joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14032be50
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x40
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r8d, dword [rcx + 0x18]
mov rbx, rcx
mov ecx, dword [rcx + 0x14]
mov eax, r8d
shr eax, 0x18
mov r14, rdx
mov byte [rsp + 0x20], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x21], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x22], al
mov eax, ecx
shr eax, 0x18
mov byte [rsp + 0x24], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x25], al
mov eax, ecx
shr eax, 8
mov byte [rsp + 0x27], cl
mov byte [rsp + 0x26], al
mov eax, ecx
mov ecx, eax
mov qword [rsp + 0x70], rsi
shr rcx, 3
add eax, 8
and ecx, 0x3f
mov qword [rsp + 0x30], r15
mov byte [rsp + 0x23], r8b
mov dword [rbx + 0x14], eax
cmp eax, 8
jae 0x14032beda
inc r8d
lea rax, [rcx + 1]
mov dword [rbx + 0x18], r8d
lea r15, [0x1403ecb74]
cmp rax, 0x3f
jbe 0x14032bf56
mov esi, 0x40
mov qword [rsp + 0x38], rdi
sub rsi, rcx
mov rdx, r15
add rcx, 0x1c
mov r8, rsi
add rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rbp, [rbx + 0x1c]
mov rcx, rbx
mov rdx, rbp
call fcn.14032c0a0
lea rdi, [rsi + 0x3f]
cmp rdi, 1
jae 0x14032bf4d
nop word [rax + rax]
lea rdx, [r15 - 0x3f]
mov rcx, rbx
add rdx, rdi
call fcn.14032c0a0
add rsi, 0x40
add rdi, 0x40
cmp rdi, 1
jb 0x14032bf30
mov rdi, qword [rsp + 0x38]
xor ecx, ecx
jmp 0x14032bf5c
xor esi, esi
lea rbp, [rbx + 0x1c]
add rcx, 0x1c
lea rdx, [rsi + r15]
mov r8d, 1
add rcx, rbx
sub r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rbx + 0x14]
mov r15, qword [rsp + 0x30]
and eax, 0x1f8
mov rsi, qword [rsp + 0x70]
cmp eax, 0x1c0
je 0x14032bfb4
nop
mov r8d, 1
lea rdx, [0x1403e916c]
mov rcx, rbx
call fcn.14032dd10
mov eax, dword [rbx + 0x14]
and eax, 0x1f8
cmp eax, 0x1c0
jne 0x14032bf90
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14032dd10
movzx eax, byte [rbx + 3]
xorps xmm0, xmm0
mov byte [r14], al
movzx eax, byte [rbx + 2]
mov byte [r14 + 1], al
mov eax, dword [rbx]
shr eax, 8
mov byte [r14 + 2], al
movzx eax, byte [rbx]
mov byte [r14 + 3], al
movzx eax, byte [rbx + 7]
mov byte [r14 + 4], al
movzx eax, byte [rbx + 6]
mov byte [r14 + 5], al
mov eax, dword [rbx + 4]
shr eax, 8
mov byte [r14 + 6], al
movzx eax, byte [rbx + 4]
mov byte [r14 + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [r14 + 8], al
movzx eax, byte [rbx + 0xa]
mov byte [r14 + 9], al
mov eax, dword [rbx + 8]
shr eax, 8
mov byte [r14 + 0xa], al
movzx eax, byte [rbx + 8]
mov byte [r14 + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [r14 + 0xc], al
movzx eax, byte [rbx + 0xe]
mov byte [r14 + 0xd], al
mov eax, dword [rbx + 0xc]
shr eax, 8
mov byte [r14 + 0xe], al
movzx eax, byte [rbx + 0xc]
mov byte [r14 + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [r14 + 0x10], al
movzx eax, byte [rbx + 0x12]
mov byte [r14 + 0x11], al
mov eax, dword [rbx + 0x10]
shr eax, 8
mov byte [r14 + 0x12], al
movzx eax, byte [rbx + 0x10]
mov byte [r14 + 0x13], al
xor eax, eax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbx + 0x14], rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0x40
pop r14
pop rbp
pop rbx
ret
Function at 0x14034d190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x14034d299
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x1403e0460]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x14034d211
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x14034d24c
test ecx, ecx
jne 0x14034d25a
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.1402bb740
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x14034d230
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x14034d1d0
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x14034d25f
inc r8
jmp 0x14034d200
test r10d, r10d
jne 0x14034d229
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x14034d285
test edx, edx
je 0x14034d211
inc rax
jmp 0x14034d270
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x14034d229
inc rax
jmp 0x14034d270
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14035ff90
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, qword [rcx]
lea rbp, [rcx + 0x68]
xor ebx, ebx
mov r13, r8
mov r15, rcx
mov esi, ebx
mov r12d, dword [r14 + 0x18]
cmp qword [rbp], rbx
jne 0x1403600a0
cmp dword [r14 + 0x44], ebx
lea rax, str._origin
mov r9, qword [r14 + 0x10]
lea rdx, [0x1403f5736]
mov r8, qword [r14 + 8]
lea rcx, str.SELECT_sz_s_FROM__Q._q_docsize_WHERE_id_
cmovne rdx, rax
call fcn.140285a90
mov rdi, rax
test rax, rax
jne 0x14036000c
mov esi, 7
jmp 0x1403600a0
mov rax, qword [r15]
mov r9d, 0x85
mov qword [rsp + 0x30], rbx
mov r8d, 0xffffffff
mov qword [rsp + 0x28], rbp
mov rdx, rdi
mov qword [rsp + 0x20], rbx
inc dword [rax + 0x80]
mov rcx, qword [r14]
call fcn.14036b1c0
mov esi, eax
mov rax, qword [r15]
dec dword [rax + 0x80]
cmp dword [reloc.SinoSPE.dll_Ordinal_1], ebx
je 0x140360097
mov rcx, qword [0x1404b8660]
test rcx, rcx
je 0x140360060
call qword [0x1404a5bd0]
mov rcx, rdi
call qword [0x1404a5b88]
dec qword [0x1404b85e8]
movsxd rcx, eax
sub qword [0x1404b85a0], rcx
mov rcx, rdi
call qword [0x1404a5b78]
mov rcx, qword [0x1404b8660]
test rcx, rcx
je 0x1403600a0
call qword [0x1404a5be0]
jmp 0x1403600a0
mov rcx, rdi
call qword [0x1404a5b78]
mov rdi, qword [rbp]
mov rcx, rdi
call fcn.14028bb90
test rdi, rdi
je 0x1403601aa
mov r8, qword [rsp + 0x78]
mov edx, 1
mov rcx, rdi
call fcn.140288b80
mov rcx, rdi
call fcn.14028a180
cmp eax, 0x64
jne 0x140360196
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1403600ea
call qword [0x1404a5bd0]
mov rcx, qword [rdi + 0xa0]
test rcx, rcx
je 0x1403600ff
cmp bx, word [rdi + 0xc0]
jb 0x14036011a
mov rcx, qword [rdi]
mov edx, reloc.SinoSPE.dll_Ordinal_25
mov dword [rcx + 0x50], reloc.SinoSPE.dll_Ordinal_25
call fcn.140345860
lea rcx, [0x1403e20b8]
call fcn.14028c250
mov rcx, qword [rdi]
mov r14, rax
mov edx, dword [rdi + 0x34]
cmp byte [rcx + 0x67], bl
jne 0x140360135
test edx, edx
jne 0x140360135
mov eax, ebx
jmp 0x14036013a
call fcn.140299160
mov dword [rdi + 0x34], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x14036014f
call qword [0x1404a5be0]
xor edx, edx
mov rcx, rdi
call fcn.14028b650
mov ebp, eax
mov esi, ebx
test r12d, r12d
jle 0x140360188
cmp ebx, ebp
jge 0x140360196
movsxd rcx, esi
lea rdx, [rcx*4]
movsxd rcx, ebx
add rcx, r14
add rdx, r13
call fcn.14035a880
add ebx, eax
inc esi
cmp esi, r12d
jl 0x140360162
cmp ebx, ebp
jne 0x140360196
mov rcx, rdi
call fcn.14028bb90
jmp 0x1403601ac
mov rcx, rdi
call fcn.14028bb90
test eax, eax
mov ecx, 0x10b
cmove eax, ecx
jmp 0x1403601ac
mov eax, esi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140361990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [rsp + 0x70]
xor ebp, ebp
movsxd rdi, r9d
mov rsi, r8
mov r14d, edx
mov r13, rcx
mov r8d, edx
mov dword [r15], ebp
test rcx, rcx
je 0x140361ad4
lea eax, [rdi - 1]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r12
mov r9d, Ordinal_16
movsxd rdx, eax
test eax, eax
js 0x1403619f7
nop dword [rax]
movsx ecx, byte [rdx + rsi]
lea eax, [r9*8]
xor ecx, eax
xor r9d, ecx
sub rdx, 1
jns 0x1403619e0
lea r12d, [r9*8]
mov eax, r9d
xor r12, r8
xor r12, rax
and r12d, 0x1ff
mov rbx, qword [r13 + r12*8]
test rbx, rbx
je 0x140361a46
nop dword [rax]
cmp dword [rbx + 0xc], r14d
jne 0x140361a3d
cmp dword [rbx + 8], edi
jne 0x140361a3d
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140361ab7
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140361a20
lea rbp, [rdi + 0x18]
call fcn.1403a2170
test eax, eax
jne 0x140361ac2
mov rcx, rbp
call fcn.14036b6d0
mov rbx, rax
test rax, rax
je 0x140361ac2
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbx + 0x18]
mov dword [rbx + 8], edi
mov r8, rdi
mov qword [rbx], rcx
mov rdx, rsi
mov dword [rbx + 0xc], r14d
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r13 + r12*8]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov eax, ecx
mov qword [r13 + r12*8], rbx
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov dword [r15], 1
mov eax, ebp
jmp 0x140361a9b
test rbp, rbp
mov eax, 7
mov ecx, 0
cmovle eax, ecx
jmp 0x140361a9b
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x1403620b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
cmp ecx, 0x80
jge 0x1403620d2
lea edx, [rcx - 0x41]
cmp edx, 0x19
lea eax, [rcx + 0x20]
cmova eax, ecx
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x10000
jge 0x140362197
mov qword [rsp + 0x30], rbx
xor r10d, r10d
mov qword [rsp + 0x38], rsi
mov r11d, r10d
lea rsi, [0x140000000]
mov r9d, 0xa2
mov ebx, 0xffffffff
lea eax, [r11 + r9]
mov r8d, ecx
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
movzx edx, word [rsi + rdx*4 + 0x3e0f70]
sub r8d, edx
mov edx, eax
cmovs edx, ebx
test r8d, r8d
movsxd rbx, edx
lea edx, [rax + 1]
cmovs edx, r11d
dec eax
test r8d, r8d
mov r11d, edx
cmovs r9d, eax
cmp r9d, edx
jge 0x140362100
lea r8, [rbx*4 + 0x3e0f70]
mov rbx, qword [rsp + 0x30]
movzx edx, word [r8 + rsi]
movzx eax, byte [r8 + rsi + 3]
add eax, edx
cmp ecx, eax
jge 0x14036217a
movzx eax, byte [r8 + rsi + 2]
xor edx, ecx
and edx, eax
test dl, 1
jne 0x14036217a
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x3e80a0]
add eax, ecx
movzx ecx, ax
mov rsi, qword [rsp + 0x38]
test edi, edi
je 0x1403621a5
cmp edi, 2
sete r10b
mov edx, r10d
add rsp, 0x20
pop rdi
jmp fcn.1402fbd90
lea eax, [rcx - 0x10400]
cmp eax, 0x27
lea eax, [rcx + 0x28]
jbe 0x1403621a7
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1403a37e0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 8], rax
movups xmm0, xmmword [r9]
mov r15, qword [rbp + 0x60]
mov eax, edx
mov r12, qword [rbp + 0x70]
mov edi, edx
xor ebx, ebx
mov byte [rbp - 0x10], dil
test r8d, r8d
mov dword [rbp - 0xc], 0x546c4173
movups xmmword [rbp - 0x20], xmm0
sete bl
mov dword [rsp + 0x48], 0x67452301
sar eax, 8
mov r14, rcx
mov byte [rbp - 0xf], al
lea rcx, [rbp - 8]
mov eax, edx
mov dword [rsp + 0x4c], 0xefcdab89
sar eax, 0x10
mov esi, r8d
mov byte [rbp - 0xe], al
mov eax, edx
sar eax, 0x18
lea rdx, [rsp + 0x40]
mov byte [rbp - 0xd], al
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x50], 0x98badcfe
movsd xmm0, qword [rbp - 0x10]
movsd qword [rsp + 0x68], xmm0
mov dword [rsp + 0x54], 0x10325476
mov qword [rsp + 0x40], reloc.SinoSPE.dll_Ordinal_24
call fcn.140292750
lea rdx, [rsp + 0x30]
mov ecx, edi
call fcn.1403a69a0
lea rax, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp - 8]
mov edx, 1
mov dword [rsp + 0x20], 0
mov rcx, r14
call fcn.140293e40
mov eax, dword [rbp + 0x68]
mov r9, r12
mov rdx, r15
mov rcx, r14
lea r8d, [rax*8]
test esi, esi
je 0x1403a38e7
call fcn.140293060
jmp 0x1403a38ec
call fcn.1402928d0
shr eax, 0x1f
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1403a3920
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 0x18], rax
movups xmm0, xmmword [r9]
mov r15, qword [rbp + 0x70]
mov eax, edx
movups xmm1, xmmword [r9 + 0x10]
mov r12, qword [rbp + 0x80]
mov edi, edx
xor ebx, ebx
mov byte [rbp + 0x10], dil
test r8d, r8d
mov dword [rbp + 0x14], 0x546c4173
movups xmmword [rsp + 0x48], xmm0
sete bl
mov dword [rsp + 0x40], 0
sar eax, 8
mov r14, rcx
mov byte [rbp + 0x11], al
lea rcx, [rsp + 0x40]
mov eax, edx
mov dword [rsp + 0x44], reloc.SinoSPE.dll_Ordinal_40
sar eax, 0x10
mov esi, r8d
mov byte [rbp + 0x12], al
mov eax, edx
sar eax, 0x18
lea rdx, [rbp - 0x10]
mov byte [rbp + 0x13], al
mov eax, dword [0x1404a5f78]
movsd xmm0, qword [rbp + 0x10]
mov dword [rbp - 0x38], eax
mov eax, dword [0x1404a5f7c]
mov dword [rbp - 0x34], eax
mov eax, dword [0x1404a5f80]
mov dword [rbp - 0x30], eax
mov eax, dword [0x1404a5f84]
mov dword [rbp - 0x2c], eax
mov eax, dword [0x1404a5f88]
mov dword [rbp - 0x28], eax
mov eax, dword [0x1404a5f8c]
mov dword [rbp - 0x24], eax
mov eax, dword [0x1404a5f90]
mov dword [rbp - 0x20], eax
mov eax, dword [0x1404a5f94]
mov dword [rbp - 0x1c], eax
movups xmmword [rsp + 0x58], xmm1
movsd qword [rsp + 0x68], xmm0
call fcn.14032df40
lea rdx, [rsp + 0x30]
mov ecx, edi
call fcn.1403a69a0
lea rax, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
mov edx, 1
mov dword [rsp + 0x20], 2
mov rcx, r14
call fcn.140293e40
mov eax, dword [rbp + 0x78]
mov r9, r12
mov rdx, r15
mov rcx, r14
lea r8d, [rax*8]
test esi, esi
je 0x1403a3a5f
call fcn.140293060
jmp 0x1403a3a64
call fcn.1402928d0
shr eax, 0x1f
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1403a69a0
Capabilities:
Hash data with md5

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 0x47], rax
inc ecx
mov r9, rdx
mov eax, 0x4f7a09cd
imul ecx
imul ecx, ecx, 0x9ef4
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul ecx, r8d, 0x9ef4
mov eax, r8d
sar eax, 8
mov byte [rbp + 0x38], al
mov eax, r8d
sar eax, 0x10
mov byte [rbp + 0x39], al
mov eax, r8d
sar eax, 0x18
mov byte [rbp + 0x3a], al
mov eax, 0x4f7a09cd
imul r8d
mov byte [rbp + 0x37], r8b
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul ecx, r8d, 0x9ef4
mov eax, r8d
sar eax, 8
mov byte [rbp + 0x3c], al
mov eax, r8d
sar eax, 0x10
mov byte [rbp + 0x3d], al
mov eax, r8d
sar eax, 0x18
mov byte [rbp + 0x3e], al
mov eax, 0x4f7a09cd
imul r8d
mov byte [rbp + 0x3b], r8b
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
mov eax, 0x4f7a09cd
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul r8d
mov ecx, r8d
mov byte [rbp + 0x3f], r8b
sar ecx, 8
mov byte [rbp + 0x40], cl
mov ecx, r8d
sar ecx, 0x10
sar edx, 0xe
mov byte [rbp + 0x41], cl
mov eax, edx
shr eax, 0x1f
mov ecx, r8d
add edx, eax
sar ecx, 0x18
imul eax, edx, 0x7fffff07
mov byte [rbp + 0x42], cl
imul ecx, r8d, 0x9ef4
sub ecx, eax
lea edx, [rcx + 0x7fffff07]
cmovns edx, ecx
mov eax, edx
mov byte [rbp + 0x43], dl
sar eax, 8
mov byte [rbp + 0x44], al
mov eax, edx
sar edx, 0x18
mov rcx, r9
mov byte [rbp + 0x46], dl
lea rdx, [rbp - 0x69]
sar eax, 0x10
mov byte [rbp + 0x45], al
movups xmm0, xmmword [rbp + 0x37]
mov dword [rbp - 0x61], 0x67452301
mov dword [rbp - 0x5d], 0xefcdab89
movups xmmword [rbp - 0x51], xmm0
mov dword [rbp - 0x59], 0x98badcfe
mov dword [rbp - 0x55], 0x10325476
mov qword [rbp - 0x69], reloc.SinoSPE.dll_Ordinal_16
call fcn.140292750
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0xe0
pop rbp
ret
Function at 0x1403a7a10
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x100
movdqa xmm2, xmmword [0x1403f5540]
xor r10d, r10d
movdqa xmm3, xmmword [0x1403f5570]
mov ebp, edx
mov r14, rcx
movsxd r15, r9d
mov r11d, r10d
lea rdx, [rsp + 4]
mov rsi, r8
mov ecx, 8
nop word [rax + rax]
lea eax, [rcx - 8]
movd xmm0, eax
lea rdx, [rdx + 0x10]
pshufd xmm0, xmm0, 0
lea eax, [rcx - 4]
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea eax, [rcx + 4]
paddd xmm1, xmm2
andps xmm0, xmm3
andps xmm1, xmm3
packuswb xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm0, xmm0
movd dword [rdx - 0x14], xmm0
packuswb xmm1, xmm1
movd dword [rdx - 0x10], xmm1
movd xmm0, ecx
add ecx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
movd xmm1, eax
pshufd xmm1, xmm1, 0
andps xmm0, xmm3
paddd xmm1, xmm2
packuswb xmm0, xmm0
andps xmm1, xmm3
packuswb xmm0, xmm0
movd dword [rdx - 0xc], xmm0
lea eax, [rcx - 8]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx - 8], xmm1
cmp eax, 0x100
jl 0x1403a7a60
mov r8d, r10d
lea rbx, [rsp]
mov r9d, r10d
nop dword [rax]
movzx edi, byte [rbx]
mov eax, r9d
cdq
idiv ebp
movsxd rax, edx
movzx ecx, byte [rax + r14]
add r8d, ecx
add r8d, edi
and r8d, 0x800000ff
jge 0x1403a7b2d
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
lea rcx, [rsp]
add rcx, rax
inc r9d
movzx eax, byte [rcx]
mov byte [rbx], al
inc rbx
mov byte [rcx], dil
cmp r9d, 0x100
jl 0x1403a7b00
mov rbx, r15
test r15d, r15d
jle 0x1403a7bd0
mov rdx, qword [rsp + 0x140]
sub rsi, rdx
inc r10d
and r10d, 0x800000ff
jge 0x1403a7b7a
dec r10d
or r10d, 0xffffff00
inc r10d
movsxd rax, r10d
lea r8, [rsp]
add r8, rax
movzx r9d, byte [r8]
add r11d, r9d
and r11d, 0x800000ff
jge 0x1403a7ba1
dec r11d
or r11d, 0xffffff00
inc r11d
movsxd rax, r11d
lea rcx, [rsp]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r8], al
mov byte [rcx], r9b
movzx ecx, byte [r8]
add rcx, r9
movzx eax, cl
movzx ecx, byte [rsp + rax]
xor cl, byte [rdx + rsi]
mov byte [rdx], cl
inc rdx
sub rbx, 1
jne 0x1403a7b61
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1403b25f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov qword [rcx], 0
mov ecx, reloc.SinoSPE.dll_Ordinal_40
mov rbp, r8
mov r15, rdx
call fcn.14036b6d0
mov rbx, rax
test rax, rax
jne 0x1403b2634
mov eax, 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
cmp byte [reloc.SinoSPE.dll_Ordinal_1], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
je 0x1403b2699
mov rax, qword [0x1404a5ce0]
test rax, rax
je 0x1403b265e
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
call rax
test eax, eax
jne 0x1403b2699
lea rsi, [rbx + 8]
mov qword [rbx + 0x10], r15
lea rdi, [rbx + 0x10]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], 0
lea r8, [0x140380550]
mov qword [rbx + 0x18], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x1403b26b1
jmp 0x1403b26a1
lea rdi, [rbx + 0x10]
lea rsi, [rbx + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rdi], 0
mov rdi, qword [rsp + 0x58]
jne 0x1403b26ce
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [rsi], eax
call r15
mov qword [rbx + 0x20], rax
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [r14], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret

Function at 0x1403b4020
Capabilities:
Read file on windows

Disassembly:
mov r8, qword [rcx + 0x38]
mov rdx, rcx
cmp r8, qword [rcx + 0x40]
jb 0x1403b403d
cmp qword [rcx], 0
jne fcn.1403b4060
mov eax, 0xffffffff
ret
mov rax, qword [rcx + 0x48]
movzx ecx, byte [r8 + rax]
lea rax, [r8 + 1]
mov qword [rdx + 0x38], rax
mov eax, ecx
ret

Function at 0x1403b4060
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
mov edx, 1
mov r8d, 0x400
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
jne 0x1403b4091
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov qword [rbx + 0x40], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 0x38], 1
movsx eax, byte [rax]
add rsp, 0x20
pop rbx
ret
Function at 0x1403bc9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
push r13
push r14
sub rsp, 0x90
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x68], rax
movzx eax, byte [r8]
mov rdi, r9
mov r13, qword [rsp + 0xe8]
mov rbx, r8
mov rbp, rdx
mov r14, rcx
cmp al, 0x2c
jne 0x1403bca4d
mov eax, dword [rsp + 0xe0]
mov r8, qword [r8 + 0x18]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], eax
call fcn.1403bc9f0
mov rax, qword [rbx + 0x10]
mov rbx, rax
movzx eax, byte [rax]
cmp al, 0x35
je 0x1403bca5a
cmp byte [rbx], 0x2d
jne 0x1403bcbe4
mov qword [rsp + 0x88], rsi
mov rsi, qword [rbx + 0x18]
mov qword [rsp + 0x78], r15
mov r15, qword [rbx + 0x10]
cmp byte [r15], 0xa7
jne 0x1403bcbd7
mov eax, 1
mov qword [rsp + 0x80], r12
mov word [rsp + 0x5c], ax
xor r12d, r12d
mov qword [rsp + 0x38], r12
lea rax, [fcn.1402b97c0]
mov qword [rsp + 0x40], rax
lea rax, [0x14037de40]
mov qword [rsp + 0x48], rax
test rsi, rsi
je 0x1403bcac9
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140396c00
cmp word [rsp + 0x5c], r12w
je 0x1403bcbcf
mov rdx, rbx
mov rcx, r14
call fcn.14034a330
test rax, rax
je 0x1403bcaea
lea rcx, [0x1402a6270]
cmp qword [rax + 0x18], rcx
jne 0x1403bcbcf
movsx rdx, word [r15 + 0x30]
test dx, dx
js 0x1403bcbcf
mov rax, qword [rbp + 0x18]
lea rcx, [rdx + rdx*2]
mov rax, qword [rax + 8]
movzx eax, byte [rax + rcx*8 + 0xc]
mov byte [rsp + 0x30], al
cmp al, 0x42
jb 0x1403bcbcf
test r13, r13
je 0x1403bcbc0
mov rdi, qword [r14]
test rdi, rdi
je 0x1403bcb35
mov edx, reloc.SinoSPE.dll_Ordinal_40
mov rcx, rdi
call fcn.140342dc0
jmp 0x1403bcb3f
mov ecx, reloc.SinoSPE.dll_Ordinal_40
call fcn.14036b6d0
mov rbx, rax
test rax, rax
je 0x1403bcbcf
movzx ebp, byte [r13 + 0x3c]
and bpl, 0x48
test rsi, rsi
je 0x1403bcb6d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.1402b86c0
mov r12, rax
mov qword [rbx], r12
lea r8, [r14 + 0x68]
mov eax, dword [r13 + 0x44]
test bpl, bpl
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0xe0]
mov dword [rbx + 0xc], eax
movsx eax, word [r15 + 0x30]
mov dword [rbx + 0x10], eax
setne al
mov byte [rbx + 0x14], al
mov rax, qword [r8]
mov qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx + 0x15], al
mov qword [r8], rbx
cmp qword [rbx + 0x18], 0
jne 0x1403bcbcf
lea rdx, [0x1403b9790]
mov rcx, r14
call fcn.14036f9c0
jmp 0x1403bcbcf
cmp edx, 0x3f
jge 0x1403bcbcf
mov rax, qword [rdi]
btr rax, rdx
mov qword [rdi], rax
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r15, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0x90
pop r14
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x1403cb46c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1403cb4b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1403cb4b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1403cb4b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1403cb4b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1403cb4b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1403cb4b8
xor al, al
add rsp, 0x28
ret