joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000a140
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movaps xmmword [rax - 0x28], xmm6
mov r15, rcx
test r8, r8
je 0x18000a268
mov rdi, rcx
lea rbp, [r8 - 1]
sub rdi, rdx
shr rbp, 4
add rdi, 0xf0
lea rsi, [rdx + 9]
inc rbp
lea rbx, [rsi - 9]
mov r8, r15
movups xmm6, xmmword [rbx]
mov rdx, rbx
mov cl, 0xe
call fcn.18000a2b8
mov r14b, 0xd
mov al, byte [rsi]
mov rdx, rbx
mov cl, byte [rsi + 4]
mov r9d, 4
mov byte [rsi + 4], al
mov al, byte [rsi - 4]
mov byte [rsi], al
mov al, byte [rsi - 8]
mov byte [rsi - 4], al
mov al, byte [rsi + 1]
mov byte [rsi - 8], cl
mov cl, byte [rsi - 7]
mov byte [rsi - 7], al
mov al, byte [rsi + 5]
mov byte [rsi + 1], cl
mov cl, byte [rsi - 3]
mov byte [rsi - 3], al
mov al, byte [rsi - 2]
mov byte [rsi + 5], cl
mov cl, byte [rsi - 6]
mov byte [rsi - 6], al
mov al, byte [rsi + 2]
mov byte [rsi - 2], al
mov al, byte [rsi + 6]
mov byte [rsi + 2], al
mov byte [rsi + 6], cl
mov rcx, rdx
mov r8d, 4
movzx eax, byte [rcx]
lea r10, [0x18004b650]
mov al, byte [rax + r10]
mov byte [rcx], al
lea rcx, [rcx + 4]
sub r8, 1
jne 0x18000a1f3
inc rdx
sub r9, 1
jne 0x18000a1ea
mov r8, r15
mov rdx, rbx
mov cl, r14b
call fcn.18000a2b8
test r14b, r14b
je 0x18000a23a
mov rcx, rbx
call fcn.18000a3f8
add r14b, 0xff
jmp 0x18000a19b
mov ecx, 0x10
mov al, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x18000a23f
add rsi, 0x10
sub rdi, 0x10
movdqu xmmword [r15 + 0xf0], xmm6
sub rbp, 1
jne 0x18000a184
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18000a2b8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x10
movsx eax, byte [0x18006702e]
mov rbx, r8
mov word [rsp + 0x38], ax
mov r8d, 0xb4
movzx eax, word [0x180067104]
xor r11b, r11b
mov dword [rsp + 0x38], 0x8f
mov rax, qword [0x1800670c8]
mov byte [rsp + 0x38], al
movzx eax, word [0x1800670c4]
mov byte [rsp + 0x38], al
mov rax, qword [0x1800670c8]
mov dword [rsp], eax
mov eax, 0x5520
mov word [rsp + 0x38], ax
mov eax, 0x8992
mov dword [rsp + 0x38], 0xa8a90b64
mov word [rsp + 0x38], ax
movzx eax, word [0x180067100]
mov dword [rsp + 0x38], 0x96876796
mov qword [rsp + 0x38], 0xc9
mov word [rsp + 0x38], ax
mov eax, 0x2cb7
mov dword [rsp + 0x38], 0x7a
mov word [rsp + 0x38], ax
mov qword [rsp + 0x38], r8
movzx eax, word [0x1800670fc]
mov dword [rsp + 0x38], eax
mov eax, dword [0x180067094]
mov al, byte [0x180067158]
mov byte [rsp + 0x38], al
mov eax, dword [0x180067128]
mov dword [rsp + 0x38], eax
movzx eax, word [0x180067110]
mov al, byte [0x18006709c]
mov byte [rsp + 0x38], al
mov dword [rsp + 0x38], 0x79a4
mov al, byte [0x18006702e]
mov al, byte [0x18006702e]
mov qword [rsp + 0x38], r8
mov byte [rsp + 0x38], 0x6f
mov byte [rsp + 0x38], 0x36
mov eax, dword [rsp]
movzx r10d, cl
mov dword [0x1800670d8], eax
shl r10d, 2
movzx r8d, r11b
xor r9b, r9b
add r8d, r10d
shl r8d, 2
movzx eax, r9b
inc r9b
add eax, r8d
mov cl, byte [rax + rbx]
xor byte [rdx], cl
inc rdx
cmp r9b, 4
jb 0x18000a3cd
inc r11b
cmp r11b, 4
jb 0x18000a3bf
xor eax, eax
add rsp, 0x10
pop rbx
ret
Function at 0x18000c7c4
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x68
mov rax, qword [0x180067a78]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov al, byte [0x180067118]
lea rcx, [rsp + 0x38]
mov byte [rsp + 0x20], al
mov rax, qword [0x180067120]
mov qword [rsp + 0x30], 0x9d
mov dword [rsp + 0x2c], 0xd5011e10
movzx eax, word [0x18006712c]
mov eax, dword [0x180067128]
mov word [rsp + 0x28], ax
mov eax, 0xa90f
mov word [rsp + 0x28], ax
mov eax, 0xffff9f17
mov word [rsp + 0x28], ax
mov eax, dword [0x1800670dc]
movzx eax, word [0x1800670fc]
mov dword [rsp + 0x20], eax
mov al, byte [str.3_lV]
mov byte [rsp + 0x20], al
movzx eax, byte [0x18006702f]
mov qword [rsp + 0x30], rax
movsx eax, byte [0x180067076]
mov dword [rsp + 0x20], eax
mov al, byte [0x1800670d8]
mov byte [rsp + 0x20], al
mov eax, 0x94f34ee6
mov qword [rsp + 0x20], rax
movzx eax, word [0x18006712c]
mov byte [rsp + 0x20], al
movsx eax, word [0x180067114]
mov dword [rsp + 0x20], eax
movzx eax, word [0x18006704c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], 0x1a3ea94f
mov eax, dword [0x1800670b8]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180067110]
mov byte [rsp + 0x20], al
mov eax, dword [0x180067094]
movzx eax, word [0x180067098]
mov eax, dword [0x180067164]
mov qword [rsp + 0x20], rax
mov eax, 0x7ab6
mov word [rsp + 0x20], ax
mov eax, 0x49
mov word [rsp + 0x20], ax
mov rax, qword [0x180067130]
movups xmm0, xmmword [0x18004b778]
mov word [rsp + 0x20], ax
movzx eax, word [0x18004b790]
movsd xmm1, qword [0x18004b788]
mov dword [rsp + 0x20], 0x3deeb19d
movups xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x50], ax
mov dword [rsp + 0x2c], 0x221e9c2e
mov byte [rsp + 0x20], 0xb9
movsd qword [rsp + 0x48], xmm1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [0x180067164], eax
mov eax, 1
cmp ax, word [0x180067148]
jl 0x18000c96e
mov rax, qword [rsp + 0x30]
mov ecx, 0xffffd8c6
movsx edx, ax
mov rax, qword [0x1800670d0]
movsx ecx, cx
imul edx, ecx
mov word [0x180067114], dx
test rax, rax
je 0x18000c962
mov eax, dword [rsp + 0x2c]
jmp 0x18000c968
mov eax, dword [0x1800670b8]
mov dword [0x180067090], eax
movzx eax, word [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov qword [0x180067130], rax
mov eax, 0x5759
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18003f550
add rsp, 0x68
ret
Function at 0x1800316ec
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180067668]
xor edx, edx
mov byte [rsp + 0x60], 0x7a
mov qword [rsp + 0x60], rax
movzx eax, byte [0x1800675bf]
mov word [rsp + 0x24], ax
lea ecx, [rdx + 0x64]
movsx eax, word [0x180067670]
mov dword [rsp + 0x28], eax
movsxd rax, dword [str.hZn0]
mov qword [rsp + 0x30], rax
mov eax, dword [0x180067608]
mov qword [rsp + 0x60], rax
mov eax, dword [0x18006759c]
movsx ebx, byte [0x1800675ff]
mov qword [rsp + 0x60], rax
movabs rax, 0xf4742f58790d8
mov qword [rsp + 0x60], rax
mov rax, qword [0x1800675d0]
mov byte [rsp + 0x68], al
mov eax, 0xd2
mov word [rsp + 0x20], ax
mov byte [rsp + 0x60], 0x76
mov byte [rsp + 0x60], 0xd1
mov rax, qword [0x1800675e0]
mov byte [rsp + 0x60], 0x2f
mov byte [rsp + 0x60], 0xf2
mov rax, qword [0x180067620]
mov dword [rsp + 0x60], eax
mov al, byte [0x1800675f9]
mov byte [rsp + 0x60], al
mov eax, dword [0x180067630]
mov eax, dword [0x1800675cc]
mov dword [rsp + 0x60], eax
movsx eax, byte [0x1800675f8]
mov dword [rsp + 0x60], eax
mov rax, qword [0x180067640]
mov qword [rsp + 0x60], rax
mov eax, dword [0x1800675f0]
mov dword [rsp + 0x60], eax
movzx eax, word [0x180067584]
mov byte [rsp + 0x60], al
call fcn.180031868
xor edx, edx
mov byte [rsp + 0x60], al
mov al, byte [rsp + 0x60]
cmp al, 0x13
mov al, byte [rsp + 0x60]
setne dl
xor ecx, ecx
test al, al
setne cl
cmp ecx, edx
ja 0x180031807
mov eax, dword [0x180067608]
mov dword [0x18006760c], eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
mov qword [rsp + 0x60], rcx
test ebx, ebx
je 0x18003181e
mov al, byte [rsp + 0x68]
jmp 0x180031823
movzx eax, word [rsp + 0x20]
mov eax, dword [0x180067634]
add eax, 0x8d
mov dword [0x18006759c], eax
mov rax, qword [rsp + 0x30]
movzx ecx, word [rsp + 0x24]
mov word [0x180dcf230], ax
movabs rax, 0x8f62ce9b3d256
xor rcx, rax
mov eax, dword [rsp + 0x28]
add eax, ecx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x180042584
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x18004245b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18004245b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18004245b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18004245b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18004245b
cmp dword [rcx + 0x84], 0xe
jbe 0x18004245b
cmp dword [rcx + 0xf8], 0
je 0x18004245b
mov ecx, ebx
call fcn.1800424fc
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1800422ec
cmp dword [rbp + 0x20], 0
je 0x1800424a8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800424b0
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800423f4

Function at 0x14058eee0
Capabilities:
Encode data using xor

Disassembly:
neg r11
rol r11, 1
inc r11
xor r10, r11
sub rbx, 8
mov qword [rbx], r11
jmp 0x14058a942
call fcn.14058b311
neg dword [rsp + 0xb]
js 0x14055d2d7
mov ebp, 0x371a0818
dec bpl
mov bx, word [r10 + rbp*2 - 0x6e34102e]
ror bp, 0xe6
lea r10, [r10 + rbp*2 - 0x6e34b83e]
lea r8, [r8 + rbp - 0x371a5c21]
neg ebp
movzx ebp, byte [r8]
jbe 0x14057a742
jmp 0x140567916
call fcn.140574fb0
lea rsp, [rsp + 0x10]
jmp fcn.14057c747
xor bpl, r9b
jmp 0x140578706
inc cl
ror cl, 1
dec rbp
sar rbp, 0x7b
xor bl, cl
sal bpl, 0x26
add rcx, rsp
shr ebp, 0xba
mov bp, word [rcx + rbp - 0x3f]
jne 0x14058548b
add r11, 8
jmp 0x140569d04
call fcn.140562d01
lea rsp, [rsp + 0x10]
jmp fcn.140581e83
rol bl, 1
call fcn.140551f67
mov esi, 0x8909cd02
call fcn.1405814f7
neg bpl
dec cl
rol bpl, 0x42
add bp, 0x378f
xor cl, 0x30
sal rbp, 0xaa
ja 0x14057f414

Function at 0x1405bb268
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r11d, dword [rcx]
mov rsi, r8
mov ebx, dword [rcx + 4]
mov rdi, rdx
movsxd rbp, r9d
mov r10, rcx
test r9d, r9d
jle 0x1405bb2cf
sub rdi, r8
inc r11b
movzx r11d, r11b
mov r8b, byte [r11 + r10 + 8]
add bl, r8b
movzx ebx, bl
mov cl, byte [rbx + r10 + 8]
mov byte [r11 + r10 + 8], cl
add cl, r8b
mov byte [rbx + r10 + 8], r8b
movzx eax, cl
mov cl, byte [rax + r10 + 8]
xor cl, byte [rdi + rsi]
mov byte [rsi], cl
inc rsi
sub rbp, 1
jne 0x1405bb295
mov rbp, qword [rsp + 0x10]
mov eax, r9d
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r10 + 4], ebx
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret
Function at 0x1400108b0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1402d70b0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14001093e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x1400108e2
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140010950
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1402d70b0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140010a54
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140010a4f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140010a24
cmp qword [rsp + 0x38], 2
jb 0x140010a24
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140010a24
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140010a24
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140010997
jmp 0x140010ae6
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140010ae6
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140010abc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140010abc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140010abc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140010a54
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140010d40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14024de6c
add rsp, 0x28
ret
Function at 0x1400861c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1403ead68]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x1988]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x1990]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.140005090
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x30], rax
jae 0x14008630e
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x1400862d0
movss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax]
call fcn.1400a1770
mov rax, qword [rsp + 0x70]
movss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x98]
test eax, eax
je 0x1400862cb
jmp 0x14008630e
jmp 0x140086241
cmp dword [rsp + 0x28], 0xd
jne 0x1400862dc
jmp 0x140086241
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.1400763d0
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x140086241
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rax]
jbe 0x14008632d
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
movss dword [rax], xmm0
cmp qword [rsp + 0x90], 0
je 0x140086369
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140005090
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x1402e31b8]
ja 0x14008638d
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
ucomiss xmm0, dword [0x1402e31b8]
jp 0x1400863a7
jne 0x1400863a7
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
cmp qword [rsp + 0x88], 0
je 0x1400863c2
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x14009dbd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1403ead68]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x10]
and eax, 1
test eax, eax
jne 0x14009dc06
jmp 0x14009de21
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 4]
and eax, 0xc0
test eax, eax
jne 0x14009dc21
mov byte [rsp + 0x20], 1
jmp 0x14009dc26
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x14009dc4d
mov rax, qword [rsp + 0x80]
movss xmm0, dword [rax + 0x50]
movss dword [rsp + 0x38], xmm0
jmp 0x14009dc56
xorps xmm0, xmm0
movss dword [rsp + 0x38], xmm0
mov rax, qword [rsp + 0x80]
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x2c], xmm0
mov rax, qword [rsp + 0x88]
movss xmm0, dword [rsp + 0x2c]
addss xmm0, dword [rax + 0x10]
comiss xmm0, dword [rsp + 0x90]
jbe 0x14009dc96
mov dword [rsp + 0x3c], 0xffffffff
jmp 0x14009dc9e
mov dword [rsp + 0x3c], 1
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
call fcn.1400a03f0
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
jmp 0x14009dceb
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jl 0x14009ddf2
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
cmp dword [rsp + 0x24], eax
jge 0x14009ddf2
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x60], rax
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
call fcn.14003bce0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 4]
and eax, 0x20
test eax, eax
je 0x14009dd3e
jmp 0x14009ddf2
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 4]
and eax, 0xc0
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 4]
and ecx, 0xc0
cmp eax, ecx
je 0x14009dd65
jmp 0x14009ddf2
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x40]
movss xmm0, dword [rsp + 0x2c]
addss xmm0, dword [rax + 0x10]
mov rax, qword [rsp + 0x50]
subss xmm0, dword [rax + 0x15c4]
movss dword [rsp + 0x48], xmm0
mov rax, qword [rsp + 0x40]
movss xmm0, dword [rsp + 0x2c]
addss xmm0, dword [rax + 0x10]
mov rax, qword [rsp + 0x40]
addss xmm0, dword [rax + 0x14]
mov rax, qword [rsp + 0x50]
addss xmm0, dword [rax + 0x15c4]
movss dword [rsp + 0x4c], xmm0
cmp dword [rsp + 0x30], 0
jge 0x14009ddd4
movss xmm0, dword [rsp + 0x90]
comiss xmm0, dword [rsp + 0x48]
ja 0x14009ddeb
cmp dword [rsp + 0x30], 0
jle 0x14009dded
movss xmm0, dword [rsp + 0x4c]
comiss xmm0, dword [rsp + 0x90]
jbe 0x14009dded
jmp 0x14009ddf2
jmp 0x14009dcdb
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x34], eax
je 0x14009de21
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov r8d, eax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.14009dba0
nop
add rsp, 0x78
ret
Function at 0x1400b9500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
test eax, eax
je 0x1400b9532
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.1400b8c70
nop
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jle 0x1400b958d
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
shr eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
sub eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x10], eax
jmp 0x1400b953a
cmp dword [rsp + 0x20], 4
jge 0x1400b95b3
mov rcx, qword [rsp + 0x50]
call fcn.1400b8bc0
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x1400b958d
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 0
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 1
imul rax, rax, 3
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
xor eax, 0xffff
cmp dword [rsp + 0x2c], eax
je 0x1400b9623
lea rcx, str.zlib_corrupt
call fcn.1400b2d40
jmp 0x1400b96c4
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 8]
jbe 0x1400b9649
lea rcx, str.read_past_buffer
call fcn.1400b2d40
jmp 0x1400b96c4
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x28]
jbe 0x1400b9678
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
call fcn.1400b8ea0
test eax, eax
jne 0x1400b9678
xor eax, eax
jmp 0x1400b96c4
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rdx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400d8d00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2d8
mov rax, qword [0x140320740]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov dword [rsp + 0x20], 0
mov edx, Ordinal_27
lea rcx, [rsp + 0x68]
call fcn.1400d8e60
lea rcx, [rsp + 0x68]
call fcn.1400da2f0
nop
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x80], 0x238
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400d8da3
mov rcx, qword [rsp + 0x2e0]
call fcn.1400da2f0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x68]
call fcn.1400da1a0
mov rax, qword [rsp + 0x2e0]
jmp 0x1400d8e39
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400d8dff
lea r8, [rsp + 0xac]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x58]
call fcn.1400db800
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400db840
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.1400da170
nop
lea rcx, [rsp + 0x30]
call fcn.1400d8e80
nop
jmp 0x1400d8da3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x2e0]
call fcn.1400da1c0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x68]
call fcn.1400da1a0
mov rax, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1402164b0
add rsp, 0x2d8
ret