joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140133e20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x340
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov r13d, 8
movzx ebp, r9b
mov rbx, r8
mov r12, rdx
mov r14, rcx
cmp word [r8 + 0x170], r13w
jbe 0x140133e73
mov word [r8 + 0x170], r13w
mov word [r8 + 0x22], r13w
movzx eax, word [r8 + 0x170]
cmp ax, 1
jne 0x140133e94
mov eax, dword [r8 + 0x18]
add eax, 7
cdq
and edx, 7
lea edi, [rdx + rax]
sar edi, 3
jmp 0x140133ec7
cmp ax, 2
jne 0x140133ead
mov eax, dword [r8 + 0x18]
add eax, 3
cdq
and edx, 3
lea edi, [rdx + rax]
sar edi, 2
jmp 0x140133ec7
cmp ax, 4
jne 0x140133ec3
mov eax, dword [r8 + 0x18]
inc eax
cdq
sub eax, edx
sar eax, 1
lea edi, [rax + 3]
jmp 0x140133eca
mov edi, dword [r8 + 0x18]
add edi, 3
and edi, 0xfffffffc
xor r15d, r15d
mov rdx, rbx
mov rcx, r12
mov dword [r8 + 8], 1
mov dword [r8], r15d
mov dword [r8 + 0x28], edi
call fcn.14005ee10
movzx esi, ax
test ax, ax
jne 0x140134066
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x300
call fcn.1401c0040
test bpl, bpl
jne 0x140133f5f
movzx ecx, word [rbx + 0x178]
mov ebp, r15d
lea eax, [rcx + rcx*2]
test eax, eax
jle 0x140133f89
nop
cmp ebp, 0x300
jge 0x140133f89
mov r9, qword [r14]
mov edx, 1
movsxd rax, ebp
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 2]
add rcx, rax
call fcn.1401c1e14
mov rcx, qword [r14]
call fcn.1401c3f28
movzx eax, word [rbx + 0x178]
add ebp, 3
lea ecx, [rax + rax*2]
cmp ebp, ecx
jl 0x140133f20
jmp 0x140133f89
movzx ecx, word [rbx + 0x178]
mov eax, 0x100
cmp cx, ax
jae 0x140133f73
movzx eax, cx
mov r9, qword [r14]
lea rcx, [rsp + 0x30]
movsxd rdx, eax
mov r8d, 3
call fcn.1401c1e14
mov edx, dword [rsp + 0x3a0]
mov rcx, qword [r14]
xor r8d, r8d
call fcn.1401c1f88
cmp dword [rbx + 0x174], 1
jne 0x140133fc4
mov r9d, dword [rbx + 0x1c]
mov rdx, qword [rbx + 0x10]
mov r8d, edi
mov rcx, r14
mov qword [rsp + 0x20], r12
call fcn.140133c70
movzx esi, ax
jmp 0x140134051
cmp dword [rbx + 0x1c], r15d
jle 0x140134051
nop
cmp word [rbx + 0x22], 4
jne 0x140134029
cmp word [rbx + 0x20], 1
jne 0x140134029
cmp dword [rbx + 0x174], 2
je 0x140134032
mov r9, qword [r14]
mov rcx, qword [rbx + 0x10]
mov r8d, 1
movsxd rdx, edi
call fcn.1401c1e14
cmp rax, 1
jne 0x14013404c
mov r9d, 1
mov r8d, r15d
or edx, 0xffffffff
mov rcx, r12
call fcn.1400615b0
movzx esi, ax
test ax, ax
jne 0x140134051
inc r15d
cmp r15d, dword [rbx + 0x1c]
jl 0x140133fd0
jmp 0x140134051
cmp dword [rbx + 0x174], 2
jne 0x140133fe7
mov rdx, qword [rbx + 0x10]
lea r8d, [rdi + rdi]
mov rcx, r14
call fcn.140133af0
movzx esi, ax
test ax, ax
jne 0x140134051
jmp 0x140134002
mov esi, 4
lea r9, [rsp + 0x30]
mov r8d, r13d
mov edx, 0x200
mov rcx, r12
call fcn.14005cb20
movzx eax, si
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x398]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401359b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov eax, 0xaaaaaaab
mov esi, edx
mov r14, rcx
mov ecx, 0x100
mov rdi, r8
mul edx
mov ebx, edx
shr ebx, 1
mov word [r8 + 0xa], bx
cmp bx, cx
jle 0x1401359ee
mov eax, 2
jmp 0x140135a31
mov edx, 3
call fcn.1401be1f8
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x140135a08
mov eax, 1
jmp 0x140135a31
mov r9, qword [r14]
movsx r8, bx
mov edx, 3
mov rcx, rax
call fcn.1401c1e14
movsx eax, word [rdi + 0xa]
lea ecx, [rax + rax*2]
sub esi, ecx
mov rcx, r14
mov edx, esi
call fcn.140066ff0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140136310
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
push r14
push r15
sub rsp, 0x20
movzx eax, r8w
movzx edi, r9w
xor ebx, ebx
add eax, 0xf
mov r14, rdx
mov r15, rcx
shr eax, 3
and ax, 0xfffe
imul ax, word [rsp + 0x60]
test edi, edi
jle 0x1401363bd
mov qword [rsp + 0x40], rbp
mov rbp, qword [rsp + 0x68]
mov qword [rsp + 0x48], rsi
movsx rsi, ax
nop word [rax + rax]
mov r9, qword [r15]
mov r8d, 1
mov rdx, rsi
mov rcx, r14
call fcn.1401c1e14
test rax, rax
je 0x1401363b6
or r8d, 0xffffffff
mov r9d, 1
mov rcx, rbp
or edx, r8d
call fcn.1400615b0
test ax, ax
jne 0x14013639d
inc bx
movsx ecx, bx
cmp ecx, edi
jl 0x140136360
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov eax, 4
jmp 0x14013639d
movzx eax, bx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140136ba0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140066b70
mov edx, 0x10
mov dword [rbx], eax
mov r9, qword [rdi]
lea rcx, [rbx + 4]
lea r8d, [rdx - 0xe]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0x5c
lea r8d, [rdx - 0x5b]
lea rcx, [rbx + 0x24]
call fcn.1401c1e14
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
test rax, rax
setne cl
movzx eax, cx
add rsp, 0x20
pop rdi
ret
Function at 0x140136f10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rdx
mov rbx, rcx
call fcn.140066b70
mov dword [rdi], eax
mov rcx, rbx
cmp eax, 2
jg 0x140136f45
mov edx, 0x1be
jmp 0x140136fc1
mov edx, 0x3d
call fcn.140066ff0
mov r9, qword [rbx]
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
cmp byte [rsp + 0x20], 0x50
jne 0x140136fd7
cmp byte [rsp + 0x21], 0x4e
jne 0x140136fd7
cmp byte [rsp + 0x22], 0x54
jne 0x140136fd7
cmp byte [rsp + 0x23], 0x47
jne 0x140136fd7
cmp byte [rsp + 0x24], 0x4d
jne 0x140136fd7
cmp byte [rsp + 0x25], 0x50
jne 0x140136fd7
cmp byte [rsp + 0x26], 0x4e
jne 0x140136fd7
cmp byte [rsp + 0x27], 0x54
jne 0x140136fd7
mov edx, 0x37
mov rcx, rbx
call fcn.140066ff0
mov rcx, rbx
call fcn.140066b70
mov dword [rdi], eax
cmp eax, 2
jg 0x140136fd7
mov edx, 0x1fc
mov rcx, rbx
call fcn.140066ff0
mov rcx, qword [rbx]
call fcn.1401c1a94
xor ecx, ecx
test eax, eax
sete cl
jmp 0x140136fd9
xor ecx, ecx
movzx eax, cx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140137290
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r15d, byte [rsp + 0x80]
xor r13d, r13d
movzx r12d, r9b
movzx r14d, r8b
mov rbp, rdx
mov rsi, rcx
mov edi, r13d
mov qword [rsp + 0x60], rbx
nop dword [rax]
mov r9, qword [rsi]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x1401373a1
movzx ecx, byte [rsp + 0x20]
cmp cl, r14b
jne 0x140137332
mov r9, qword [rsi]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x1401373a1
movzx ebx, byte [rsp + 0x20]
mov ecx, edi
movzx edx, r12b
inc ebx
add rcx, rbp
mov r8d, ebx
call fcn.1401c0040
add edi, ebx
jmp 0x14013738f
cmp cl, r15b
jne 0x140137388
mov r9, qword [rsi]
mov edx, 1
lea rcx, [rsp + 0x21]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x1401373a1
mov r9, qword [rsi]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x1401373a1
movzx ebx, byte [rsp + 0x20]
movzx edx, byte [rsp + 0x21]
mov ecx, edi
inc ebx
add rcx, rbp
mov r8d, ebx
call fcn.1401c0040
add edi, ebx
jmp 0x14013738f
mov eax, edi
inc edi
mov byte [rax + rbp], cl
cmp edi, 0x7d00
jb 0x1401372d0
movzx eax, r13w
jmp 0x1401373a6
mov eax, 4
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401373d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov byte [rsp + 0x18], r8b
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r15d, byte [rsp + 0x80]
xor eax, eax
movzx r12d, r9b
movzx ebp, r8b
mov rsi, rdx
mov r14, rcx
lea edi, [rax + 0x50]
movzx ebx, ax
mov r13d, 0xffff
nop word [rax + rax]
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x140137518
movzx edx, byte [rsp + 0x20]
cmp dl, bpl
jne 0x140137470
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x140137518
movzx edx, r12b
mov byte [rsp + 0x21], dl
jmp 0x1401374b2
cmp dl, r15b
jne 0x1401374c1
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x21]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x140137518
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
test rax, rax
je 0x140137518
movzx edx, byte [rsp + 0x21]
movzx ecx, byte [rsp + 0x20]
inc cx
test cx, cx
je 0x14013750b
jmp 0x1401374ca
mov ecx, 1
mov byte [rsp + 0x21], dl
mov ebp, 0x8301
mov r15d, 0x7d00
nop word [rax + rax]
movzx eax, bx
add bx, 0x50
mov byte [rax + rsi], dl
cmp bx, r15w
jb 0x1401374f7
add bx, bp
add di, r13w
add cx, r13w
jne 0x1401374e0
movzx ebp, byte [rsp + 0x70]
movzx r15d, byte [rsp + 0x80]
test di, di
jne 0x140137420
xor eax, eax
jmp 0x14013751d
mov eax, 4
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140137540
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r11, rcx
movzx ecx, r8b
mov eax, 1
shl ax, cl
xor ecx, ecx
mov r10, rdx
dec ax
cmp r8w, 8
jg 0x1401375e6
cmp cx, r9w
jge 0x140137635
movsx r8d, ax
lea rcx, [r11 + 0x200]
movzx r9d, r9w
nop dword [rax + rax]
movzx eax, byte [r10]
lea rcx, [rcx + 1]
lea r10, [r10 + 4]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx + 0xff], al
movzx eax, byte [r10 - 3]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 1], al
movzx eax, byte [r10 - 2]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 0x101], al
movzx eax, byte [r10 - 1]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 0x201], al
dec r9
jne 0x140137580
mov byte [r11 + 0x400], 1
ret
cmp cx, r9w
jge 0x140137635
lea rcx, [r11 + 0x200]
movzx edx, r9w
nop word [rax + rax]
movzx eax, byte [r10]
lea rcx, [rcx + 1]
lea r10, [r10 + 4]
mov byte [rcx + 0xff], al
movzx eax, byte [r10 - 3]
mov byte [rcx - 1], al
movzx eax, byte [r10 - 2]
mov byte [rcx - 0x101], al
movzx eax, byte [r10 - 1]
mov byte [rcx - 0x201], al
dec rdx
jne 0x140137600
mov byte [r11 + 0x400], 1
ret
Function at 0x1401378a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r11, rcx
mov eax, 1
movzx ecx, r8b
shl ax, cl
mov r10, rdx
xor edx, edx
dec ax
cmp r8w, 8
jg 0x140137929
cmp dx, r9w
jge 0x14013796a
lea rcx, [r11 + 0x100]
movsx r8d, ax
movzx r11d, r9w
nop word [rax + rax]
movzx eax, byte [r10]
lea rcx, [rcx + 1]
lea r10, [r10 + 3]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx + 0xff], al
movzx eax, byte [r10 - 2]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 1], al
movzx eax, byte [r10 - 1]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 0x101], al
dec r11
jne 0x1401378e0
ret
cmp dx, r9w
jge 0x14013796a
lea rcx, [r11 + 0x100]
movzx edx, r9w
nop word [rax + rax]
movzx eax, byte [r10]
lea rcx, [rcx + 1]
lea r10, [r10 + 3]
mov byte [rcx + 0xff], al
movzx eax, byte [r10 - 2]
mov byte [rcx - 1], al
movzx eax, byte [r10 - 1]
mov byte [rcx - 0x101], al
dec rdx
jne 0x140137940
ret

Function at 0x140137970
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
mov rdi, rcx
movzx ecx, r8b
mov edx, 1
xor r11d, r11d
movsx rax, r9w
shl dx, cl
dec dx
cmp r8w, 8
jg 0x140137a1a
lea r8, [rax + r10]
lea rbx, [rax + r8]
cmp r11w, r9w
jge 0x140137af4
movsx r11d, dx
lea rcx, [rdi + 0x200]
movzx r9d, r9w
nop
movzx eax, byte [rbx]
lea rcx, [rcx + 1]
lea rbx, [rbx + 1]
lea r8, [r8 + 1]
lea r10, [r10 + 1]
imul eax, eax, 0xff
cdq
idiv r11d
mov byte [rcx - 0x201], al
movzx eax, byte [r8 - 1]
imul eax, eax, 0xff
cdq
idiv r11d
mov byte [rcx - 0x101], al
movzx eax, byte [r10 - 1]
imul eax, eax, 0xff
cdq
idiv r11d
mov byte [rcx - 1], al
dec r9
jne 0x1401379c0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
lea rcx, [r10 + rax*2]
movzx r8d, r11w
lea rdx, [rcx + rax*2]
cmp r11w, r9w
jge 0x140137a52
mov ebx, 0xff
movsx rax, r8w
cmp word [rdx + rax*2], bx
ja 0x140137a52
cmp word [rcx + rax*2], bx
ja 0x140137a52
cmp word [r10 + rax*2], bx
ja 0x140137a52
inc r8w
cmp r8w, r9w
jl 0x140137a31
cmp r8w, r9w
jne 0x140137aac
cmp r11w, r9w
jge 0x140137af4
lea r8, [rdi + 0x200]
movzx r11d, r9w
nop dword [rax]
movzx eax, byte [rdx]
lea r8, [r8 + 1]
lea rdx, [rdx + 2]
mov byte [r8 - 0x201], al
movzx eax, byte [rcx]
lea rcx, [rcx + 2]
mov byte [r8 - 0x101], al
movzx eax, byte [r10]
lea r10, [r10 + 2]
mov byte [r8 - 1], al
dec r11
jne 0x140137a70
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
cmp r11w, r9w
jge 0x140137af4
lea r8, [rdi + 0x200]
movzx r11d, r9w
nop dword [rax]
movzx eax, byte [rdx + 1]
lea r8, [r8 + 1]
lea rdx, [rdx + 2]
mov byte [r8 - 0x201], al
movzx eax, byte [rcx + 1]
lea rcx, [rcx + 2]
mov byte [r8 - 0x101], al
movzx eax, byte [r10 + 1]
lea r10, [r10 + 2]
mov byte [r8 - 1], al
dec r11
jne 0x140137ac0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140137b00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r11, rcx
movzx ecx, r8b
mov eax, 1
shl ax, cl
xor ecx, ecx
mov r10, rdx
dec ax
cmp r8w, 8
jg 0x140137ba6
cmp cx, r9w
jge 0x140137bf5
movsx r8d, ax
lea rcx, [r11 + 0x100]
movzx r9d, r9w
nop dword [rax + rax]
movzx eax, byte [r10]
lea rcx, [rcx + 1]
lea r10, [r10 + 4]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx + 0xff], al
movzx eax, byte [r10 - 3]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 1], al
movzx eax, byte [r10 - 2]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 0x101], al
movzx eax, byte [r10 - 1]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx + 0x1ff], al
dec r9
jne 0x140137b40
mov byte [r11 + 0x400], 1
ret
cmp cx, r9w
jge 0x140137bf5
lea rcx, [r11 + 0x100]
movzx edx, r9w
nop word [rax + rax]
movzx eax, byte [r10]
lea rcx, [rcx + 1]
lea r10, [r10 + 4]
mov byte [rcx + 0xff], al
movzx eax, byte [r10 - 3]
mov byte [rcx - 1], al
movzx eax, byte [r10 - 2]
mov byte [rcx - 0x101], al
movzx eax, byte [r10 - 1]
mov byte [rcx + 0x1ff], al
dec rdx
jne 0x140137bc0
mov byte [r11 + 0x400], 1
ret

Function at 0x140138280
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea eax, [r8 + r8]
mov r12, rcx
xor r13d, r13d
movsxd rcx, eax
mov r15, r9
mov ebx, r8d
mov rsi, rdx
mov edi, r13d
mov r14d, r13d
call fcn.1401bee78
mov rbp, rax
test rax, rax
jne 0x1401382cd
lea eax, [rbp + 1]
jmp 0x1401383f2
test ebx, ebx
jle 0x1401383c9
mov r8, r13
nop dword [rax + rax]
movsxd r10, edi
lea eax, [rdi + 1]
add r10, rsi
movzx r9d, byte [r10]
cmp eax, ebx
jge 0x14013830b
mov edx, eax
sub edx, edi
cmp edx, 0x7f
jge 0x14013830b
movsxd rcx, eax
cmp byte [rcx + rsi], r9b
jne 0x14013830b
inc eax
inc edx
cmp eax, ebx
jl 0x1401382f5
mov ecx, eax
sub ecx, edi
cmp ecx, 1
jne 0x1401383a7
cmp eax, ebx
jge 0x140138364
mov r9d, edi
neg r9d
lea ecx, [r9 + rax]
cmp ecx, 0x7f
jge 0x14013834b
movsxd rcx, eax
movzx edx, byte [rcx + rsi]
cmp dl, byte [rcx + rsi - 1]
jne 0x140138343
cmp eax, 1
jle 0x14013834b
cmp dl, byte [rcx + rsi - 2]
je 0x14013834b
inc eax
cmp eax, ebx
jl 0x140138322
jmp 0x140138364
cmp eax, ebx
jge 0x140138364
nop
movsxd rdx, eax
add rdx, rsi
movzx ecx, byte [rdx - 1]
cmp byte [rdx], cl
jne 0x140138364
dec eax
cmp eax, ebx
jl 0x140138350
movzx ecx, al
inc r8
inc r14d
sub cl, dil
dec cl
mov byte [r8 + rbp - 1], cl
cmp edi, eax
jge 0x1401383bf
mov ecx, eax
sub ecx, edi
movsxd rdx, ecx
add r14d, edx
nop word [rax + rax]
movzx ecx, byte [r10]
inc r8
lea r10, [r10 + 1]
mov byte [r8 + rbp - 1], cl
dec rdx
jne 0x140138390
jmp 0x1401383bf
sub dil, al
add r14d, 2
inc dil
add r8, 2
mov byte [r8 + rbp - 2], dil
mov byte [r8 + rbp - 1], r9b
mov edi, eax
cmp eax, ebx
jl 0x1401382e0
test r15, r15
je 0x1401383d1
mov dword [r15], r14d
mov r9, qword [r12]
movsxd rdx, r14d
mov r8d, 1
mov rcx, rbp
call fcn.1401c24f8
mov rcx, rbp
call fcn.1401be23c
movzx eax, r13w
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401385b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x28
lea eax, [r8 + r8]
mov rdi, rcx
mov r14d, r8d
movsxd rcx, eax
mov rbp, rdx
xor r13d, r13d
call fcn.1401bee78
mov ebx, r13d
mov r12, rax
test rax, rax
jne 0x1401385f7
lea eax, [r13 + 1]
add rsp, 0x28
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
mov rcx, qword [rdi]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x20], r15
call fcn.1401c2310
mov r9, qword [rdi]
mov rcx, r12
mov esi, eax
mov dword [rsp + 0x70], eax
mov eax, r14d
cdq
sub eax, edx
mov edx, 1
sar eax, 1
add eax, r14d
movsxd r8, eax
call fcn.1401c1e14
mov r15, rax
test r14d, r14d
jle 0x1401386cb
nop dword [rax]
cmp ebx, r15d
jge 0x1401386b9
movsxd rax, ebx
inc ebx
movzx ecx, byte [rax + r12]
cmp cx, 0x7f
jg 0x140138681
movsx eax, cx
add eax, ebx
cmp eax, r15d
jge 0x1401386b9
inc cx
movsxd rdx, ebx
movsx rdi, cx
movsx esi, cx
add rdx, r12
mov r8, rdi
mov rcx, rbp
sub r14d, esi
call fcn.1401bd6e0
add ebx, esi
jmp 0x1401386af
cmp ebx, r15d
jge 0x1401386b9
mov edx, 0x101
sub dx, cx
movsx eax, dx
movsx rdi, dx
sub r14d, eax
movsxd rax, ebx
mov r8, rdi
movzx ecx, byte [rax + r12]
inc ebx
mov edx, ecx
mov rcx, rbp
call fcn.1401c0040
add rbp, rdi
test r14d, r14d
jg 0x140138640
jmp 0x1401386c2
mov eax, 4
movzx r13d, ax
mov esi, dword [rsp + 0x70]
mov rdi, qword [rsp + 0x60]
mov rcx, r12
call fcn.1401be23c
mov r15, qword [rsp + 0x20]
test r13w, r13w
jne 0x1401386ec
mov rcx, qword [rdi]
lea edx, [rsi + rbx]
xor r8d, r8d
call fcn.1401c1f88
movzx eax, r13w
mov rsi, qword [rsp + 0x68]
add rsp, 0x28
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140138810
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
mov rdi, rcx
movzx ecx, r8b
mov edx, 1
xor r11d, r11d
movsx rax, r9w
shl dx, cl
dec dx
cmp r8w, 8
jg 0x1401388b8
lea r8, [rax + r10]
lea rbx, [rax + r8]
cmp r11w, r9w
jge 0x140138992
movsx r11d, dx
lea rcx, [rdi + 0x200]
sub r10, r8
movzx r9d, r9w
movzx eax, byte [r10 + r8]
lea rcx, [rcx + 1]
lea r8, [r8 + 1]
lea rbx, [rbx + 1]
imul eax, eax, 0xff
cdq
idiv r11d
mov byte [rcx - 0x201], al
movzx eax, byte [r8 - 1]
imul eax, eax, 0xff
cdq
idiv r11d
mov byte [rcx - 0x101], al
movzx eax, byte [rbx - 1]
imul eax, eax, 0xff
cdq
idiv r11d
mov byte [rcx - 1], al
dec r9
jne 0x140138861
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
lea rcx, [rax + rax]
movzx r8d, r11w
lea rax, [rcx + r10]
lea rdx, [rcx + rax]
cmp r11w, r9w
jge 0x1401388f4
mov ebx, 0xff
movsx rcx, r8w
cmp word [r10 + rcx*2], bx
ja 0x1401388f4
cmp word [rax + rcx*2], bx
ja 0x1401388f4
cmp word [rdx + rcx*2], bx
ja 0x1401388f4
inc r8w
cmp r8w, r9w
jl 0x1401388d3
cmp r8w, r9w
jne 0x14013894d
cmp r11w, r9w
jge 0x140138992
lea r8, [rdi + 0x200]
sub r10, rax
movzx r11d, r9w
movzx ecx, byte [r10 + rax]
lea r8, [r8 + 1]
lea rax, [rax + 2]
mov byte [r8 - 0x201], cl
movzx ecx, byte [rax - 2]
lea rdx, [rdx + 2]
mov byte [r8 - 0x101], cl
movzx ecx, byte [rdx - 2]
mov byte [r8 - 1], cl
dec r11
jne 0x140138912
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
cmp r11w, r9w
jge 0x140138992
lea r8, [rdi + 0x200]
sub r10, rax
movzx r11d, r9w
movzx ecx, byte [r10 + rax + 1]
lea r8, [r8 + 1]
lea rax, [rax + 2]
mov byte [r8 - 0x201], cl
movzx ecx, byte [rax - 1]
lea rdx, [rdx + 2]
mov byte [r8 - 0x101], cl
movzx ecx, byte [rdx - 1]
mov byte [r8 - 1], cl
dec r11
jne 0x140138961
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1401389a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r11, rcx
movzx ecx, r8b
mov eax, 1
shl ax, cl
xor ecx, ecx
mov r10, rdx
dec ax
cmp r8w, 8
jg 0x140138a46
cmp cx, r9w
jge 0x140138a95
movsx r8d, ax
lea rcx, [r11 + 0x200]
movzx r9d, r9w
nop dword [rax + rax]
movzx eax, byte [r10]
lea rcx, [rcx + 1]
lea r10, [r10 + 4]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 0x201], al
movzx eax, byte [r10 - 3]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 0x101], al
movzx eax, byte [r10 - 2]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx - 1], al
movzx eax, byte [r10 - 1]
imul eax, eax, 0xff
cdq
idiv r8d
mov byte [rcx + 0xff], al
dec r9
jne 0x1401389e0
mov byte [r11 + 0x400], 1
ret
cmp cx, r9w
jge 0x140138a95
lea rcx, [r11 + 0x200]
movzx edx, r9w
nop word [rax + rax]
movzx eax, byte [r10]
lea rcx, [rcx + 1]
lea r10, [r10 + 4]
mov byte [rcx - 0x201], al
movzx eax, byte [r10 - 3]
mov byte [rcx - 0x101], al
movzx eax, byte [r10 - 2]
mov byte [rcx - 1], al
movzx eax, byte [r10 - 1]
mov byte [rcx + 0xff], al
dec rdx
jne 0x140138a60
mov byte [r11 + 0x400], 1
ret
Function at 0x140160240
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov dword [r9], 0
mov r14d, 0x40000000
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rbx]
mov ecx, dword [rsi + 0x1c]
mov r8d, edi
sub r8d, edx
cmp r8d, r14d
cmova r8d, r14d
add rdx, rbp
call fcn.1401d5578
test eax, eax
jle 0x1401602a6
add dword [rbx], eax
cmp dword [rbx], edi
jb 0x140160280
test eax, eax
jns 0x1401602c7
call fcn.1401c7f6c
mov ecx, dword [rax]
call fcn.1401c7fdc
or edx, 0xffffffff
mov rcx, rsi
mov r8, rax
call fcn.140160820
or eax, 0xffffffff
jmp 0x1401602d4
test eax, eax
jne 0x1401602d2
mov dword [rsi + 0x50], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140160ec0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
sub rsp, 0x288
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp qword [rcx + 0x108], 0x3d40
mov rbp, rdx
mov rbx, rcx
jge 0x140160ef9
mov eax, 2
jmp 0x140161086
mov rcx, qword [rcx]
xor r8d, r8d
mov edx, 0x1d6
call fcn.1401c1f88
mov r9, qword [rbx]
mov edx, 0x22
lea r8d, [rdx - 0x21]
lea rcx, [rsp + 0x30]
call fcn.1401c1e14
test rax, rax
je 0x140160eef
lea rdx, str.Kodak_DC120_ZOOM_Digital_Camera
lea rcx, [rsp + 0x30]
call fcn.1401c3380
test eax, eax
jne 0x140160eef
mov edx, 0xcb
mov rcx, rbx
call fcn.140066ff0
mov rcx, qword [rbx]
call fcn.1401c3f28
cmp eax, 7
jne 0x140160eef
mov edx, 0x3a7c
mov rcx, rbx
mov qword [rsp + 0x2b0], rsi
call fcn.140066ff0
lea rcx, [rsp + 0x70]
mov edx, 0x200
call fcn.1400661b0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140066470
lea rcx, [rsp + 0x20]
mov edx, 0x12
call fcn.140066480
mov rsi, rax
test rax, rax
jne 0x140160fa5
lea eax, [rsi + 4]
jmp 0x14016107e
mov r9, qword [rax]
mov edx, 0x14
lea rcx, [0x1402a2060]
lea r8d, [rdx - 0x13]
mov qword [rsp + 0x280], rdi
call fcn.1401c24f8
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, qword [rbx]
mov edi, eax
call fcn.1401c3f28
cmp edi, 0xffffffff
je 0x140161020
nop dword [rax]
cmp eax, 0xffffffff
je 0x140161020
mov rdx, qword [rsi]
mov ecx, eax
call fcn.1401c1ae4
mov rdx, qword [rsi]
mov ecx, edi
call fcn.1401c1ae4
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, qword [rbx]
mov edi, eax
call fcn.1401c3f28
cmp edi, 0xffffffff
jne 0x140160ff0
mov rcx, rsi
call fcn.140066370
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140066470
lea rcx, [rsp + 0x20]
mov edx, 0x11
call fcn.140066480
lea r8, str.Kodak_DC120_Digital_Camera
xor r9d, r9d
mov rcx, rax
mov rdx, rbp
mov rdi, rax
call fcn.140077140
mov rcx, rdi
movzx ebx, ax
call fcn.140066370
lea rcx, [rsp + 0x70]
call fcn.140065fe0
mov rdi, qword [rsp + 0x280]
movzx eax, bx
mov rsi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x288
pop rbp
pop rbx
ret