joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400551e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r13, r8
mov qword [rsp + 0x20], rdx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x140055207
mov r13, qword [r13]
movabs rsi, 0xcbf29ce484222325
mov rbp, r15
sub rbp, 1
jae 0x140055222
mov rbx, rsi
jmp 0x1400552b8
movabs rax, 0x100000001b3
mov edx, r15d
and edx, 3
cmp rbp, 3
jae 0x14005523c
xor ebp, ebp
jmp 0x14005528d
mov rdi, r15
sub rdi, rdx
xor ebp, ebp
nop word cs:[rax + rax]
nop
movzx ebx, byte [r13 + rbp]
xor rbx, rsi
imul rbx, rax
movzx esi, byte [r13 + rbp + 1]
xor rsi, rbx
imul rsi, rax
movzx ebx, byte [r13 + rbp + 2]
xor rbx, rsi
imul rbx, rax
movzx esi, byte [r13 + rbp + 3]
xor rsi, rbx
imul rsi, rax
add rbp, 4
cmp rdi, rbp
jne 0x140055250
mov rbx, rsi
test rdx, rdx
je 0x1400552b8
add rbp, r13
xor edi, edi
nop word [rax + rax]
movzx ebx, byte [rbp + rdi]
xor rbx, rsi
imul rbx, rax
add rdi, 1
mov rsi, rbx
cmp rdx, rdi
jne 0x1400552a0
and rbx, qword [rcx + 0x30]
mov r14, qword [rcx + 8]
mov r12, qword [rcx + 0x18]
mov rax, rbx
shl rax, 4
mov rdi, qword [r12 + rax]
lea rbp, [rbx + rbx]
add rbp, 1
mov rsi, rdi
cmp rdi, r14
jne 0x1400552f8
jmp 0x140055320
mov rsi, qword [rsi]
cmp rdi, r14
je 0x140055320
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rsi
je 0x1400553ad
cmp qword [rsi + 0x20], r15
jne 0x1400552f0
cmp qword [rsi + 0x28], 0xf
jbe 0x140055330
mov rcx, qword [rsi + 0x10]
jmp 0x140055334
mov rax, r14
cmp rax, rsi
jne 0x140055308
jmp 0x1400553ad
lea rcx, [rsi + 0x10]
mov rdx, r13
mov r8, r15
call fcn.14005ebe0
test eax, eax
jne 0x1400552f0
mov rbx, rsi
cmp rdi, r14
jne 0x140055358
jmp 0x1400553a0
mov rbx, qword [rbx]
cmp rdi, r14
je 0x1400553a0
mov rax, qword [r12 + rbp*8]
mov rax, qword [rax]
cmp rax, rbx
je 0x1400553a8
cmp r15, qword [rbx + 0x20]
jne 0x1400553a8
cmp qword [rbx + 0x28], 0xf
jbe 0x140055380
mov rdx, qword [rbx + 0x10]
jmp 0x140055384
lea rdx, [rbx + 0x10]
mov rcx, r13
mov r8, r15
call fcn.14005ebe0
test eax, eax
je 0x140055350
jmp 0x1400553a8
mov rax, r14
cmp rax, rbx
jne 0x140055364
cmp rsi, rbx
jne 0x1400553b3
mov rsi, r14
mov rbx, r14
mov rax, qword [rsp + 0x20]
mov qword [rax], rsi
mov qword [rax + 8], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140055cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140055d4b
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140055d4b
cmp dword [rsp + 0x38], 4
jne 0x140055d4b
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400562f0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
jmp 0x140059ac0
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x140059ae9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140059b22
and eax, 0x410
cmp eax, 0x410
jne 0x140059b22
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov rcx, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
jmp 0x140059c10
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x140059b2f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140059bec
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x140059bea
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x94
mov r9d, 2
call fcn.1400245c0
lea rcx, [rsp + 0x50]
lea rdx, str.DeleteFile
call fcn.14000d630
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x140059b9c
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140016fd0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140059bd2
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.14000e890
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.140024700
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x140059c39
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x140059cf6
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x140059cf4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x2f
mov r9d, 2
call fcn.1400245c0
lea rcx, [rsp + 0x50]
lea rdx, str.RemoveDirectory
call fcn.14000d630
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x140059ca6
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140016fd0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140059cdc
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.14000e890
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.140024700
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400595e0
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 0x7fffffff
jbe 0x14005556c
xor eax, eax
ret
jmp 0x1400595e0
push rsi
xor eax, eax
test rcx, rcx
je 0x140059711
test edx, edx
jle 0x140059711
mov r8d, edx
and r8d, 3
mov r11d, edx
shr r11d, 2
mov r9d, r11d
sub r9d, 1
jb 0x140059692
lea r10d, [r11 - 1]
test dl, 4
jne 0x140059620
mov r9d, r11d
mov rax, rcx
jmp 0x14005963e
movzx esi, word [rcx]
add esi, edx
movzx eax, word [rcx + 2]
shl eax, 0xb
xor eax, esi
shl esi, 0x10
xor esi, eax
lea rax, [rcx + 4]
mov edx, esi
shr edx, 0xb
add edx, esi
lea r10, [r10*4 + 4]
cmp r11d, 1
je 0x14005968f
nop dword [rax]
movzx esi, word [rax]
add esi, edx
movzx edx, word [rax + 2]
shl edx, 0xb
xor edx, esi
shl esi, 0x10
xor esi, edx
mov edx, esi
shr edx, 0xb
add edx, esi
movzx esi, word [rax + 4]
add esi, edx
movzx edx, word [rax + 6]
shl edx, 0xb
xor edx, esi
shl esi, 0x10
xor esi, edx
mov edx, esi
shr edx, 0xb
add edx, esi
add rax, 8
add r9d, 0xfffffffe
jg 0x140059650
add rcx, r10
cmp r8d, 1
je 0x1400596c0
cmp r8d, 2
je 0x1400596d2
cmp r8d, 3
jne 0x1400596e5
movzx eax, word [rcx]
add edx, eax
movsx eax, byte [rcx + 2]
shl eax, 0x12
xor eax, edx
mov ecx, edx
shl ecx, 0x10
xor eax, ecx
mov edx, eax
shr edx, 0xb
jmp 0x1400596e3
movsx eax, byte [rcx]
add edx, eax
mov eax, edx
shl eax, 0xa
xor eax, edx
mov edx, eax
shr edx, 1
jmp 0x1400596e3
movzx eax, word [rcx]
add edx, eax
mov eax, edx
shl eax, 0xb
xor eax, edx
mov edx, eax
shr edx, 0x11
add edx, eax
lea eax, [rdx*8]
xor eax, edx
mov ecx, eax
shr ecx, 5
add ecx, eax
mov eax, ecx
shl eax, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add ecx, eax
mov edx, ecx
shl edx, 0x19
xor edx, ecx
mov eax, edx
shr eax, 6
add eax, edx
pop rsi
ret
Function at 0x140059ac0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
jmp 0x140059ac0
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x140059ae9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140059b22
and eax, 0x410
cmp eax, 0x410
jne 0x140059b22
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov rcx, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
jmp 0x140059c10
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x140059b2f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140059bec
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x140059bea
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x94
mov r9d, 2
call fcn.1400245c0
lea rcx, [rsp + 0x50]
lea rdx, str.DeleteFile
call fcn.14000d630
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x140059b9c
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140016fd0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140059bd2
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.14000e890
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.140024700
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x140059c39
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x140059cf6
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x140059cf4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x2f
mov r9d, 2
call fcn.1400245c0
lea rcx, [rsp + 0x50]
lea rdx, str.RemoveDirectory
call fcn.14000d630
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x140059ca6
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140016fd0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140059cdc
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.14000e890
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.140024700
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x140059c10
Capabilities:
Delete directory

Disassembly:
jmp 0x140059ac0
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x140059ae9
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140059b22
and eax, 0x410
cmp eax, 0x410
jne 0x140059b22
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov rcx, rsi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
jmp 0x140059c10
cmp qword [rsi + 0x18], 7
mov rcx, rsi
jbe 0x140059b2f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140059bec
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x140059bea
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x94
mov r9d, 2
call fcn.1400245c0
lea rcx, [rsp + 0x50]
lea rdx, str.DeleteFile
call fcn.14000d630
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x140059b9c
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140016fd0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140059bd2
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.14000e890
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.140024700
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rsi, rcx
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rsp + 0x178], rax
cmp qword [rcx + 0x18], 7
jbe 0x140059c39
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dil, 1
test eax, eax
jne 0x140059cf6
mov ecx, 2
call fcn.1400230d0
test al, al
je 0x140059cf4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov r8d, 0x2f
mov r9d, 2
call fcn.1400245c0
lea rcx, [rsp + 0x50]
lea rdx, str.RemoveDirectory
call fcn.14000d630
mov rbx, rax
cmp qword [rsi + 0x18], 7
mov rax, rsi
jbe 0x140059ca6
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov rax, qword [rsi + 0x10]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.140016fd0
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140059cdc
mov rdx, qword [rsp + 0x158]
mov rcx, rbx
call fcn.14000e890
mov rcx, rsi
call fcn.140001260
mov rcx, rdi
call fcn.140024700
xor edi, edi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.14005aa40
mov eax, edi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005a1a0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx + 0x28]
call fcn.140063b40
mov dword [rsi + 0x28], eax
mov ecx, dword [rsi + 0x2c]
call fcn.140063b40
mov dword [rsi + 0x2c], eax
mov ecx, dword [rsi + 0x30]
call fcn.140063b40
mov dword [rsi + 0x30], eax
mov ecx, dword [rsi + 0x34]
call fcn.140063b40
mov dword [rsi + 0x34], eax
mov ecx, dword [rsi + 0x38]
call fcn.140063b40
mov dword [rsi + 0x38], eax
mov ecx, dword [rsi + 0x3c]
call fcn.140063b40
mov dword [rsi + 0x3c], eax
mov ecx, dword [rsi + 0x40]
call fcn.140063b40
mov dword [rsi + 0x40], eax
mov ecx, dword [rsi + 0x44]
call fcn.140063b40
mov dword [rsi + 0x44], eax
mov ecx, dword [rsi + 0x48]
call fcn.140063b40
mov dword [rsi + 0x48], eax
mov ecx, dword [rsi + 0x4c]
call fcn.140063b40
mov dword [rsi + 0x4c], eax
mov ecx, dword [rsi + 0x50]
call fcn.140063b40
mov dword [rsi + 0x50], eax
mov ecx, dword [rsi + 0x54]
call fcn.140063b40
mov dword [rsi + 0x54], eax
mov ecx, dword [rsi + 0x58]
call fcn.140063b40
mov dword [rsi + 0x58], eax
mov ecx, dword [rsi + 0x5c]
call fcn.140063b40
mov dword [rsi + 0x5c], eax
mov ecx, dword [rsi + 0x60]
call fcn.140063b40
mov dword [rsi + 0x60], eax
mov ecx, dword [rsi + 0x64]
call fcn.140063b40
mov dword [rsi + 0x64], eax
xor eax, eax
nop
mov ecx, dword [rsi + rax*4 + 0x48]
xor ecx, dword [rsi + rax*4 + 0x5c]
xor ecx, dword [rsi + rax*4 + 0x30]
xor ecx, dword [rsi + rax*4 + 0x28]
rol ecx, 1
mov dword [rsi + rax*4 + 0x68], ecx
add rax, 1
cmp rax, 0x40
jne 0x14005a260
movdqu xmm0, xmmword [rsi + 0x14]
movdqu xmmword [rsi], xmm0
mov r8d, dword [rsi + 0x24]
mov dword [rsi + 0x10], r8d
movd edi, xmm0
pshufd xmm1, xmm0, 0xe5
movd ebp, xmm1
pshufd xmm1, xmm0, 0x4e
movd ecx, xmm1
pshufd xmm1, xmm0, 0xe7
movd r10d, xmm1
xor eax, eax
mov r11d, 0x8f1bbcdc
mov ebx, r8d
nop dword [rax]
mov r14d, edi
mov r9d, r10d
mov r10d, ecx
mov ecx, ebp
mov ebp, edi
rol ebp, 5
cmp rax, 0x14
jae 0x14005a300
mov edx, ecx
and edx, r10d
mov edi, ecx
not edi
and edi, r9d
or edi, edx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x5a827999
jmp 0x14005a355
cmp rax, 0x28
jae 0x14005a320
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x6ed9eba1
jmp 0x14005a355
cmp rax, 0x3b
ja 0x14005a338
mov edx, r10d
or edx, r9d
and edx, ecx
mov edi, r10d
and edi, r9d
or edi, edx
jmp 0x14005a340
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
cmp rax, 0x3c
mov ebx, 0xca62c1d6
cmovb ebx, r11d
add edi, ebx
rol ecx, 0x1e
add rax, 1
mov ebx, r9d
mov ebp, r14d
cmp rax, 0x50
jne 0x14005a2c0
mov dword [rsi + 0x10], r9d
mov dword [rsi + 0xc], r10d
mov dword [rsi + 8], ecx
mov dword [rsi + 4], r14d
mov dword [rsi], edi
movd xmm1, r10d
movd xmm2, ecx
punpckldq xmm2, xmm1
movd xmm1, r14d
movd xmm3, edi
punpckldq xmm3, xmm1
punpcklqdq xmm3, xmm2
paddd xmm3, xmm0
movdqu xmmword [rsi + 0x14], xmm3
add r8d, r9d
mov dword [rsi + 0x24], r8d
mov dword [rsi + 0x168], 0
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140002e3a
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140002e7e
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.140002e90
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140002e6e
mov qword [rdi], rsi
call fcn.140054d90
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400043d8
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov edi, edx
mov rsi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
xor edx, edx
call fcn.1400035a4
mov dword [rsi + 0x120], ebx
mov dword [rsi + 0x124], edi
movaps xmm0, xmmword [section..rdata]
lea rdi, [rsp + 0x20]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov ecx, dword [rdi + 0x28]
cmp eax, ecx
cmova ecx, eax
mov qword [rsi + 0x128], rcx
mov qword [rsi + 0x130], 0x20
mov qword [rsi + 0x138], 0x40
mov dword [rsi + 0x140], ebx
lea rax, [rsi + 8]
mov qword [rsi + 8], 0
xor rax, 0xffffffffb37cc16a
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rsi
mov dword [rsi + 0x28], ebx
lea rcx, [rsi + 0x30]
mov r8d, 0xf0
xor edx, edx
call fcn.140146ec0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140143c30
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000ac8c
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r15, [rsp + 0x34]
mov dword [r15], 0xaaaaaaaa
mov qword [rsp + 0x20], r15
mov r8, r9
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000ad37
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x28]
mov qword [r12], rax
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, eax
mov r14, qword [r12]
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000ad37
test ebp, ebp
setne al
cmp r14, rsi
sete sil
and sil, al
jmp 0x14000ad39
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140143c30
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14000b7e0
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov qword [rcx], 0
mov rbx, qword [rdx]
mov qword [rdx], 0
lea r14, [rbx + 1]
cmp r14, 2
jae 0x14000b80e
cmp qword [rsi], rbx
jne 0x14000b818
jmp 0x14000b83a
call fcn.140054d90
cmp qword [rsi], rbx
je 0x14000b83a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14000b847
cmp r14, 2
jae 0x14000b861
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140054d90
mov rcx, qword [rsi]
call fcn.140035570
mov qword [rsi], 0
cmp r14, 2
jb 0x14000b832
mov qword [rsi], rbx
call fcn.140054d90
jmp 0x14000b832

Function at 0x14000bc70
Capabilities:
Check if file exists

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
mov qword [rdx], 0
lea r14, [rbx + 1]
cmp r14, 2
jae 0x14000bc97
cmp qword [rsi], rbx
jne 0x14000bca1
jmp 0x14000bcc3
call fcn.140054d90
cmp qword [rsi], rbx
je 0x14000bcc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14000bcd0
cmp r14, 2
jae 0x14000bcea
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.140054d90
mov rcx, qword [rsi]
call fcn.140035570
mov qword [rsi], 0
cmp r14, 2
jb 0x14000bcbb
mov qword [rsi], rbx
call fcn.140054d90
jmp 0x14000bcbb
Function at 0x140011630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x14001178a
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1401c2c08]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [rcx + 0x60], 0
je 0x1400117d7
mov edi, dword [rsi + 0x5c]
test bl, bl
je 0x1400118f2
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
jmp 0x1400118f2
cmp byte [rsi + 0x61], 0
je 0x140011802
mov rcx, qword [rsi + 0x40]
call fcn.14016388c
cmp eax, 0xffffffff
je 0x1400118d7
test bl, bl
je 0x1400118de
movzx edi, al
mov dword [rsi + 0x5c], edi
jmp 0x1400118f2
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x60], rdi
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov r15d, 1
cmovge r15d, eax
xor r14d, r14d
mov rcx, qword [rsi + 0x40]
call fcn.14016388c
cmp eax, 0xffffffff
je 0x1400118d7
mov byte [rsp + r14 + 0x60], al
inc r14
cmp r15, r14
jne 0x140011824
lea r12, [rsp + 0x60]
mov byte [r12 - 1], 0xaa
lea r13, [rsp + 0x50]
mov qword [r13], rdi
lea rbp, [rsp + 0x48]
mov qword [rbp], rdi
mov edi, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r14d, dword [rdx]
movss xmm6, dword [rdx + 4]
lea r9, [rsp + r15]
add r9, 0x60
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x5f]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x60]
call qword [0x1401b1be0]
cmp eax, 1
jne 0x14001191a
mov rax, qword [rsi + 0x50]
mov dword [rax], r14d
movss dword [rax + 4], xmm6
cmp r15, 8
je 0x1400118f2
mov rcx, qword [rsi + 0x40]
call fcn.14016388c
cmp eax, 0xffffffff
je 0x1400118f2
mov byte [rsp + r15 + 0x60], al
inc r15
jmp 0x140011865
mov edi, 0xffffffff
jmp 0x1400118f2
mov rdx, qword [rsi + 0x40]
movzx edi, al
mov ecx, edi
call fcn.14016a8a4
cmp eax, 0xffffffff
cmove edi, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140143c30
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 2
je 0x1400118f2
cmp eax, 3
jne 0x14001192c
mov al, byte [rsp + 0x60]
mov byte [rsp + 0x5f], al
test bl, bl
je 0x14001193a
movzx edi, byte [rsp + 0x5f]
jmp 0x1400117fa
mov ebx, r15d
test rbx, rbx
jle 0x14001195a
mov rdx, qword [rsi + 0x40]
movzx ecx, byte [rsp + rbx + 0x5f]
dec rbx
call fcn.14016a8a4
cmp eax, 0xffffffff
jne 0x14001193d
jmp 0x1400118f2
movzx edi, byte [rsp + 0x5f]
jmp 0x1400118f2

Function at 0x1400122c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400122f7
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x1400122d1
ret

Function at 0x140012370
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400123a8
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x140012381
ret