joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14025a6d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov edi, r8d
mov rsi, rdx
test ecx, ecx
je 0x14025a70c
mov rcx, rsi
test edi, edi
je 0x14025a8b5
call fcn.140376598
jmp 0x14025a8ba
cmp byte [rsi + 0x19], 0
jne 0x14025a8ba
jmp 0x14025a73f
call fcn.140084c10
mov edx, 0x40
mov rcx, rsi
call fcn.140084c10
cmp byte [rbx + 0x19], 0
mov rsi, rbx
jne 0x14025a8ba
mov rdx, qword [rsi + 0x10]
xor ecx, ecx
mov r8d, edi
xor r9d, r9d
call fcn.14025a6d0
mov rbx, qword [rsi]
mov r14, qword [rsi + 0x28]
test r14, r14
je 0x14025a725
mov rax, qword [0x1404b7bd8]
movsxd r15, dword [rax]
mov r12d, dword [0x1403ca8f4]
mov r13, qword [rsi + 0x30]
cmp r14, r13
je 0x14025a880
add r15, rax
jmp 0x14025a7f3
mov r11, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r11
cmp rcx, 0x20
jae 0x14025a8cc
add rax, 0x28
movzx ecx, word [0x1403ca8f8]
and r8d, r9d
cmp r8d, 1
mov edx, 0
sbb edx, edx
sub ecx, r10d
test cx, dx
setne cl
or cl, byte [0x1404ee6f0]
and cl, 1
mov byte [0x1404ee6f0], cl
mov rdx, rax
mov rcx, r11
call fcn.140084c10
mov qword [r14 + 0x18], 0
mov qword [r14 + 0x20], 0xf
mov byte [r14 + 8], 0
add r14, 0x30
cmp r14, r13
je 0x14025a880
mov rax, qword [r14 + 0x20]
mov r8d, dword [0x1404b7bd4]
lea r9d, [r8 - 0x2403c701]
add r9d, 0x2403c702
mov dword [0x1404b7bd4], r9d
test r8d, r9d
je 0x14025a820
xor r10d, r10d
jmp 0x14025a840
xor ecx, ecx
mov r10d, 0
test r12d, r12d
jle 0x14025a840
xor r10d, r10d
movsxd rcx, ecx
xor r10w, word [r15 + rcx]
add ecx, 2
cmp ecx, r12d
jl 0x14025a830
cmp rax, 0xf
jbe 0x14025a7d1
mov rcx, qword [r14 + 8]
cmp byte [0x1404ee8f4], 0
jne 0x14025a780
test byte [0x1404ee6f0], 1
jne 0x14025a780
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14025a7cc
jmp 0x14025a780
mov rcx, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x38]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14025a720
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14025a8d1
add rdx, 0x27
mov rcx, rax
jmp 0x14025a720
call fcn.140376538
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140356a3c
call fcn.140356a3c
int3
Function at 0x14025cd80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x458
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3d0], 0xfffffffffffffffe
mov rsi, rdx
cmp qword [0x1404efca0], 0
je 0x14025cdd4
mov ecx, 0x5fff0dbe
call fcn.14025cfb0
mov rcx, qword [rax]
mov r8, qword [rcx + 8]
mov rcx, rax
mov rdx, rsi
mov rax, r8
call qword [case.0x14014757d.0]
jmp 0x14025cef7
lea rdx, [0x1403b9d28]
mov rcx, rsi
mov r8d, 0xc5673c7d
call fcn.14013b540
mov qword [rbp + 0x3c8], rsi
mov rsi, qword [0x1404b8228]
movsxd rbx, dword [rsi]
mov r14d, dword [0x1403cb2d4]
xor ecx, ecx
call fcn.1401a97f0
add rbx, rsi
mov esi, dword [0x1404b8220]
lea edi, [rsi + 1]
mov dword [0x1404b8220], edi
xor esi, edi
not esi
test esi, edi
je 0x14025ce27
xor r15d, r15d
jmp 0x14025ce4e
xor ecx, ecx
mov r15d, 0
test r14d, r14d
jle 0x14025ce4e
xor r15d, r15d
nop word [rax + rax]
movsxd rcx, ecx
xor r15b, byte [rbx + rcx]
inc ecx
cmp ecx, r14d
jl 0x14025ce40
lea rdx, [rbp - 0x60]
mov rcx, rax
mov r8d, 0x400
call fcn.14018e840
and esi, edi
movzx eax, byte [0x1403cb2d8]
xor ecx, ecx
cmp esi, 1
sbb ecx, ecx
sub al, r15b
and al, cl
movzx eax, al
add qword [0x1404efad0], rax
lea rcx, [rbp + 0x3a0]
lea rdx, [rbp - 0x60]
call fcn.140242660
lea rdx, [rbp + 0x3a0]
mov rcx, qword [rbp + 0x3c8]
call fcn.1402427c0
mov rax, qword [0x1404efad0]
add rax, qword [rbp + 0x3c0]
cmp rax, 0x10
mov rsi, qword [rbp + 0x3c8]
jb 0x14025cef7
mov rcx, qword [rbp + 0x3a8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14025ceec
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14025cf0a
add rax, 0x28
mov rdx, rax
mov rcx, r8
mov r8d, 0xad2d7175
call fcn.140084c10
mov rax, rsi
add rsp, 0x458
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.140356a3c
int3
Function at 0x14027fe40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], 0xfffffffffffffffe
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov ecx, 0xcb359193
call fcn.140247110
mov r15, rax
mov ecx, 0xcb359193
call fcn.140247110
mov r12, rax
mov ecx, 0xcb359193
call fcn.140247110
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x30], 0xe9c9f63d
lea rcx, [rbp + 0xc8]
mov rdx, r14
mov r8, rsi
mov r9, rax
call fcn.14024a400
lea rax, [0x1403c8c98]
mov qword [rbp + 0xc8], rax
lea rsi, [rbp + 0x1a0]
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0xf
mov byte [rbp + 0x1a8], 0
movsxd r15, dword [0x1403ce7d4]
mov r12d, dword [0x1403ce7d0]
lea r14, [0x1403bb278]
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1c8], rbx
add rdi, 8
mov rcx, rsi
mov rdx, rdi
call fcn.1402427c0
mov eax, dword [0x1404bf5b0]
lea ecx, [rax + 1]
mov dword [0x1404bf5b0], ecx
xor ecx, eax
not ecx
test ecx, eax
setne bl
or bl, byte [0x1404efc2c]
xor edi, edi
mov r13d, 0
test bl, 1
jne 0x14027ff83
xor eax, eax
mov edi, 0
mov r13d, 0
test r12d, r12d
jle 0x14027ff83
lea rcx, [0x1403ce7d4]
add r15, rcx
xor edi, edi
xor r13d, r13d
nop dword [rax]
cdqe
xor r13, qword [r15 + rax + 8]
xor rdi, qword [r15 + rax]
add eax, 0x10
cmp eax, r12d
jl 0x14027ff70
lea rcx, [rbp - 0x40]
lea rdx, [rbp + 0xc8]
call fcn.140253750
mov rax, qword [0x1403ce7c8]
mov rcx, qword [0x1403ce7c0]
movzx edx, bl
mov r8d, edx
and r8d, 1
xor r9d, r9d
bt edx, 0
adc r9, 0xffffffffffffffff
dec r8
sub rcx, rdi
sbb rax, r13
and rax, r9
and rcx, r8
or rcx, rax
setne al
or al, byte [0x1404eebc9]
and al, 1
mov byte [0x1404eebc9], al
lea rax, [0x1403c8c98]
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x98]
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov qword [rbp + 0x98], r14
mov qword [rbp + 0xc0], 0
mov rdx, rsi
call fcn.1402427c0
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0xc0], rax
lea rdx, [0x140449310]
lea rcx, [rbp - 0x40]
call fcn.14039ed3c
int3
Function at 0x14028e750
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rax, qword [0x1404dd9c8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov edi, dword [rcx + 0x10]
mov esi, dword [rcx + 0x14]
mov r11d, dword [rcx + 0x18]
mov r10d, dword [rcx + 0x1c]
mov r13d, dword [rcx + 0x20]
mov r14d, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x28]
mov ebx, dword [rcx + 0x2c]
movups xmm0, xmmword [rcx + 0x30]
movups xmm1, xmmword [rcx + 0x40]
movups xmm2, xmmword [rcx + 0x50]
mov qword [rsp + 0x48], rcx
movups xmm3, xmmword [rcx + 0x60]
movaps xmmword [rsp + 0x80], xmm3
movaps xmmword [rsp + 0x70], xmm2
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov eax, 0x10
nop word cs:[rax + rax]
mov ecx, dword [rsp + rax*4 + 0x48]
mov edx, ecx
rol edx, 0xf
mov r8d, ecx
rol r8d, 0xd
xor r8d, edx
shr ecx, 0xa
xor ecx, r8d
add ecx, dword [rsp + rax*4 + 0x34]
mov edx, dword [rsp + rax*4 + 0x14]
mov r8d, edx
rol r8d, 0x19
mov r9d, edx
rol r9d, 0xe
xor r9d, r8d
shr edx, 3
xor edx, r9d
add ecx, dword [rsp + rax*4 + 0x10]
add ecx, edx
mov dword [rsp + rax*4 + 0x50], ecx
inc rax
cmp rax, 0x40
jne 0x14028e7d0
xor r15d, r15d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x34], r10d
mov r9d, r10d
mov dword [rsp + 0x30], r11d
mov r8d, r11d
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x28], edi
nop dword [rax + rax]
mov ecx, r13d
mov r12d, r14d
mov eax, ebp
mov edx, r13d
rol edx, 0x1a
mov r10d, r13d
rol r10d, 0x15
xor r10d, edx
mov edx, r13d
rol edx, 7
xor edx, r10d
mov r10d, r14d
and r10d, r13d
add r10d, ebx
mov ebx, r13d
not ebx
and ebx, ebp
add ebx, r10d
add ebx, edx
lea rdx, [0x1403d2440]
add ebx, dword [r15 + rdx]
add ebx, dword [rsp + r15 + 0x50]
mov r10d, edi
rol edi, 0x1e
mov edx, esi
mov esi, r10d
rol esi, 0x13
mov r11d, r8d
mov r8d, r10d
rol r8d, 0xa
xor esi, edi
xor r8d, esi
mov esi, r11d
or esi, edx
and esi, r10d
mov edi, r11d
and edi, edx
or edi, esi
add edi, r8d
mov r13d, r9d
add r13d, ebx
add edi, ebx
add r15, 4
mov ebx, ebp
mov ebp, r14d
mov r14d, ecx
mov r9d, r11d
mov r8d, edx
mov esi, r10d
cmp r15, 0x100
jne 0x14028e850
add edi, dword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov dword [r8 + 0x10], edi
add r10d, dword [rsp + 0x2c]
mov dword [r8 + 0x14], r10d
add edx, dword [rsp + 0x30]
mov dword [r8 + 0x18], edx
add r11d, dword [rsp + 0x34]
mov dword [r8 + 0x1c], r11d
add r13d, dword [rsp + 0x38]
mov dword [r8 + 0x20], r13d
add ecx, dword [rsp + 0x3c]
mov dword [r8 + 0x24], ecx
add r12d, dword [rsp + 0x40]
mov dword [r8 + 0x28], r12d
add eax, dword [rsp + 0x44]
mov dword [r8 + 0x2c], eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1403763e0
nop
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1402df3c0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1402df5bb
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.14017a020
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
cmp byte [0x1404ee749], 0
jne 0x1402df5af
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x1402df5af
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
jmp 0x1402df471
mov qword [r9 + r10*8], rdx
mov qword [r9 + r11*8], rdx
cmp r8, rdi
je 0x1402df5af
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rax
imul r8, rcx
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rcx
movzx r9d, byte [rdx + 0x13]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x14]
xor r8, r9
imul r8, rcx
movzx r9d, byte [rdx + 0x15]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x16]
xor r8, r9
imul r8, rcx
movzx ebx, byte [rdx + 0x17]
xor rbx, r8
imul rbx, rcx
and rbx, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [rbx + rbx]
lea r11, [rbx + rbx]
inc r11
shl rbx, 4
mov r14, qword [r9 + rbx]
cmp r14, rdi
je 0x1402df460
mov rbx, qword [r9 + r11*8]
mov r15, qword [rdx + 0x10]
cmp r15, qword [rbx + 0x10]
je 0x1402df550
nop dword [rax + rax]
cmp r14, rbx
je 0x1402df585
mov rbx, qword [rbx + 8]
cmp r15, qword [rbx + 0x10]
jne 0x1402df510
mov r9, qword [rbx]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x1402df468
mov r10, qword [rbx]
cmp r10, rdx
je 0x1402df579
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
add rdx, qword [0x1404eebb0]
jmp 0x1402df464
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], rbx
mov r15, qword [rbx + 8]
mov qword [r15], rdx
mov qword [rbx + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x1402df468
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 1
xor r8d, r8d
mov r9d, 0x229b45c1
call fcn.1402dfba0
mov rcx, rax
call fcn.140378034
int3
Function at 0x14030f7c0
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x1404dd9c8]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
nop word [rax + rax]
movzx r8d, byte [0x1404ee88c]
add r8b, byte [rdx + rax*4]
movzx r9d, r8b
shl r9d, 0x18
movzx r8d, byte [rdx + rax*4 + 1]
shl r8d, 0x10
or r8d, r9d
movzx r9d, byte [rdx + rax*4 + 2]
shl r9d, 8
or r9d, r8d
movzx r8d, byte [rdx + rax*4 + 3]
or r8d, r9d
mov dword [rsp + rax*4 + 0x50], r8d
inc rax
cmp rax, 0x10
jne 0x14030f7f0
mov eax, dword [rcx]
mov edx, dword [rcx + 4]
mov r11d, dword [rcx + 8]
mov r13d, dword [rcx + 0xc]
mov r10d, dword [rcx + 0x10]
mov r14d, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
mov qword [rsp + 0x48], rcx
mov ebx, dword [rcx + 0x1c]
lea r15, [0x1403e48c0]
xor r12d, r12d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x24], r13d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x2c], edx
mov dword [rsp + 0x28], eax
jmp 0x14030f98b
lea eax, [r12 + 0xe]
and eax, 0xf
add rax, qword [0x1404efa78]
mov r10d, dword [rsp + rax*4 + 0x50]
mov eax, r10d
rol eax, 0xf
mov edx, r10d
rol edx, 0xd
xor edx, eax
shr r10d, 0xa
xor r10d, edx
lea eax, [r12 + 9]
and eax, 0xf
add r10d, dword [rsp + rax*4 + 0x50]
lea eax, [r12 + 1]
and eax, 0xf
mov eax, dword [rsp + rax*4 + 0x50]
mov edx, eax
rol edx, 0x19
mov esi, r8d
mov r8d, r11d
mov r11d, eax
rol r11d, 0xe
xor r11d, edx
shr eax, 3
xor eax, r11d
mov r11d, r8d
mov r8d, esi
mov edx, r12d
and edx, 0xf
add r10d, dword [rsp + rdx*4 + 0x50]
add r10d, eax
mov dword [rsp + rdx*4 + 0x50], r10d
mov edi, dword [rsp + 0x24]
mov eax, r8d
rol eax, 0x1a
mov edx, r8d
rol edx, 0x15
xor edx, eax
mov eax, r8d
rol eax, 7
xor eax, edx
add eax, r10d
mov edx, ebp
xor edx, r13d
and edx, r8d
xor edx, ebp
add ebx, edx
add ebx, eax
add ebx, dword [r15]
mov eax, ecx
rol eax, 0x1e
mov edx, ecx
rol edx, 0x13
xor edx, eax
mov r10d, ecx
rol r10d, 0xa
xor r10d, edx
mov edx, r9d
and edx, ecx
mov eax, r9d
xor eax, ecx
and eax, r11d
or eax, edx
add eax, r10d
mov r10d, edi
add r10d, ebx
add eax, ebx
inc r12
add r15, 4
mov ebx, ebp
mov esi, ebp
mov ebp, r13d
mov r14d, r8d
mov dword [rsp + 0x24], r11d
mov edi, r8d
mov r8d, r11d
mov r11d, r9d
mov edx, ecx
cmp r12, 0x40
je 0x14030f9aa
mov ecx, eax
mov r9d, edx
mov r8d, r10d
mov r13d, r14d
cmp r12, 0xf
ja 0x14030f890
mov r10d, dword [rsp + r12*4 + 0x50]
jmp 0x14030f906
add eax, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov dword [rdx], eax
add ecx, dword [rsp + 0x2c]
mov dword [rdx + 4], ecx
add r9d, dword [rsp + 0x30]
mov dword [rdx + 8], r9d
add r8d, dword [rsp + 0x34]
mov dword [rdx + 0xc], r8d
add r10d, dword [rsp + 0x38]
mov dword [rdx + 0x10], r10d
add edi, dword [rsp + 0x3c]
mov dword [rdx + 0x14], edi
add r13d, dword [rsp + 0x40]
mov dword [rdx + 0x18], r13d
add esi, dword [rsp + 0x44]
mov dword [rdx + 0x1c], esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1403763e0
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140340d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ecx, edx
mov rax, qword [0x1404dd9c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [0x1403ec7c0]
movaps xmmword [rsp + 0x20], xmm0
movabs rax, 0x1716151413121110
mov qword [rsp + 0x30], rax
mov word [rsp + 0x38], 0x1918
mov byte [rsp + 0x3a], 0x1a
mov r8d, 0x1b
nop word cs:[rax + rax]
mov eax, ecx
xor edx, edx
div r8d
movzx eax, byte [rsp + r8 + 0x1f]
movzx r9d, byte [rsp + rdx + 0x20]
mov byte [rsp + r8 + 0x1f], r9b
mov byte [rsp + rdx + 0x20], al
imul eax, ecx, 0x6255
add eax, 0x3619
movzx ecx, ax
dec r8
cmp r8, 1
ja 0x140340d80
xor eax, eax
lea rdx, [0x1404f32e0]
xor r8d, r8d
jmp 0x140340e18
mov r10d, r8d
and r10b, 7
mov ecx, r8d
and ecx, 7
mov r11d, 0xffffffff
shl r11d, cl
lea edi, [r9 + r8]
add ecx, r9d
mov ebx, 0xffffffff
shl ebx, cl
xor ebx, r11d
shr r8d, 3
mov byte [rdx + rsi*4], r8b
mov byte [rdx + rsi*4 + 3], r10b
mov byte [rdx + rsi*4 + 1], bl
mov byte [rdx + rsi*4 + 2], bh
inc rax
mov r8d, edi
cmp rax, 0x1b
je 0x140340e60
movzx esi, byte [rsp + rax + 0x20]
mov r9d, 6
cmp rsi, 0xf
ja 0x140340dd0
mov r9d, 5
cmp sil, 7
ja 0x140340dd0
mov r9d, 4
cmp sil, 3
ja 0x140340dd0
mov r9d, 3
cmp sil, 1
ja 0x140340dd0
cmp rsi, 1
mov r9d, 2
sbb r9d, 0
jmp 0x140340dd0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1403763e0
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140002ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140003064
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140003064
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x140002f6b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x14000308b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140002f82
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140002f82
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140002f95
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140002fe2
mov r8d, eax
cmp eax, 0x800
jae 0x140002faf
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140002fe2
cmp eax, 0x10000
jae 0x140002fc9
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140002fe2
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x140003064
add qword [r14], 2
test sil, sil
jne 0x140003003
cmp r10d, 3
jae 0x14000300f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x140003041
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x140003020
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x140002f1f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140003072
Function at 0x140036ca8
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x140071020]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x14005c990]
mov rbp, rcx
call fcn.1400472f4
xor edi, edi
test rax, rax
je 0x140036d8e
mov ebx, edi
call fcn.1400398c0
mov r14d, dword [rax]
call fcn.1400398c0
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.140047240
mov rsi, rax
test rax, rax
je 0x140036d1f
call fcn.1400398c0
mov dword [rax], r14d
jmp 0x140036d49
call fcn.1400398c0
cmp dword [rax], 0x22
jne 0x140036d86
call fcn.1400398c0
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140047240
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x140036d86
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x140036d4d
cmp rax, 3
je 0x140036d68
mov rcx, rsi
call fcn.140036c04
test al, al
je 0x140036d79
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140036d79
mov dil, 1
mov rcx, rbx
call fcn.1400397d0
mov al, dil
jmp 0x140036d90
mov rcx, rbx
call fcn.1400397d0
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140030210
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14004f45c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14004f48c
xor eax, eax
jmp 0x14004f54f
mov rbp, rbx
cmp word [rax], si
je 0x14004f4b1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14004f498
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14004f494
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14004ce38
movsxd r14, eax
test eax, eax
jne 0x14004f4ef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14004f485
mov rcx, r14
call fcn.140046fb0
mov rdi, rax
test rax, rax
jne 0x14004f508
xor ecx, ecx
call fcn.140046f74
jmp 0x14004f4e4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14004ce38
test eax, eax
jne 0x14004f539
mov rcx, rdi
call fcn.140046f74
jmp 0x14004f543
xor ecx, ecx
call fcn.140046f74
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14004f56c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14004f5f3
mov rsi, rbx
cmp word [rax], bp
je 0x14004f5b2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14004f59c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14004f598
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140046fb0
mov rdi, rax
test rax, rax
je 0x14004f5e0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140032250
mov rbp, rdi
xor ecx, ecx
call fcn.140046f74
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret