joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010ef60
Capabilities:
Get geographical location

Disassembly:
push rsi
sub rsp, 0x90
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x2c], 0
mov rax, qword [0x1404aae50]
test rax, rax
jne 0x14010f07f
lea rsi, [0x1404aae60]
xor ecx, ecx
mov edx, 0x5c
mov r8, rsi
mov r9d, 0x55
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x14010f073
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x7d], 0
mov eax, 1
jmp 0x14010eff9
mov byte [rsp + rax + 0x30], 0x2d
add rax, 2
movzx ecx, word [rsi + rax*2 - 2]
cmp cx, 0x5f
jne 0x14010f010
mov byte [rsp + rax + 0x2f], 0x2d
jmp 0x14010f018
mov byte [rsp + rax + 0x2f], cl
test cl, cl
je 0x14010f03a
cmp rax, 0x55
je 0x14010f032
movzx ecx, word [rsi + rax*2]
cmp cx, 0x5f
je 0x14010eff0
mov byte [rsp + rax + 0x30], cl
test cl, cl
jne 0x14010eff5
jmp 0x14010f03a
mov byte [rsp + 0x84], 0
mov ecx, 0x41
call fcn.1400ee040
test rax, rax
je 0x14010f073
mov rsi, rax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rdx, rax
mov r8d, 0x40
call fcn.1401265e0
cmp dword [rsp + 0x2c], 0
jle 0x14010f09c
mov rcx, rsi
call fcn.1400ee120
mov rax, qword [0x1404aae50]
test rax, rax
je 0x14010f0cd
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14010f0ef
add rsp, 0x90
pop rsi
ret
cdqe
mov byte [rsi + rax], 0
mov qword [0x1404aae50], rsi
mov byte [0x1404aaf0a], 1
lea rdx, [0x14010ec70]
mov ecx, 0x18
call fcn.14011eb30
mov rax, qword [0x1404aae50]
test rax, rax
jne 0x14010f07f
lea rax, [0x14048ad73]
mov qword [0x1404aae50], rax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x14010f093
call fcn.14029fd30
int3
Function at 0x140125770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, r9d
mov rsi, r8
mov rdi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp dl, 0x5f
je 0x1401257a2
movzx eax, dl
cmp eax, 0x40
je 0x1401257d8
cmp eax, 0x2d
jne 0x1401257bc
movzx ecx, byte [rdi]
test ecx, ecx
je 0x1401257b7
cmp ecx, 0x2e
je 0x1401257b7
cmp ecx, 0x40
jne 0x14012585b
cmp dl, 0x40
je 0x1401257d8
mov rcx, rdi
mov edx, 0x40
call fcn.1402a4f18
test rax, rax
je 0x1401258c7
mov rdi, rax
inc rdi
movzx ecx, byte [rdi]
test ecx, ecx
je 0x1401258c7
cmp ecx, 0x2e
je 0x1401258c7
cmp ecx, 0x40
je 0x1401258c7
test bl, bl
je 0x140125812
mov rax, qword [rsi]
lea rdx, [0x14048a5db]
mov rcx, rsi
mov r8d, 1
call qword [rax + ioctlsocket]
movzx ecx, byte [rdi]
inc rdi
mov ebp, 0x5f
lea rbx, [rsp + 0x2e]
nop
call fcn.1400ee160
movzx ecx, al
and al, 0xfe
cmp al, 0x2c
cmove ecx, ebp
mov byte [rsp + 0x2e], cl
mov rax, qword [rsi]
mov rcx, rsi
mov rdx, rbx
mov r8d, 1
call qword [rax + ioctlsocket]
movzx ecx, byte [rdi]
test ecx, ecx
je 0x1401258c7
cmp ecx, 0x40
je 0x1401258c7
inc rdi
cmp ecx, 0x2e
jne 0x140125820
jmp 0x1401258c7
test bl, bl
je 0x140125878
mov rax, qword [rsi]
lea rdx, [0x14048a5db]
mov rcx, rsi
mov r8d, 1
call qword [rax + ioctlsocket]
movzx ecx, byte [rdi]
inc rdi
mov ebp, 0x5f
lea rbx, [rsp + 0x2f]
nop word cs:[rax + rax]
call fcn.1400ee160
cmp al, 0x2d
movzx eax, al
cmove eax, ebp
mov byte [rsp + 0x2f], al
mov rax, qword [rsi]
mov rcx, rsi
mov rdx, rbx
mov r8d, 1
call qword [rax + ioctlsocket]
movzx ecx, byte [rdi]
test ecx, ecx
je 0x1401258c7
cmp ecx, 0x2e
je 0x1401258c7
inc rdi
cmp ecx, 0x40
jne 0x140125890
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401258e1
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.14029fd30
int3

Function at 0x14012dc90
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14012dcab
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rsi, rdx
mov rbx, r8
mov r14, rcx
call fcn.140121a90
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14012dd59
mov rdi, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x14012dd59
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [r14 + 8], rax
test rax, rax
je 0x14012dd84
mov qword [r14 + 0x28], rsi
mov al, 1
jmp 0x14012dca1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14012dc9f
mov dword [rbx], 7
jmp 0x14012dc9f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14012dc9f
Function at 0x1401354d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
test r8d, r8d
jle 0x140135521
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140135569
mov eax, edi
lea r8, [rsi + rax*2]
mov rdx, rsi
call fcn.1400e9480
mov r14, rax
sub r14, rsi
shr r14, 1
jmp 0x140135528
xor r14d, r14d
test edi, edi
js 0x140135555
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14013554f
mov eax, r14d
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14029fd30
int3
mov rcx, rsi
mov edi, r9d
call fcn.14014af00
mov r9d, edi
mov edi, eax
test eax, eax
je 0x140135528
mov r14, qword [rbx + 0x58]
test r14, r14
je 0x1401355a5
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
mov ebx, r9d
call fcn.14029fd30
mov rcx, r14
mov rdx, rsi
mov r8d, edi
mov r9d, ebx
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14013ace0
mov r8, qword [rbx + 0x50]
test r8, r8
je 0x140135610
cmp dword [r8 + 8], 0
je 0x140135610
mov ebp, r9d
cmp r9d, 1
mov r9d, 0x2a
sbb r9d, 0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14013a290
cmp dword [rsp + 0x114], 0
je 0x140135603
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
mov r8d, edi
mov r9d, ebp
call fcn.14013ace0
mov r14d, eax
mov rcx, rbx
call fcn.14013ac70
jmp 0x140135528
lea rcx, [rsp + 0x20]
call fcn.14013ac70
mov r9d, ebp
xor ebp, ebp
test r9d, r9d
setne bpl
xor r14d, r14d
nop dword [rax]
lea r15d, [r14 + 1]
movsxd rax, r14d
movzx edx, word [rsi + rax*2]
mov eax, edx
and eax, 0xfc00
cmp eax, 0xd800
setne al
cmp r15d, edi
sete cl
or cl, al
jne 0x14013566a
movsxd rax, r15d
movzx eax, word [rsi + rax*2]
mov ecx, eax
and ecx, 0xfc00
cmp ecx, 0xdc00
jne 0x14013566a
lea r15d, [r14 + 2]
shl edx, 0xa
add edx, eax
add edx, 0xfca02400
mov rax, rbx
nop dword [rax]
mov rcx, qword [rax + 0x28]
test rcx, rcx
jne 0x1401356b0
mov r8, rax
mov rax, qword [rax + 0x58]
test rax, rax
jne 0x140135670
xor eax, eax
cmp edx, 0x10ffff
jg 0x1401356b6
mov rcx, qword [r8 + 0x10]
cmp edx, dword [rcx]
jl 0x1401356a5
movsxd r8, dword [r8 + 0x1c]
lea eax, [r8 - 1]
cmp r8, 2
jge 0x1401356d2
and al, 1
jmp 0x1401356b6
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
movsx eax, al
cmp ebp, eax
jne 0x140135528
mov r14d, r15d
cmp r15d, edi
jl 0x140135620
jmp 0x140135528
cmp r8d, 2
je 0x1401356a5
cmp edx, dword [rcx + r8*4 - 8]
jge 0x1401356a5
mov r9d, eax
shr r9d, 1
xor r8d, r8d
jmp 0x1401356ff
mov r8d, r9d
lea r9d, [rax + r8]
shr r9d, 1
cmp r9d, r8d
je 0x1401356a5
mov r10d, r9d
cmp edx, dword [rcx + r10*4]
jge 0x1401356f0
mov eax, r9d
lea r9d, [rax + r8]
shr r9d, 1
cmp r9d, r8d
jne 0x1401356ff
jmp 0x1401356a5
Function at 0x140146570
Capabilities:
Inspect section memory permissions

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rsp + 0x50]
mov qword [rcx + 8], r8
mov ecx, dword [r8]
mov dword [rsi + 0x20], ecx
lea r10, [0x140407970]
mov qword [rsi + 0x10], r10
test r9d, r9d
js 0x1401465c4
mov r10d, r9d
shr r10d, 2
mov r11d, 6
cmp byte [rdx], 1
jne 0x1401465bb
xor r11d, r11d
cmp byte [rdx + 1], 0
setne r11b
lea r11d, [r11 + r11*4]
inc r11d
cmp r10d, r11d
jb 0x1401466f1
mov r10d, ecx
and r10d, 0xf0000000
cmp r10d, 0x20000000
sete r10b
and ecx, 0xe0000000
cmp ecx, 0x40000000
sete cl
or cl, r10b
je 0x1401466f1
movzx r10d, byte [rdx]
cmp r10b, 1
jne 0x140146601
cmp byte [rdx + 1], 0
je 0x140146664
movzx ecx, byte [r8 + 4]
cmp ecx, 4
jbe 0x1401466f1
test r9d, r9d
js 0x140146636
lea r11d, [rcx*4 + 4]
cmp r9d, r11d
jb 0x1401466f1
mov r11d, dword [r8 + 0x10]
shl r11d, 2
cmp r9d, r11d
jl 0x1401466f1
mov r9d, dword [r8 + 8]
lea r11d, [rcx + 1]
cmp r9d, r11d
jg 0x140146675
cmp r10b, 3
jae 0x140146687
cmp ecx, 5
jne 0x140146696
cmp byte [rsi + 0x39], 0
jne 0x1401466f1
cmp byte [rsi + 0x3a], 0
jne 0x1401466f1
jmp 0x14014666b
mov dword [rsi + 0x24], 0x10000
mov byte [rsi + 0x3b], 1
add rsp, 0x20
pop rsi
ret
shl r9d, 2
mov dword [rsi + 0x24], r9d
movzx r10d, byte [rdx]
cmp r10b, 3
jb 0x140146649
mov edx, dword [r8 + 4]
shr edx, 8
mov dword [rsi + 0x30], edx
cmp ecx, 5
je 0x14014664e
mov r9d, dword [r8 + 0x18]
mov edx, r9d
and dl, 1
mov byte [rsi + 0x38], dl
mov r10d, r9d
shr r10b, 1
mov edx, r9d
shr dl, 2
and dl, 1
mov r11d, r9d
shl r11d, 0xc
and r11d, 0xf000000
or dword [rsi + 0x30], r11d
shr r9d, 0x10
and r10b, 1
mov byte [rsi + 0x39], r10b
mov byte [rsi + 0x3a], dl
mov dword [rsi + 0x34], r9d
jne 0x1401466ec
cmp ecx, 8
setb r9b
test dl, r9b
jne 0x1401466f1
cmp ecx, 7
jb 0x14014666b
jmp 0x140146715
cmp ecx, 7
ja 0x140146715
mov dword [rax], 3
mov rcx, qword [rsi]
test rcx, rcx
je 0x14014666f
call fcn.140121b90
mov qword [rsi], 0
add rsp, 0x20
pop rsi
ret
movsxd rax, dword [r8 + 8]
cmp dword [r8 + 0x1c], eax
jle 0x14014666b
lea rax, [r8 + rax*4]
mov qword [rsi + 0x10], rax
jmp 0x14014666b
Function at 0x14014a810
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov r11d, r8d
mov r10d, edx
mov esi, dword [rsp + 0x58]
movsxd r14, edx
lea rdi, [rcx + 0x10]
xor r8d, r8d
mov rbx, rsi
nop
mov eax, r11d
xor edx, edx
div r9d
lea ebp, [rdx + 0x37]
lea r15d, [rdx + 0x30]
cmp edx, 0xa
cmovge r15d, ebp
inc r8
mov word [rdi - 0x10], r15w
add rdi, 2
dec rbx
cmp r9d, r11d
ja 0x14014a862
mov r11d, eax
cmp r8, r14
jl 0x14014a830
cmp esi, r8d
jg 0x14014a877
cmp r8d, r10d
jl 0x14014a8d7
cmp r8d, 2
jae 0x14014a8ea
jmp 0x14014a97a
mov eax, esi
mov rdx, rax
sub rdx, r8
cmp rdx, 0x10
jb 0x14014a8c0
mov r9, rdx
and r9, 0xfffffffffffffff0
and rbx, 0xfffffffffffffff0
add r8, rbx
movaps xmm0, xmmword [str.00000000a_ab_beef_fn_nr_rt_tv_v]
mov r11, r9
nop dword [rax]
movups xmmword [rdi - 0x10], xmm0
movups xmmword [rdi], xmm0
add rdi, 0x20
add r11, 0xfffffffffffffff0
jne 0x14014a8a0
cmp rdx, r9
je 0x14014a8cf
nop word cs:[rax + rax]
mov word [rcx + r8*2], 0x30
inc r8
cmp rax, r8
jne 0x14014a8c0
mov r8d, esi
cmp r8d, r10d
jge 0x14014a86c
mov eax, r8d
mov word [rcx + rax*2], 0
cmp r8d, 2
jb 0x14014a97a
mov edx, r8d
shr edx, 1
movsxd r10, r8d
lea rax, [rcx + r10*2]
cmp edx, 1
jne 0x14014a900
xor r9d, r9d
jmp 0x14014a95b
mov r11d, edx
and r11d, 0xfffffffe
dec r10
xor r9d, r9d
movabs rsi, 0x7ffffffffffffffe
nop word [rax + rax]
movzx edi, word [rcx + r10*2]
movzx ebx, word [rcx + r9*2]
mov word [rcx + r10*2], bx
mov word [rcx + r9*2], di
mov rdi, r9
xor rdi, rsi
movzx ebx, word [rax + rdi*2]
movzx ebp, word [rcx + r9*2 + 2]
mov word [rax + rdi*2], bp
mov word [rcx + r9*2 + 2], bx
add r9, 2
add r10, 0xfffffffffffffffe
cmp r11, r9
jne 0x14014a920
test dl, 1
je 0x14014a97a
mov rdx, r9
not rdx
movzx r10d, word [rax + rdx*2]
movzx r11d, word [rcx + r9*2]
mov word [rax + rdx*2], r11w
mov word [rcx + r9*2], r10w
mov eax, r8d
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1401529b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x1401529c5
mov r8d, r8d
add rsp, 0x28
jmp fcn.1401520b0
test r8d, r8d
je 0x1401529d1
xor eax, eax
add rsp, 0x28
ret
call fcn.140152040
xor eax, eax
add rsp, 0x28
ret
Function at 0x14016a350
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x2040
call fcn.14029fcd0
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x2038], rax
cmp qword [0x1404ab440], 0
jne 0x14016a3a1
mov ecx, 8
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [0x1404ab440], rax
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14016a42e
mov rbx, rax
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x2c]
mov rcx, rax
mov r8d, 0x2000
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x14016a40f
cmp dword [rsp + 0x2c], 8
jb 0x14016a40f
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax]
mov rcx, qword [rsp + r14*8 + 0x30]
mov rdx, rdi
call r15
test rax, rax
jne 0x14016a468
inc r14
mov eax, dword [rsp + 0x2c]
shr eax, 3
cmp r14, rax
jb 0x14016a3f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.None_of_the_loaded_modules_contained_the_requested_symbol__s.
xor r14d, r14d
xor ecx, ecx
mov r8, rdi
call fcn.1402030a0
jmp 0x14016a43f
lea rdx, str.Failed_to_open_current_process.
xor r14d, r14d
xor ecx, ecx
call fcn.1402030a0
mov qword [rsi], rax
mov rcx, qword [rsp + 0x2038]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14016a488
mov rax, r14
add rsp, 0x2040
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r14, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2038]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x14016a456
call fcn.14029fd30
int3
Function at 0x14019e170
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, dword [0x1404b15b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rsi, qword [rax + 8]
test rsi, rsi
je 0x14019e1d8
mov rcx, qword [rsi + 0x708]
lea rax, [0x1404ab750]
test rcx, rcx
je 0x14019e22e
mov rdx, qword [0x1404ab740]
test rdx, rdx
je 0x14019e203
mov rcx, qword [rcx + 0x390]
mov rcx, qword [rcx + 8]
mov rdi, rax
call fcn.1402a50d4
mov rcx, rax
mov rax, rdi
test rcx, rcx
jne 0x14019e226
jmp 0x14019e22e
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14019e1fc
cmp byte [rax + 8], 0
jne 0x14019e22a
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x14019e22a
call fcn.1402021d0
jmp 0x14019e22a
mov rdx, qword [0x1404ab4b0]
test rdx, rdx
je 0x14019e215
cmp rcx, qword [rdx + 0x50]
je 0x14019e226
mov rdi, rax
call fcn.140197440
mov ecx, eax
mov rax, rdi
test cl, cl
jne 0x14019e22e
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x40]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401b53e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 7]
sar rax, 1
test cl, 1
je 0x1401b541e
mov rdx, qword [rcx - 1]
and edx, 0xfffff000
cmp edx, 0x5e000
jne 0x1401b541e
test rax, rax
jle 0x1401b543a
add rcx, 0xf
mov edx, eax
and edx, 3
cmp rax, 4
jae 0x1401b5519
xor r8d, r8d
jmp 0x1401b55a9
test rax, rax
jle 0x1401b543a
add rcx, 0xf
mov edx, eax
and edx, 3
cmp rax, 4
jae 0x1401b5441
xor r8d, r8d
jmp 0x1401b54d9
xor eax, eax
jmp 0x1401b55d8
movabs r8, 0x7ffffffffffffffc
and rax, r8
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, word [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 2]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, word [rcx + 4]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, word [rcx + 6]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 8
add rax, 0xfffffffffffffffc
jne 0x1401b5460
test rdx, rdx
je 0x1401b55d4
xor eax, eax
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax*2]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rax
cmp rdx, rax
jne 0x1401b54f0
jmp 0x1401b55d4
movabs r8, 0x7ffffffffffffffc
and rax, r8
xor r8d, r8d
nop dword [rax]
movzx r9d, byte [rcx]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 1]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
movzx r9d, byte [rcx + 2]
add r9d, r8d
mov r8d, r9d
shl r8d, 0xa
add r8d, r9d
mov r9d, r8d
shr r9d, 6
xor r9d, r8d
movzx r8d, byte [rcx + 3]
add r8d, r9d
mov r9d, r8d
shl r9d, 0xa
add r9d, r8d
mov r8d, r9d
shr r8d, 6
xor r8d, r9d
add rcx, 4
add rax, 0xfffffffffffffffc
jne 0x1401b5530
test rdx, rdx
je 0x1401b55d4
xor eax, eax
movzx r9d, byte [rcx + rax]
add r9d, r8d
mov r10d, r9d
shl r10d, 0xa
add r10d, r9d
mov r8d, r10d
shr r8d, 6
xor r8d, r10d
inc rax
cmp rdx, rax
jne 0x1401b55b0
lea eax, [r8 + r8*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov eax, ecx
shl eax, 0xf
add eax, ecx
and eax, 0x3fffffff
cmp eax, 1
adc eax, 0
ret
Function at 0x1401c31f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.1401cfb10
mov ecx, eax
mov al, 1
test cl, cl
jne 0x1401c32c2
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx + 7]
cmp rdx, 6
jl 0x1401c32c0
mov edx, 1
jmp 0x1401c3250
movzx r8d, word [rcx + rdx*2 + 0x11]
cmp r8w, 0x5f
jne 0x1401c32ae
jmp 0x1401c32c2
mov r8, qword [rcx - 1]
shr r8d, 0xc
cmp r8d, 0x5f
je 0x1401c3280
cmp r8d, 0x5e
jne 0x1401c32df
movzx r8d, byte [rcx + rdx + 0xf]
cmp r8w, 0x2e
je 0x1401c328d
jmp 0x1401c32ae
movzx r8d, word [rcx + rdx*2 + 0xf]
cmp r8w, 0x2e
jne 0x1401c32ae
mov r8, qword [rcx - 1]
shr r8d, 0xc
cmp r8d, 0x5f
je 0x1401c3240
cmp r8d, 0x5e
jne 0x1401c32df
movzx r8d, byte [rcx + rdx + 0x10]
cmp r8w, 0x5f
je 0x1401c32c2
inc rdx
mov r8, qword [rcx + 7]
sar r8, 1
dec r8
cmp rdx, r8
jl 0x1401c3250
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401c32d9
add rsp, 0x40
pop rsi
ret
call fcn.14029fd30
int3
lea rax, str..._.._runtime_vm_object.h
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x34c3
lea rdx, str.unreachable_code
lea rcx, [rsp + 0x28]
call fcn.1402d94a0
int3
Function at 0x1401c3fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [0x1404b15b8]
mov r8, qword gs:[0x58]
mov rax, qword [r8 + rax*8]
mov r8, qword [rax + 8]
mov rax, qword [rcx + 8]
mov eax, dword [rax + 0x7f]
and eax, 0xc
cmp eax, 8
je 0x1401c400c
mov rax, qword [rcx + 8]
mov eax, dword [rax + 0x7f]
not eax
test al, 0xc
jne 0x1401c4188
mov rax, qword [0x1404a6c80]
mov rbx, qword [r8 + 0xc88]
mov r14, qword [r8 + 0xcb8]
mov r15, qword [r8 + 0xd00]
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 0x1f]
mov qword [rbx + 8], rcx
mov r12, qword [rcx + 0xf]
sar r12, 1
mov r13, qword [r8 + 0xcb8]
mov rcx, qword [rsi + 8]
test qword [rcx - 1], 2
jne 0x1401c40ad
test r12, r12
jle 0x1401c4147
mov dword [rsp + 0x2c], r9d
mov qword [rsp + 0x20], rdx
mov rdi, qword [r8 + 0xd00]
xor ebp, ebp
nop dword [rax]
mov rax, qword [rbx + 8]
mov rax, qword [rax + rbp*8 + 0x17]
mov qword [r13 + 8], rax
mov rax, qword [rax + 7]
mov qword [rdi + 8], rax
mov rcx, rsi
mov rdx, rdi
call fcn.14015eaa0
test al, al
jne 0x1401c40e1
inc rbp
cmp r12, rbp
jne 0x1401c4070
mov rax, qword [0x1404a6c80]
mov rdx, qword [rsp + 0x20]
jmp 0x1401c4147
test r12, r12
jle 0x1401c4147
xor r8d, r8d
nop dword [rax]
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + r8*8 + 0x17]
mov qword [r13 + 8], rcx
mov r10, qword [rsi + 8]
cmp r10, qword [rcx + 7]
je 0x1401c4103
inc r8
cmp r12, r8
jne 0x1401c40c0
jmp 0x1401c4147
mov rax, qword [r13 + 8]
mov ecx, dword [rsp + 0x2c]
cmp ecx, 1
je 0x1401c411e
cmp ecx, 2
mov rdx, qword [rsp + 0x20]
jne 0x1401c4147
movzx ecx, word [rax + 0x51]
test cl, 2
je 0x1401c4147
jmp 0x1401c412c
cmp r9d, 1
je 0x1401c4135
cmp r9d, 2
jne 0x1401c4144
movzx r8d, word [rcx + 0x51]
test r8b, 2
cmove rax, rcx
jmp 0x1401c4147
movzx ecx, word [rax + 0x51]
test cl, 2
mov rdx, qword [rsp + 0x20]
jne 0x1401c4147
mov rax, qword [0x1404a6c80]
jmp 0x1401c4147
movzx r8d, word [rcx + 0x51]
test r8b, 2
cmovne rax, rcx
jmp 0x1401c4147
mov rax, rcx
mov qword [rdx], rax
mov rax, qword [0x1404a6c80]
mov qword [r15 + 8], rax
mov qword [r14 + 8], rax
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401c4182
mov rax, rdx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14029fd30
int3
lea rax, str..._.._runtime_vm_object.cc
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x13f4
lea rdx, str.unreachable_code
lea rcx, [rsp + 0x30]
call fcn.1402d94a0
int3
Function at 0x1401ce700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, 0xffffffffffffffff
cmp rdx, r8
jle 0x1401ce8b3
test r9, r9
jle 0x1401ce8b3
test rdx, rdx
jle 0x1401ce8b3
mov r10, qword [rsp + 0x98]
test r10, r10
js 0x1401ce8b3
mov rsi, qword [rsp + 0x90]
inc r8
cmp rdx, r8
sete r11b
cmp r9, rsi
setle bl
test r11b, bl
jne 0x1401ce8b3
mov r11, qword [rcx + 7]
sar r11, 1
cmp r10, r11
setge dil
cmp r8, rdx
sete bl
or dil, bl
jne 0x1401ce834
mov rdi, r8
nop dword [rax]
mov rbx, qword [rcx - 1]
shr ebx, 0xc
cmp ebx, 0x5f
je 0x1401ce7c0
cmp ebx, 0x5e
jne 0x1401ce8d5
movzx ebx, byte [rcx + r10 + 0xf]
cmp bx, 0xd
jne 0x1401ce7cc
jmp 0x1401ce7d4
movzx ebx, word [rcx + r10*2 + 0xf]
cmp bx, 0xd
je 0x1401ce7d4
movzx ebp, bx
cmp ebp, 0xa
jne 0x1401ce7d7
inc rdi
cmp bx, 0xd
jne 0x1401ce81d
lea rbx, [r10 + 1]
cmp rbx, r11
jge 0x1401ce81d
mov r14, qword [rcx - 1]
shr r14d, 0xc
cmp r14d, 0x5f
je 0x1401ce80b
cmp r14d, 0x5e
jne 0x1401ce8d5
movzx ebp, byte [rcx + rbx + 0xf]
cmp bp, 0xa
jne 0x1401ce817
jmp 0x1401ce81a
movzx ebp, word [rcx + r10*2 + 0x11]
cmp bp, 0xa
je 0x1401ce81a
mov rbx, r10
mov r10, rbx
inc r10
cmp rdi, rdx
sete bl
cmp r10, r11
jge 0x1401ce834
cmp rdi, rdx
jne 0x1401ce790
test bl, bl
je 0x1401ce8b3
inc rsi
cmp rdx, r8
mov edx, 1
cmove rdx, rsi
cmp r10, r11
jge 0x1401ce8a5
lea rax, [r10 + r9]
sub rax, rdx
lea r8, [rdx + r11]
sub r8, r10
nop
cmp r9, rdx
je 0x1401ce8b3
mov rsi, qword [rcx - 1]
shr esi, 0xc
cmp esi, 0x5f
je 0x1401ce880
cmp esi, 0x5e
jne 0x1401ce8d5
movzx esi, byte [rcx + r10 + 0xf]
jmp 0x1401ce886
movzx esi, word [rcx + r10*2 + 0xf]
cmp si, 0xa
je 0x1401ce8a5
movzx esi, si
cmp esi, 0xd
je 0x1401ce8a5
inc r10
inc rdx
cmp r11, r10
jne 0x1401ce860
mov r10, r11
mov rdx, r8
cmp rdx, r9
mov rax, 0xffffffffffffffff
cmove rax, r10
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1401ce8cf
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.14029fd30
int3
lea rax, str..._.._runtime_vm_object.h
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x34c3
lea rdx, str.unreachable_code
lea rcx, [rsp + 0x28]
call fcn.1402d94a0
int3