joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076440
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14009a0c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dword [rbp - 9], eax
mov r8d, 0xf003f
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], eax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x3f], eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x14007656f
mov r8d, 0xf01ff
mov qword [rsp + 0xa0], rbx
lea rdx, [0x14008b838]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
je 0x140076565
lea rax, [rbp - 9]
mov r9d, Ordinal_41
lea r8, [rbp - 1]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140076565
cmp dword [rbp + 3], 4
jne 0x140076539
lea r8, [rbp + 0x27]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x140076546
cmp dword [rbp + 3], 1
je 0x140076539
lea rax, [rbp - 9]
mov r9d, Ordinal_41
lea r8, [rbp - 1]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140076546
cmp dword [rbp + 3], 1
jne 0x140076511
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14007655c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x140076567
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140070900
mov rdi, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
Function at 0x140077270
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x1310]
mov eax, 0x1410
call fcn.1400710e0
sub rsp, rax
mov rax, qword [0x14009a0c0]
xor rax, rsp
mov qword [rbp + 0x1300], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov r8d, 0x3e
lea rdx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea rcx, [rsp + 0x48]
call fcn.1400037f0
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov r10d, 0xffffffff
mov dword [rbp + 0x12f4], r10d
mov dword [rsp + 0x74], eax
mov ecx, 1
nop dword [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x74], edx
inc rcx
cmp rcx, 0x270
jb 0x1400772f0
mov dword [rsp + 0x70], 0x270
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
add rdx, qword [rsp + 0x58]
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r9, qword [rsp + 0x48]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
mov r8d, 0x40
nop word [rax + rax]
dec r8
shr rax, 1
cmp rax, r10
ja 0x140077360
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x28]
mov rcx, r9
call fcn.1400043c0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov r8d, reloc.WS2_32.dll_recvfrom
cmp qword [rsp + 0x58], r8
cmovb r8, qword [rsp + 0x58]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400037f0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140077403
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400773fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400773fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140070964
mov rax, rbx
mov rcx, qword [rbp + 0x1300]
xor rcx, rsp
call fcn.140070900
mov rbx, qword [rsp + 0x1428]
add rsp, 0x1410
pop rbp
ret
Function at 0x1400aa540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400aa56d
xor al, al
jmp 0x1400aa6cf
mov rax, qword [0x1400ca6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400ca6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400ca6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400ca6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400ca6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400ca6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400ca6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400ca6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400ca700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400aa6c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400aa619
mov r11d, 2
jmp 0x1400aa63d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400aa633
mov r11d, 1
jmp 0x1400aa63d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400aa6e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400aa682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400aa69a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400aa6aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400aa6b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400aa600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400aa6ca
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14001fe98
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov edi, edx
mov rsi, rcx
mov rax, qword [0x14019c018]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
xor edx, edx
call fcn.14001dc04
mov dword [rsi + 0x120], ebx
mov dword [rsi + 0x124], edi
movaps xmm0, xmmword [0x140173f60]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmovb eax, ecx
mov qword [rsi + 0x128], rax
mov qword [rsi + 0x130], 0x20
mov qword [rsi + 0x138], 0x40
mov dword [rsi + 0x140], ebx
lea rax, [rsi + 8]
mov qword [rsi + 8], 0
xor rax, 0xffffffffb37cc16a
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rsi
mov dword [rsi + 0x28], ebx
lea rcx, [rsi + 0x30]
mov r8d, 0xf0
xor edx, edx
call fcn.140138090
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140135280
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140026ef0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x40
jb 0x140027025
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x140178e80]
nop word cs:[rax + rax]
nop dword [rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm0, xmmword [rcx]
pxor xmm0, xmm6
pxor xmm0, xmm4
movdqu xmm3, xmmword [rcx + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [rcx + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [rcx + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add rdx, 0xffffffffffffffc0
add rcx, 0x40
cmp rdx, 0x3f
ja 0x140026f80
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x140178e90]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp rdx, 0x10
jb 0x1400270ba
nop word [rax + rax]
movdqu xmm1, xmmword [rcx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add rcx, 0x10
add rdx, 0xfffffffffffffff0
cmp rdx, 0xf
ja 0x140027090
movdqa xmm1, xmmword [0x140178e90]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
pxor xmm3, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm3, 3
pclmulqdq xmm0, xmmword [0x140178ea0], 0x10
pblendw xmm0, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm3
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret

Function at 0x140028734
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
call fcn.140147560
call qword [0x1401bf010]
mov ecx, 2
call fcn.140139058
lea rcx, str.terminate_handler_unexpectedly_returned_n
mov edx, 0x28
mov r8d, 1
mov r9, rax
call fcn.14014ec94
call fcn.140149890
int3
Function at 0x14002aa10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14019c018]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [0x1401bf010]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14014ec94
cmp rax, rbx
jne 0x14002aab3
cmp edi, 1
je 0x14002aa54
cmp edi, 2
je 0x14002aab3
mov rcx, qword [rsi + 0x40]
call fcn.14014e618
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140135280
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14002aae0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14002ab15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014ec94
xor ebx, ebx
test rsi, rsi
jle 0x14002ab41
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x1401bf010]
cmp eax, 0xffffffff
je 0x14002ab41
inc rbx
cmp rsi, rbx
jne 0x14002ab1c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002ab50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x14019c018]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp edx, 0xffffffff
je 0x14002abbd
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x14002abc8
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14014ec94
mov esi, 0xffffffff
cmp rax, 1
je 0x14002abc0
jmp 0x14002ac84
xor r15d, r15d
mov esi, r15d
jmp 0x14002ac84
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [0x1401bf010]
cmp qword [rsp + 0x40], rsi
je 0x14002ac7f
mov ebp, eax
cmp eax, 3
je 0x14002ac5e
cmp ebp, 1
ja 0x14002ac7f
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14014ec94
cmp rax, rsi
jne 0x14002ac7f
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14002abe0
jmp 0x14002abc0
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14014ec94
cmp rax, 1
je 0x14002abc0
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140135280
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14002ad00
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x14002ad35
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14014ec94
xor ebx, ebx
test rsi, rsi
jle 0x14002ad62
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x1401bf010]
cmp ax, 0xffff
je 0x14002ad62
inc rbx
cmp rsi, rbx
jne 0x14002ad3c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14002ad70
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x14019c018]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp dx, 0xffff
je 0x14002addd
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x14002ade8
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14014ec94
mov si, 0xffff
cmp rax, 1
je 0x14002ade0
jmp 0x14002aea3
xor r15d, r15d
mov esi, r15d
jmp 0x14002aea3
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [0x1401bf010]
cmp qword [rsp + 0x40], rsi
je 0x14002ae9f
mov ebp, eax
cmp eax, 3
je 0x14002ae7e
cmp ebp, 1
ja 0x14002ae9f
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14014ec94
cmp rax, rsi
jne 0x14002ae9f
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x14002ae00
jmp 0x14002ade0
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14014ec94
cmp rax, 1
je 0x14002ade0
mov si, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140135280
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140031170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x1400311c1
mov dl, byte [rbp + 0x60]
movzx ebx, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov byte [rsp + 0x20], dl
mov rdx, r14
mov r8, rdi
call qword [0x1401bf010]
jmp 0x1400312b0
lea rbx, [rbp - 0x20]
mov rcx, r9
mov rdx, rbx
call fcn.140029306
lea rdx, [0x1401a9720]
mov rcx, rbx
call fcn.14003e4c0
mov rsi, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140031201
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1401bf010]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [0x140173f60]
movaps xmmword [rbp - 0x20], xmm0
mov rax, qword [rsi]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, rsi
mov rdx, rbx
call qword [0x1401bf010]
mov al, byte [rbp - 9]
test al, al
jns 0x140031290
mov rbx, qword [rbp - 0x20]
jmp 0x140031290
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
add rax, rcx
cmp rbx, rax
je 0x1400312a8
test rdi, rdi
je 0x140031288
mov al, byte [rbx]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140031270
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x14003128a
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x1401bf010]
cmp eax, 0xffffffff
jne 0x14003128a
xor edi, edi
inc rbx
mov al, byte [rbp - 9]
test al, al
js 0x140031243
movzx eax, al
add rax, rbp
add rax, 0xffffffffffffffe0
cmp rbx, rax
jne 0x140031253
mov qword [r14], rdi
jmp 0x1400312b0
mov qword [r14], rdi
call fcn.1401349d4
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x140032fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x140033003
movzx edx, word [rbp + 0x60]
movzx ebx, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], ebx
mov word [rsp + 0x20], dx
mov rdx, r14
mov r8, rdi
call qword [0x1401bf010]
jmp 0x140033101
lea rbx, [rbp - 0x20]
mov rcx, r9
mov rdx, rbx
call fcn.140029306
lea rdx, [0x1401a9730]
mov rcx, rbx
call fcn.14003e4c0
mov rsi, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140033043
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1401bf010]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [0x140173f60]
movaps xmmword [rbp - 0x20], xmm0
mov rax, qword [rsi]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, rsi
mov rdx, rbx
call qword [0x1401bf010]
mov al, byte [rbp - 9]
test al, al
jns 0x1400330dd
mov rbx, qword [rbp - 0x20]
jmp 0x1400330dd
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
lea rdx, [rcx + rdx*2]
cmp rbx, rdx
je 0x1400330f9
test rdi, rdi
je 0x1400330b5
movzx eax, word [rbx]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400330b9
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
jmp 0x1400330ce
xor edi, edi
jmp 0x1400330d9
mov rcx, qword [rdi]
mov rsi, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, rsi
call qword [0x1401bf010]
cmp ax, 0xffff
jne 0x1400330d6
xor edi, edi
mov al, byte [rbp - 9]
add rbx, 2
test al, al
js 0x140033085
movzx ecx, al
lea rcx, [rcx*2 - 0x20]
add rcx, rbp
cmp rbx, rcx
jne 0x140033096
mov qword [r14], rdi
jmp 0x140033101
mov qword [r14], rdi
call fcn.1401349d4
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x14003765b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r12, r9
mov r14, r8
mov rdi, rdx
mov r15, rcx
call fcn.1400433d6
mov ebx, eax
test rdi, rdi
je 0x140037690
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x1400376a3
movzx eax, word [rax]
jmp 0x1400376b3
xor esi, esi
mov eax, 6
test bl, bl
jne 0x14003773c
xor edi, edi
jmp 0x1400376c9
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1401bf010]
xor esi, esi
cmp ax, 0xffff
sete cl
cmove rdi, rsi
mov eax, 6
cmp bl, cl
je 0x14003773c
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400376db
movzx esi, word [rax]
jmp 0x1400376ea
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1401bf010]
mov esi, eax
mov rax, qword [r12]
mov rax, qword [rax + 0x18]
mov rcx, r12
mov dx, 4
mov r8d, esi
call qword [0x1401bf010]
test al, al
je 0x140037735
mov rax, qword [r12]
mov rax, qword [rax + 0x68]
mov rcx, r12
mov edx, esi
xor r8d, r8d
call qword [0x1401bf010]
mov ebx, eax
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x140037750
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x14003775d
xor esi, esi
mov eax, 4
or dword [r14], eax
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1401bf010]
mov ebp, dword [rsp + 0x80]
movsx esi, bl
mov rcx, r15
call fcn.1400433d6
mov ebx, eax
test rdi, rdi
je 0x140037785
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x140037789
movzx eax, word [rax]
jmp 0x140037799
mov al, 1
jmp 0x1400377a2
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1401bf010]
cmp ax, 0xffff
sete al
jne 0x1400377a4
xor edi, edi
add esi, 0xffffffd0
cmp bl, al
je 0x140037845
cmp ebp, 2
jl 0x140037845
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400377ca
movzx ebx, word [rax]
jmp 0x1400377d9
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1401bf010]
mov ebx, eax
mov rax, qword [r12]
mov rax, qword [rax + 0x18]
mov rcx, r12
mov dx, 4
mov r8d, ebx
call qword [0x1401bf010]
test al, al
je 0x14003773f
mov rax, qword [r12]
mov rax, qword [rax + 0x68]
mov rcx, r12
mov edx, ebx
xor r8d, r8d
call qword [0x1401bf010]
mov ebx, eax
mov rcx, qword [r15]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x140037828
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x140037835
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1401bf010]
lea eax, [rsi + rsi*4]
movsx ecx, bl
lea esi, [rcx + rax*2]
dec ebp
jmp 0x140037767
mov rcx, r15
call fcn.1400433d6
mov ebx, eax
test rdi, rdi
je 0x140037863
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x140037875
movzx eax, word [rax]
jmp 0x140037885
mov eax, 2
test bl, bl
jne 0x14003773c
jmp 0x14003773f
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x1401bf010]
cmp ax, 0xffff
sete al
xor bl, al
mov eax, 2
je 0x14003773c
jmp 0x14003773f