joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001fc30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x30
movzx eax, byte [rdx]
xor r12d, r12d
mov rbp, r9
mov r15, r8
mov rbx, rdx
mov rsi, rcx
mov edi, 0xa
test al, al
je 0x14001fc95
movsx edx, al
inc rbx
cmp edx, 0x66
je 0x14001fc7c
cmp edx, 0x69
je 0x14001fd37
cmp edx, 0x6c
jne 0x14001fc8e
mov rax, qword [rsi + 0x10]
mov rcx, rsi
mov dword [rax + 0xefc], edx
call fcn.14001a480
movzx eax, byte [rbx]
test al, al
jne 0x14001fc63
mov rbx, qword [0x1400d2e80]
mov qword [rsp + 0x50], r14
lea r14, [rsi + 0x10]
test rbx, rbx
je 0x14001fd76
cmp qword [r14], rbx
jne 0x14001fd6d
mov rcx, qword [0x1400d2f08]
mov edx, 0xffffffff
mov dword [0x1400d2f10], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [0x1400d2ee0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and byte [rbx + 0x91], 0x7f
mov rcx, rbx
call fcn.14000efe0
mov rcx, rsi
mov dword [rbx + 0xefc], r12d
call fcn.14001a480
mov r8d, dword [0x1400d2ea0]
xor r9d, r9d
sub r8d, dword [0x1400d2ea8]
mov rdx, qword [0x1400d2ea8]
sub qword [rbx + 0x10], r8
mov rcx, qword [rbx + 8]
call qword [rbx]
mov qword [0x1400d2ea0], r12
mov qword [0x1400d2e98], r12
mov qword [0x1400d2e80], r12
jmp 0x14001fd76
movzx eax, byte [rbx]
mov edi, r12d
cmp al, 0x30
jl 0x14001fd63
cmp al, 0x39
ja 0x14001fd5b
inc rbx
movzx ecx, al
lea edi, [rdi + rdi*4]
lea edi, [rdi - 0x18]
movzx eax, byte [rbx]
lea edi, [rcx + rdi*2]
cmp al, 0x30
jge 0x14001fd41
test edi, edi
jg 0x14001fc8e
mov edi, 1
jmp 0x14001fc8e
test rbx, rbx
jne 0x14001fe64
cmp qword [0x1400d2ec8], r12
mov rax, qword [r14]
mov qword [0x1400d2e80], rax
mov dword [0x1400d2eb8], edi
mov qword [0x1400d2e88], r15
mov qword [0x1400d2e90], rbp
mov dword [0x1400d2ebc], r12d
mov qword [0x1400d2eb0], rsi
mov qword [0x1400d2ea8], r12
mov qword [0x1400d2ea0], r12
mov qword [0x1400d2e98], r12
jne 0x14001fe27
xor r8d, r8d
lea rcx, str.winmm.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1400d2ec8], rax
test rax, rax
je 0x14001fe27
lea rdx, str.timeBeginPeriod
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400d2ec8]
lea rdx, str.timeEndPeriod
mov qword [0x1400d2ed0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1400d2ed0], r12
mov qword [0x1400d2ed8], rax
je 0x14001fe1e
test rax, rax
jne 0x14001fe27
mov qword [0x1400d2ec8], r12
jmp 0x14001fe64
lea rcx, [0x1400d2ee0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r9, [0x1400d2e80]
mov qword [rsp + 0x28], r12
lea r8, [0x14001ff50]
mov dword [0x1400d2f10], r12d
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400d2f08], rax
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rdi
ret
Function at 0x140039cf0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
xor r11d, r11d
mov r10d, edx
mov edi, r8d
mov rbx, rcx
mov esi, 0xffffffff
test edx, edx
jne 0x140039d31
mov eax, dword [rcx]
test eax, eax
je 0x140039d21
bsf ecx, eax
cmp ecx, r8d
jb 0x140039d2b
mov ecx, r8d
shr eax, cl
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x30]
pop rdi
pop rsi
ret
shr eax, cl
mov dword [rbx], eax
sub edi, ecx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r15
mov r15d, 1
cmp edi, 0x12
jbe 0x140039dd3
mov edx, r9d
and r9b, 0x30
shr edx, 0x18
lea r8d, [rdx - 1]
cmp r9b, 0x20
jne 0x140039d7f
mov eax, 0x38e38e39
mov r14d, 0x3f
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
sub r14d, edx
jmp 0x140039de0
bsr ecx, dword [rbx + r10*4]
imul eax, r10d, 0x1d
mov esi, r10d
sub eax, edi
add eax, ecx
mov ecx, r15d
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x1400b5398]
cvttsd2si eax, xmm0
sub ecx, eax
mov eax, 0x38e38e39
sub ecx, edx
imul ecx
mov eax, r8d
sar edx, 1
mov r14d, edx
add edx, 0x3e
shr r14d, 0x1f
add r14d, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
sub esi, eax
add esi, 0x3d
jmp 0x140039de0
mov r14d, esi
cmp edi, 9
jb 0x140039e7d
nop
mov ecx, dword [rbx + r10*4]
mov r8d, r10d
mov eax, ecx
and ecx, 0x1ff
shr eax, 9
imul r9d, ecx, 0x1dcd65
mov dword [rbx + r10*4], eax
cmp r10d, r11d
je 0x140039e39
nop dword [rax]
nop word [rax + rax]
dec r8d
and r8d, 0x3f
mov edx, dword [rbx + r8*4]
mov eax, edx
shr eax, 9
and edx, 0x1ff
add eax, r9d
imul r9d, edx, 0x1dcd65
mov dword [rbx + r8*4], eax
cmp r8d, r11d
jne 0x140039e10
cmp r11d, r14d
je 0x140039e5c
cmp r11d, esi
je 0x140039e5c
test r9d, r9d
je 0x140039e53
dec r11d
and r11d, 0x3f
mov dword [rbx + r11*4], r9d
cmp dword [rbx + r10*4], 0
jne 0x140039e71
jmp 0x140039e68
cmp dword [rbx + r10*4], 0
jne 0x140039e71
cmp r10d, r11d
je 0x140039ee7
dec r10d
and r10d, 0x3f
dec esi
add edi, 0xfffffff7
cmp edi, 9
jae 0x140039de0
test edi, edi
je 0x140039ee7
mov r9d, dword [rbx + r10*4]
mov ecx, edi
mov eax, r9d
shl r15d, cl
dec r15d
shr eax, cl
and r9d, r15d
mov dword [rbx + r10*4], eax
mov esi, 0x3b9aca00
sar esi, cl
imul r9d, esi
cmp r10d, r11d
je 0x140039ed7
nop dword [rax]
dec r10d
mov ecx, edi
and r10d, 0x3f
mov edx, dword [rbx + r10*4]
mov eax, edx
shr eax, cl
add eax, r9d
mov r9d, edx
and r9d, r15d
mov dword [rbx + r10*4], eax
imul r9d, esi
cmp r10d, r11d
jne 0x140039eb0
test r9d, r9d
je 0x140039ee7
dec r11d
and r11d, 0x3f
mov dword [rbx + r11*4], r9d
mov r14, qword [rsp + 0x20]
mov eax, r11d
mov rbp, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x140051f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov ebp, r9d
mov r10, r8
mov r11, rdx
mov r14, rcx
test r9b, 1
jne 0x14005208d
nop dword [rax]
cmp r11, r10
je 0x14005208d
mov rsi, qword [r14]
xor ebx, ebx
movzx eax, word [r11]
xor edi, edi
lea rcx, [rax + rax*2]
mov edx, dword [rsi + rcx*8]
lea r11, [rsi + rcx*8]
mov r8d, edx
mov eax, edx
shr r8d, 0x1c
cmp r8d, 8
jne 0x140051fbf
shr edx, 0x10
cmp dl, 1
jne 0x140051fc5
or ebx, dword [r11 + 4]
movzx eax, ax
jmp 0x140051f94
cmp r8d, 5
jne 0x140051fca
movzx eax, ax
jmp 0x140051f94
mov ecx, dword [r10]
and eax, 0x3000000
or ebx, eax
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x10000000
je 0x140052023
movzx eax, cx
lea rcx, [rax + rax*2]
mov eax, dword [rsi + rcx*8]
lea r10, [rsi + rcx*8]
mov r9d, eax
mov ecx, eax
shr ecx, 0x1c
cmp ecx, 8
jne 0x14005200e
shr eax, 0x10
cmp al, 1
jne 0x140052013
or edi, dword [r10 + 4]
movzx eax, r9w
jmp 0x140051fe5
cmp ecx, 5
jne 0x140052019
movzx eax, r9w
jmp 0x140051fe5
and r9d, 0x3000000
or edi, r9d
test bpl, 4
je 0x140052033
cmp ebx, edi
jne 0x1400520c0
jmp 0x140052056
test bpl, 8
jne 0x140052056
mov eax, edi
and eax, ebx
cmp eax, edi
jne 0x1400520c0
cmp r8d, 4
je 0x14005208d
mov eax, dword [r10]
and eax, 0xf0000000
cmp eax, 0x40000000
je 0x14005208d
mov ecx, dword [r10]
mov eax, ecx
shr eax, 0x1c
cmp r8d, eax
jne 0x1400520c0
mov eax, dword [r10 + 4]
cmp dword [r11 + 4], eax
jne 0x1400520c0
test r8d, r8d
je 0x1400520b6
and edx, 0xe0000000
cmp edx, 0x20000000
jne 0x1400520a9
or ebp, 4
test bpl, 1
je 0x140051f80
mov eax, 1
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
cmp r8d, 1
jne 0x14005208d
cmp r11, r10
jne 0x1400520c0
jmp 0x14005208d
xor ecx, edx
test ecx, 0xc000000
je 0x14005208d
xor eax, eax
jmp 0x140052092
Function at 0x140055680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x4500
shr r8, 2
or dx, ax
mov word [rcx + 0xba], r8w
mov eax, 0x7fff
mov word [rcx + 0xbc], dx
mov word [rcx + 0xb8], ax
jmp fcn.14005ef20
Function at 0x140059260
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x6c]
mov esi, r8d
inc eax
mov rdi, rdx
mov dword [rcx + 0x6c], eax
mov rbx, rcx
cmp eax, 0x14
jg 0x1400592b5
call fcn.140058e40
mov rdx, rdi
mov rcx, rbx
call fcn.140058c10
dec dword [rbx + 0x6c]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400583c0
mov edx, 0x8d0
call fcn.1400581e0
int3
Function at 0x14005ef20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
lea r14, [0x140000000]
mov ecx, dword [rcx + 0xa8]
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x3ff0000
je 0x14005efda
bt ecx, 0x10
jb 0x14005ef78
movzx eax, byte [rdi + 0xbd]
test byte [rax + r14 + 0xb57e0], 0x60
jne 0x14005ef78
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14005b920
mov eax, ecx
and eax, 0xb0000
cmp eax, 0xb0000
je 0x14005efb6
movzx r8d, byte [rdi + 0xbd]
movzx eax, byte [r8 + r14 + 0xb57e0]
and al, 0x60
cmp al, 0x40
jne 0x14005efb6
cmp r8b, 0x47
je 0x14005efb6
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.1400555f0
and ecx, 0x110000
cmp ecx, 0x110000
je 0x14005efda
movzx eax, byte [rdi + 0xbd]
movzx eax, byte [rax + r14 + 0xb57e0]
and al, 0x60
cmp al, 0x60
je 0x14005efa3
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0x7ffd
mov qword [rsp + 0x40], rsi
nop
movzx edx, byte [rdi + 0xbd]
movzx r8d, word [rdi + 0xb8]
mov r10d, dword [rdi + 0x28]
shl edx, 0x11
cmp r8d, r10d
jb 0x14005f039
mov rax, qword [rdi + 0x20]
lea r9, [rax + r8*8]
movzx eax, byte [rax + r8*8 + 5]
shl eax, 0xa
add edx, eax
mov rax, qword [r9]
mov qword [rdi + 0xc0], rax
cmp r8w, bp
jae 0x14005f039
mov rax, qword [r9 + 8]
mov qword [rdi + 0xc8], rax
movzx r8d, word [rdi + 0xba]
cmp r8d, r10d
jb 0x14005f072
mov rax, qword [rdi + 0x20]
movzx ecx, byte [rax + r8*8 + 5]
lea r9, [rax + r8*8]
mov rax, qword [rax + r8*8]
mov qword [rdi + 0xd0], rax
cmp r8w, bp
jae 0x14005f07b
mov rax, qword [r9 + 8]
mov qword [rdi + 0xd8], rax
jmp 0x14005f07b
mov ecx, r8d
and ecx, 0x3ff
lea esi, [rcx + rdx]
xor ebx, ebx
mov r8d, ebx
mov eax, 0x5e1d27b
and r8d, 0x1ffff
or r8d, esi
mov ecx, r8d
ror ecx, 0xb
sub ecx, r8d
rol ecx, 0xe
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3e9
sub ecx, eax
mov edx, dword [r14 + rcx*4 + 0xb6620]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
je 0x14005f0de
lea eax, [rcx + 1]
mov edx, dword [r14 + rax*4 + 0xb6620]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
jne 0x14005f0f6
mov eax, edx
mov rcx, rdi
shr rax, 0x18
call qword [r14 + rax*8 + 0xb6130]
movzx edx, ax
test edx, edx
jne 0x14005f110
cmp ebx, 0xfffff
je 0x14005f133
mov eax, ebx
shr eax, 0xa
or ebx, eax
xor ebx, 0xffc00
jmp 0x14005f080
cmp edx, 5
jae 0x14005f149
cmp edx, 1
je 0x14005eff0
cmp edx, 2
jne 0x14005f13d
mov edx, dword [rdi + 0xb8]
mov rcx, rdi
call fcn.140055a00
jmp 0x14005f157
mov rcx, rdi
call fcn.14005b920
jmp 0x14005f157
cmp edx, 3
je 0x14005f172
mov eax, 0xffff
jmp 0x14005f157
mov rax, qword [rdi + 0x20]
movzx eax, byte [rax + rdx*8 + 4]
shl eax, 0x18
add eax, edx
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov edx, 0x18
mov rcx, rdi
call fcn.14001a090
int3
Function at 0x14005f180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
movzx r11d, word [rdx + 2]
mov r14, rcx
movzx r9d, word [r8 + 2]
cmp rdx, r8
je 0x14005f2d7
mov r10, qword [rcx + 0x20]
cmp byte [r10 + r11*8 + 5], 0x1e
lea rbx, [r10 + r11*8]
jne 0x14005f1b7
movzx r11d, word [rbx]
lea rbx, [r10 + r11*8]
cmp byte [r10 + r9*8 + 5], 0x1e
lea rcx, [r10 + r9*8]
jne 0x14005f1cb
movzx r9d, word [rcx]
lea rcx, [r10 + r9*8]
movzx edi, byte [rdx + 5]
lea eax, [rdi - 0x38]
cmp al, 1
jbe 0x14005f1db
movzx eax, word [rdx]
jmp 0x14005f1e3
movzx eax, word [rdx]
movzx eax, word [r10 + rax*8]
movzx edx, ax
movzx eax, byte [r8 + 5]
sub al, 0x38
cmp al, 1
jbe 0x14005f1f7
movzx eax, word [r8]
jmp 0x14005f200
movzx eax, word [r8]
movzx eax, word [r10 + rax*8]
movzx r8d, ax
cmp r11d, r9d
jne 0x14005f222
cmp edx, r8d
je 0x14005f2d7
mov rcx, r14
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp fcn.14005f380
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r15
mov r15d, 0x8000
cmp r11d, r15d
jae 0x14005f245
cmp r9d, r15d
jb 0x14005f2c9
cmp dil, 0x38
jne 0x14005f2be
xor esi, esi
mov ebp, r11d
cmp byte [rbx + 5], 0x29
mov edi, esi
jne 0x14005f272
movzx eax, word [rbx + 2]
cmp ax, r15w
jae 0x14005f272
movzx ebp, word [rbx]
mov esi, dword [r10 + rax*8]
cmp ebp, r9d
jne 0x14005f272
test esi, esi
jne 0x14005f2c9
cmp byte [rcx + 5], 0x29
jne 0x14005f293
movzx eax, word [rcx + 2]
cmp ax, r15w
jae 0x14005f293
movzx r9d, word [rcx]
mov edi, dword [r10 + rax*8]
cmp r11d, r9d
jne 0x14005f293
test edi, edi
jne 0x14005f2c9
cmp ebp, r9d
jne 0x14005f29c
cmp esi, edi
jne 0x14005f2c9
cmp edx, r8d
jne 0x14005f2cd
mov eax, 1
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
movzx eax, byte [rcx + 4]
xor al, byte [rbx + 4]
test al, 0x1f
je 0x14005f29c
xor eax, eax
jmp 0x14005f2a6
mov rcx, r14
call fcn.14005f380
jmp 0x14005f2a6
mov eax, 2
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x140060240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx eax, byte [rcx + 0xd4]
lea r14, [rcx + 0xb8]
movzx r12d, word [r14]
and al, 0x1f
mov rdi, rcx
cmp al, 0xe
jne 0x1400602a8
movzx edx, word [rcx + 0x208]
cmp edx, r12d
jbe 0x1400602a8
movzx eax, word [rcx + 0x226]
cmp eax, r12d
jbe 0x1400602a8
nop
cmp eax, edx
jb 0x1400603fd
mov ecx, eax
mov rax, qword [rdi + 0x20]
movzx eax, word [rax + rcx*8 + 6]
cmp eax, r12d
ja 0x140060290
movzx eax, word [rdi + 0x228]
cmp eax, r12d
jbe 0x140060401
mov rbx, qword [rdi + 0x20]
mov ebp, 0x8000
mov dword [rsp + 0x50], ebp
nop word [rax + rax]
lea r13, [rbx + rax*8]
movzx eax, word [rbx + rax*8]
movzx ecx, word [rbx + rax*8 + 2]
lea rdx, [rbx + rax*8]
cmp r14, rdx
je 0x1400603fd
movzx r9d, word [r14 + 2]
cmp byte [rbx + r9*8 + 5], 0x1e
lea r8, [rbx + r9*8]
jne 0x140060303
movzx r9d, word [r8]
lea r8, [rbx + r9*8]
cmp byte [rbx + rcx*8 + 5], 0x1e
lea r10, [rbx + rcx*8]
jne 0x140060316
movzx ecx, word [r10]
lea r10, [rbx + rcx*8]
movzx r11d, byte [r14 + 5]
lea eax, [r11 - 0x38]
cmp al, 1
jbe 0x140060329
movzx eax, word [r14]
jmp 0x140060331
movzx eax, word [r14]
movzx eax, word [rbx + rax*8]
movzx r15d, ax
movzx eax, byte [rdx + 5]
sub al, 0x38
cmp al, 1
jbe 0x140060344
movzx eax, word [rdx]
jmp 0x14006034b
movzx eax, word [rdx]
movzx eax, word [rbx + rax*8]
movzx esi, ax
cmp r9d, ecx
je 0x1400603d2
cmp r9d, ebp
jae 0x140060360
cmp ecx, ebp
jb 0x1400603e9
cmp r11b, 0x38
jne 0x1400603c5
xor r11d, r11d
xor edx, edx
cmp byte [r8 + 5], 0x29
mov ebp, r9d
jne 0x140060392
movzx eax, word [r8 + 2]
cmp ax, word [rsp + 0x50]
jae 0x140060392
movzx ebp, word [r8]
mov r11d, dword [rbx + rax*8]
cmp ebp, ecx
jne 0x140060392
test r11d, r11d
jne 0x1400603e9
cmp byte [r10 + 5], 0x29
jne 0x1400603ba
movzx eax, word [r10 + 2]
mov r8d, 0x8000
cmp ax, r8w
jae 0x1400603ba
movzx ecx, word [r10]
mov edx, dword [rbx + rax*8]
cmp r9d, ecx
jne 0x1400603ba
test edx, edx
jne 0x1400603e9
cmp ebp, ecx
jne 0x1400603d2
cmp r11d, edx
je 0x1400603d2
jmp 0x1400603e9
movzx eax, byte [r10 + 4]
xor al, byte [r8 + 4]
test al, 0x1f
jne 0x1400603e9
cmp r15d, esi
je 0x1400603fd
mov rcx, rdi
mov r8d, esi
mov edx, r15d
call fcn.14005f380
test eax, eax
jne 0x1400603fd
movzx eax, word [r13 + 6]
cmp eax, r12d
jbe 0x140060401
mov ebp, 0x8000
jmp 0x1400602d0
xor eax, eax
jmp 0x140060406
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400606e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
movzx esi, dx
mov r14, rcx
movzx r9d, word [rcx + rsi*2 + 0x1a2]
cmp r9d, r8d
jbe 0x14006077d
mov r11, qword [rcx + 0x20]
mov eax, r8d
lea rbp, [r11 + rax*8]
nop word [rax + rax]
movzx eax, byte [r11 + r9*8 + 4]
lea rbx, [r11 + r9*8]
movzx ecx, word [rbx]
and al, 0x1f
cmp ecx, r8d
je 0x1400607c1
test al, al
jne 0x140060773
movzx r9d, word [r11 + rcx*8 + 2]
movzx r10d, word [rbp + 2]
cmp esi, 0x42
je 0x14006075c
movzx edx, byte [r11 + r10*8 + 4]
xor dl, byte [r11 + r9*8 + 4]
test dl, 0x1f
jne 0x140060773
cmp r9d, r10d
je 0x1400607a6
cmp r9d, 0x8000
jae 0x1400607a6
cmp r10d, 0x8000
jae 0x1400607a6
movzx r9d, word [rbx + 6]
cmp r9d, r8d
ja 0x140060720
movzx eax, word [r14 + rsi*2 + 0x192]
cmp eax, r8d
jbe 0x1400607a6
mov rdx, qword [r14 + 0x20]
nop
lea rcx, [rdx + rax*8]
movzx eax, word [rdx + rax*8]
cmp eax, r8d
je 0x1400607cc
movzx eax, word [rcx + 6]
cmp eax, r8d
ja 0x140060790
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
jmp 0x1400607a8
test byte [rcx + 4], 0x1f
mov ecx, 0
setne cl
mov eax, ecx
jmp 0x1400607a8
Function at 0x140061890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x20
mov r10, qword [rcx + 0x20]
mov esi, r9d
movzx r14d, dx
mov r12d, r8d
mov r9d, edx
mov rbp, rcx
movzx r15d, byte [r10 + r14*8 + 5]
cmp r15d, 0x35
jb 0x1400619cf
cmp r15d, r8d
jg 0x1400619cf
xor edx, edx
add rcx, 0xb24
nop word [rax + rax]
cmp word [rcx], r14w
jne 0x1400618fa
mov eax, dword [rcx + 4]
cmp eax, esi
jb 0x1400618fa
xor eax, esi
test eax, 0xfff
je 0x1400619be
inc rdx
add rcx, 8
cmp rdx, 0x10
jl 0x1400618e0
movzx edx, word [r10 + r14*8]
mov r9d, esi
mov qword [rsp + 0x40], rbx
mov rcx, rbp
movzx ebx, word [r10 + r14*8 + 2]
mov qword [rsp + 0x48], rdi
call fcn.140061890
mov r9d, esi
mov r8d, r12d
mov edx, ebx
mov rcx, rbp
mov edi, eax
call fcn.140061890
mov ecx, 0xf4
mov word [rbp + 0xb8], di
add r15w, cx
mov word [rbp + 0xba], ax
movzx edx, r15w
mov ecx, 0x100
imul edx, ecx
mov r8d, esi
shr r8d, 5
mov rcx, rbp
and r8w, 0x1f
or r8w, dx
mov word [rbp + 0xbc], r8w
call fcn.14005ef20
mov ecx, dword [rbp + 0xba4]
mov r9d, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rdx, [rcx*8]
lea eax, [rcx + 1]
and eax, 0xf
mov dword [rbp + 0xba4], eax
mov word [rdx + rbp + 0xb24], r14w
mov word [rdx + rbp + 0xb26], r9w
mov dword [rdx + rbp + 0xb28], esi
jmp 0x140061a10
movzx ecx, word [rcx + 2]
movzx eax, byte [r10 + rcx*8 + 4]
shl eax, 0x18
add eax, ecx
jmp 0x140061a13
bt esi, 0xb
jae 0x140061a10
movzx ecx, byte [r10 + r14*8 + 4]
mov edx, 0x605fd9
and ecx, 0x1f
shr edx, cl
test dl, 1
jne 0x140061a10
mov eax, 0x5b15
mov word [rbp + 0xb8], r14w
mov rcx, rbp
mov word [rbp + 0xbc], ax
mov word [rbp + 0xba], si
call fcn.14005ef20
mov r9d, eax
mov eax, r9d
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14006b400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
mov edx, 0x14
call fcn.140055a00
mov ecx, 0x548a
mov word [rdi + 0xb8], ax
mov word [rdi + 0xbc], cx
mov rcx, rdi
mov word [rdi + 0xba], bx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005ef20

Function at 0x14006e338
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006e382
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006e382
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006e382
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006e382
cmp dword [rcx + 0x84], 0xe
jbe 0x14006e382
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006e384
xor al, al
add rsp, 0x28
ret

Function at 0x14008b314
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14008b1a7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008b1a7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008b1a7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008b1a7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008b1a7
cmp dword [rcx + 0x84], 0xe
jbe 0x14008b1a7
cmp dword [rcx + 0xf8], 0
je 0x14008b1a7
mov ecx, ebx
call fcn.14008b248
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14008b038
cmp dword [rbp + 0x20], 0
je 0x14008b1f4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14008b1fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14008b140
Function at 0x14009ece4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14009ea0a
call fcn.14008b3d8
mov dword [rax], 0x16
call fcn.140098eb0
jmp 0x14009eb55
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14009eb55
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14009eb55
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14009ea39
lock or dword [rcx + 0x14], 0x10
jmp 0x14009eb55
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14009ea4d
call fcn.1400a263c
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14009ea5d
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14009ea60
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14008a6dc
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.14009e460
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14009eb43
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14009eaf1
mov rcx, rbx
call fcn.14008a6dc
cmp eax, 0xffffffff
je 0x14009eadc
mov rcx, rbx
call fcn.14008a6dc
cmp eax, 0xfffffffe
je 0x14009eadc
mov rcx, rbx
call fcn.14008a6dc
movsxd rdi, eax
lea r14, [0x1400d3ce0]
mov rcx, rbx
sar rdi, 6
call fcn.14008a6dc
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14009eae3
lea rdx, [0x1400d2340]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14009eaf1
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14009eb15
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14009eb15
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14009eb15
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14009eb33
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14009eb3e
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14009eb5a
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14009e9d4

Function at 0x1400a4c8c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400a4cac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14008b368
or eax, 0xffffffff
jmp 0x1400a4cae
xor eax, eax
add rsp, 0x28
ret