145da
jmp 0x180092bb0
cmp eax, 0x12867bc5
jne 0x180092bb0
mov rax, qword [rsp + 0x38]
add rsp, 0x50
ret
Function at 0x180092fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x40
mov eax, 0x8e13338f
mov r8d, 0xf0e86f1
jmp 0x180092fe0
movzx eax, word [rsp + 4]
mov word [rsp + 2], ax
mov eax, 0x507699f9
cmp eax, 0x1ed95f02
jle 0x180093030
cmp eax, 0x57fd4650
jle 0x1800930f0
cmp eax, 0x57fd4651
je 0x180093174
cmp eax, 0x623b28e3
jne 0x1800931b9
mov qword [rsp + 8], r9
mov rax, qword [rsp + 8]
cmp rax, 0x10
mov eax, 0xe7296776
cmovb eax, r8d
jmp 0x180092fe0
cmp eax, 0xe7296775
jg 0x180093130
cmp eax, 0x8e13338f
je 0x180093181
cmp eax, 0x8e29695b
jne 0x180092fe0
movzx r10d, word [rsp]
mov rdx, qword [rsp + 8]
mov eax, 0xd275c0d5
nop dword [rax]
cmp eax, 0xcdef556b
je 0x180092fd1
cmp eax, 0xd275c0d5
jne 0x180093060
mov dword [rsp + 0x14], r10d
mov eax, 0x69bed94a
nop dword [rax]
cmp eax, 0xbb847963
je 0x1800930d5
cmp eax, 0x69bed94a
jne 0x180093080
mov eax, 0x4dbaad07
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x95525898
je 0x1800930ba
cmp eax, 0x4dbaad07
jne 0x1800930a0
mov qword [rsp + 0x38], rcx
mov eax, 0x95525898
jmp 0x1800930a0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
add ax, dx
xor eax, dword [rsp + 0x14]
mov word [rsp + 6], ax
mov eax, 0xbb847963
jmp 0x180093080
movzx eax, word [rsp + 6]
mov word [rsp + 4], ax
mov eax, 0xcdef556b
jmp 0x180093060
cmp eax, 0x1ed95f03
je 0x18009318b
cmp eax, 0x507699f9
jne 0x180092fe0
mov rax, qword [rsp + 0x28]
movzx edx, word [rsp + 2]
mov word [rax], dx
mov eax, 0x623b28e3
mov r9, qword [rsp + 0x20]
jmp 0x180092fe0
cmp eax, 0xe7296776
je 0x1800931aa
cmp eax, 0xf0e86f1
jne 0x180092fe0
mov rax, qword [rsp + 8]
add rax, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
mov word [rsp], ax
mov eax, 0x8e29695b
jmp 0x180092fe0
mov eax, 0x623b28e3
xor r9d, r9d
jmp 0x180092fe0
mov eax, 0x57fd4651
jmp 0x180092fe0
mov rax, qword [rsp + 0x18]
mov word [rax + 0x22], 0
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
mov eax, 0x5e6ed281
jmp 0x180092fe0
mov qword [rsp + 0x18], rcx
mov eax, 0x1ed95f03
jmp 0x180092fe0
cmp eax, 0x5e6ed281
jne 0x180092fe0
mov rax, qword [rsp + 0x30]
add rax, 2
add rsp, 0x40
ret
Function at 0x1800c8410
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800c8438
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800c8438
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000a440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], r8
mov rbx, rcx
mov esi, edx
call fcn.1400f9e70
mov r8, qword [rsp + 0x28]
mov edx, esi
mov rcx, rbx
movzx r9d, al
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400fa180

Function at 0x14001c5c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x144bd09b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14001c5e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14001c5e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14001c5e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14001c63d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14001c634
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14001c5e0
add rax, 0x28
cmp rax, r9
jne 0x14001c620
xor eax, eax
ret

Function at 0x14001c640
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x144bd09b0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14001c65f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14001c668
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14001c65f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14001c700
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x144bd09b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14001c71f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14001c728
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140492607
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rcx - 0x626e691], r8
movsx r8d, cx
push r8
lea r8, [rcx + rcx*2 + 0x7206918a]
lea rcx, [0x14048ad50]
lea rsp, [rsp + 8]
movzx r8d, byte [rdx]
push 0xffffffffb093c404
xor r8d, r10d
sar dword [rsp + 3], 0xbb
and r8d, 0xff
mov r8d, dword [rcx + r8*4]
shr r10d, 8
push 0xffffffff8394daa3
xor r10d, r8d
inc rdx
xor r10d, 0xbd1c0b09
dec rax
lea rsp, [rsp + 0x10]
jne 0x140492629
pop r8
Function at 0x3be96a6e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.3be9748b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call fcn.3be975048
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.3be9748b0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x3be96a750
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x3beaed0c4]
mov rbx, rcx
test esi, esi
jle 0x3be96a880
mov rax, qword [0x3beaed0c8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x3be96a79b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x3be96a825
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x3be96a780
mov rcx, rbx
call fcn.3be96afb0
mov rdi, rax
test rax, rax
je 0x3be96a8a2
mov rax, qword [0x3beaed0c8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.3be96b0f0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x3beaed0c8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x3be96a887
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x3be96a81e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x3be96a830
add dword [0x3beaed0c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x3beaed0c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x3be96a81e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.3be96a6e0
nop dword [rax]
xor esi, esi
jmp 0x3be96a7a8
mov rax, qword [0x3beaed0c8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.3be96a6e0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.3be96a6e0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x3be96ac20
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x3beaed100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x3beaed0e0]
test rbx, rbx
je 0x3be96ac7c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x3be96ac73
test rsi, rsi
je 0x3be96ac73
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x3be96ac58
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]