joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a2620
Capabilities:
Get thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, r8
mov ebx, edx
mov rdi, rcx
mov esi, dword [0x140229568]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test ebp, ebp
jne 0x1400a2732
cmp rsi, 1
je 0x1400a272e
mov eax, dword [rdi + 0x1518]
test eax, eax
jne 0x1400a272e
mov eax, 1
lock xadd dword [rdi + 0x1518], eax
cmp eax, 0x7fffffff
je 0x1400a273f
mov rcx, rdi
call fcn.1400a2a40
lock dec dword [rdi + 0x1518]
mov rdi, rax
inc qword [rax + 0x5a0]
cmp word [0x14021eb0c], bx
jb 0x1400a2720
movzx edx, bx
mov rsi, rdx
shl rsi, 4
mov rbx, rdi
add rbx, rsi
mov rax, qword [rdi + rsi]
test rax, rax
jne 0x1400a2742
inc qword [rdi + 0x5b8]
inc qword [rdi + 0x5b0]
mov rcx, rdi
call fcn.140105740
mov rax, qword [rbx]
test rax, rax
je 0x1400a272e
mov rcx, qword [rax]
test rcx, rcx
je 0x1400a274b
mov rdx, rcx
not rdx
cmp qword [rax + 8], rdx
jne 0x1400a274f
bswap rcx
prefetcht0 byte [rcx]
dec byte [rdi + rsi + 8]
mov qword [rbx], rcx
movzx ecx, word [rdi + rsi + 0xa]
mov qword [r14], rcx
movzx ecx, word [rdi + rsi + 0xa]
sub qword [rdi + 0x590], rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
inc qword [rdi + 0x5c0]
inc qword [rdi + 0x5b0]
xor eax, eax
jmp 0x1400a2715
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400a2653
int3
inc qword [rdi + 0x5a8]
jmp 0x1400a26e0
xor ecx, ecx
jmp 0x1400a26fa
call fcn.140141530
int3

Function at 0x1400a2a40
Capabilities:
Set thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x1400a2b6f
mov rsi, rcx
mov byte [rsp + 0x3f], 0xaa
lea rbx, [rcx + 0x858]
lea r14, [rcx + 8]
mov edi, 1
xor ebp, ebp
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, r14
call r15
test al, al
jne 0x1400a2ab9
jmp 0x1400a2b60
pause
dec eax
jne 0x1400a2a94
add ebp, edi
add edi, edi
cmp edi, 0x40
mov eax, 0x40
cmovge edi, eax
cmp ebp, 0x3e8
jl 0x1400a2a85
mov rcx, r14
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rbx]
mov rdi, qword [rax]
test rdi, rdi
je 0x1400a2b1a
mov byte [rsp + 0x3f], 0
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1400a2b49
xor ecx, ecx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, rdi
mov rdx, rsi
call fcn.140105590
mov ecx, dword [0x140229568]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140111870
mov rax, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, [rsp + 0x3f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x4000
mov r9d, 0x610
mov rcx, rbx
mov rdx, rsi
mov r8d, 2
call fcn.1400dccb0
mov rdi, rax
jmp 0x1400a2ada
mov rdx, rcx
not rdx
cmp qword [rdi + 8], rdx
jne 0x1400a2b72
bswap rcx
prefetcht0 byte [rcx]
jmp 0x1400a2ad3
mov eax, edi
test edi, edi
jg 0x1400a2a94
jmp 0x1400a2a9c
int3
call fcn.140141530
int3
Function at 0x1400a2b80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, dword [0x140229568]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test edi, edi
jne 0x1400a2bb7
cmp rsi, 2
jb 0x1400a2bc1
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140105bc0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400a2ba3
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400b6fd0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x140229ff0]
cmp rdi, 1
jbe 0x1400b6ff9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140100810
lea rcx, [0x140229ff0]
call fcn.14008ba60
test al, al
je 0x1400b703f
mov qword [0x140229ff8], 0
lea rbx, [0x140229ff0]
lea rdi, [0x140229ff8]
mov rcx, rdi
xor edx, edx
call fcn.14009cb70
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14008bb00
jmp 0x1400b6fe7
mov rdi, qword [0x140229ff0]
jmp 0x1400b6fe7

Function at 0x1400ba1d0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x14022a068], 0
jne 0x1400ba20d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400ba200
mov dword [rdi], eax
mov dword [0x14022a070], eax
mov qword [0x14022a068], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x1400bd9d0
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400bda70]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 8], rax
test rax, rax
je 0x1400bda29
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140111870
nop
add rsp, 0x40
pop rsi
ret
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x1b
call fcn.14017dc60
mov rcx, rsi
call fcn.14017db90
lea rdx, [0x1401f5f36]
mov r8d, ntohl
mov rcx, rax
call fcn.1400dd7e0
mov rcx, rsi
call fcn.14017dba0
jmp 0x1400bda15
Function at 0x1400e6120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1401e90c0]
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x4f], 3
movzx eax, word [0x1401f049a]
mov word [rsp + 0x3c], ax
mov eax, dword [0x1401f0496]
mov dword [rsp + 0x38], eax
mov word [rsp + 0x3e], 0
movzx r9d, byte [rdx + 0x17]
test r9b, r9b
mov r8, qword [rdx + 8]
mov rax, r9
cmovs rax, r8
mov rdx, qword [rdx]
mov r10, rdi
cmovs r10, rdx
test rax, rax
je 0x1400e61bf
lea rsi, [r10 + rax*2]
mov rcx, r10
nop dword [rax]
movzx eax, word [rcx]
xor ebx, ebx
cmp ax, word [rsp + rbx*2 + 0x38]
je 0x1400e6206
add rbx, 1
cmp rbx, 3
jne 0x1400e61a5
add rcx, 2
cmp rcx, rsi
jne 0x1400e61a0
test r9b, r9b
js 0x1400e61fc
mov rax, qword [rdi + 0x10]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rdi]
movups xmmword [r14], xmm0
cmp byte [rsp + 0x4f], 0
js 0x1400e6348
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140111870
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, r14
call fcn.1400e4a50
jmp 0x1400e61d3
cmp rcx, rsi
je 0x1400e61bf
sub rcx, r10
cmp rcx, 0xfffffffffffffffe
je 0x1400e61bf
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov dx, 0x22
call fcn.1400e4ec0
movzx ecx, byte [rdi + 0x17]
mov rax, rcx
test cl, cl
jns 0x1400e623f
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400e630d
shr cl, 7
xor esi, esi
lea rbx, [rsp + 0x20]
nop word cs:[rax + rax]
nop dword [rax]
test cl, 1
je 0x1400e632e
mov rcx, qword [rdi]
movzx edx, word [rcx + rsi*2]
cmp dx, 0x5c
je 0x1400e62a2
cmp dx, 0x22
je 0x1400e62f8
mov rcx, rbx
call fcn.1400e4ec0
add rsi, 1
movzx ecx, byte [rdi + 0x17]
test cl, cl
jns 0x1400e6336
mov rax, qword [rdi + 8]
shr cl, 7
cmp rsi, rax
jb 0x1400e6260
jmp 0x1400e630d
lea r8, [rsi + 1]
cmp rax, r8
cmova r8, rax
lea r15, [r8 - 1]
mov rdx, rsi
inc rdx
cmp rdx, rax
jae 0x1400e6343
cmp word [rcx + rdx*2], 0x5c
je 0x1400e62b4
lea r15, [rdx - 1]
mov r12, rdx
sub r12, rsi
cmp rdx, rax
je 0x1400e633e
cmp word [rcx + rdx*2], 0x22
je 0x1400e633e
test r12, r12
je 0x1400e62f3
mov rcx, rbx
mov dx, 0x5c
call fcn.1400e4ec0
dec r12
jne 0x1400e62e2
mov rsi, r15
jmp 0x1400e6284
mov rcx, rbx
mov dx, 0x5c
call fcn.1400e4ec0
mov dx, 0x22
jmp 0x1400e627c
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov dx, 0x22
call fcn.1400e4ec0
mov rax, qword [rdi + 0x10]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [rdi]
jmp 0x1400e61cf
mov rcx, rdi
jmp 0x1400e626c
mov rax, rcx
jmp 0x1400e6298
add r12, r12
jmp 0x1400e62dd
mov rdx, r8
jmp 0x1400e62cb
mov rcx, qword [rsp + 0x38]
call fcn.1401109f8
jmp 0x1400e61de
Function at 0x1400e68f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov r15, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x40], rax
movzx ebx, byte [rdx + 0x17]
test bl, bl
jns 0x1400e6920
mov rbx, qword [rsi + 8]
mov rsi, qword [rsi]
movzx ebp, byte [r15 + 0x17]
test bpl, bpl
jns 0x1400e6931
mov rbp, qword [r15 + 8]
mov r15, qword [r15]
cmp rbp, 2
jb 0x1400e6a4c
cmp word [r15 + 2], 0x3a
jne 0x1400e6a4c
movzx eax, word [r15]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x1400e6a4c
mov edi, 2
xor eax, eax
cmp rbx, 2
jb 0x1400e6a22
cmp word [rsi + 2], 0x3a
jne 0x1400e6a22
movzx ecx, word [rsi]
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp cx, 0x1a
setb cl
not al
test al, cl
je 0x1400e6a22
cmp rbp, rdi
mov rax, rdi
cmovb rax, rbp
lea rdx, [rsp + 0x30]
mov qword [rdx], rsi
mov qword [rdx + 8], 2
lea rcx, [rsp + 0x20]
mov qword [rcx], r15
mov qword [rcx + 8], rax
mov r8d, 1
call fcn.1400f0540
mov r14b, 1
test al, al
je 0x1400e69db
sub rbp, rdi
jb 0x1400e6a5a
add rbx, 0xfffffffffffffffe
cmp rbp, rbx
je 0x1400e69f8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140111870
mov eax, r14d
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
test rbp, rbp
je 0x1400e6a55
lea rax, [r15 + rdi*2]
xor ecx, ecx
movzx edx, word [rax + rcx*2]
movzx ebx, word [rsi + rcx*2 + 4]
cmp dx, bx
jne 0x1400e6a19
inc rcx
cmp rbp, rcx
jne 0x1400e6a03
cmp dx, bx
setne r14b
jmp 0x1400e69db
mov r14b, 1
cmp rbp, rbx
jne 0x1400e69db
test rbx, rbx
je 0x1400e6a55
xor eax, eax
movzx ecx, word [r15 + rax*2]
movzx edx, word [rsi + rax*2]
cmp cx, dx
jne 0x1400e6a47
inc rax
cmp rbx, rax
jne 0x1400e6a31
cmp cx, dx
jmp 0x1400e6a1c
mov al, 1
xor edi, edi
jmp 0x1400e6962
xor r14d, r14d
jmp 0x1400e69db
int3
Function at 0x1401070b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140229b98]
cmp rsi, 1
jbe 0x1401070d3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140100810
lea rcx, [0x140229b98]
call fcn.14008ba60
test al, al
je 0x140107119
mov qword [0x140229ba0], 0
lea rdi, [0x140229b98]
lea rsi, [0x140229ba0]
mov rcx, rsi
xor edx, edx
call fcn.14009cb70
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14008bb00
jmp 0x1401070c3
mov rsi, qword [0x140229b98]
jmp 0x1401070c3

Function at 0x1401071b0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x140229fb0]
cmp rsi, 1
jbe 0x1401071d3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140100810
lea rcx, [0x140229fb0]
call fcn.14008ba60
test al, al
je 0x140107219
mov qword [0x140229fb8], 0
lea rdi, [0x140229fb0]
lea rsi, [0x140229fb8]
mov rcx, rsi
xor edx, edx
call fcn.14009cb70
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14008bb00
jmp 0x1401071c3
mov rsi, qword [0x140229fb0]
jmp 0x1401071c3

Function at 0x14010bdc0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14022a008]
mov ecx, dword [0x14021ef3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14010bdf5
lea rcx, [0x14022a000]
add rsp, 0x28
jmp fcn.1401007d0
lea rcx, [0x14022a008]
call fcn.140110b10
cmp dword [0x14022a008], 0xffffffff
jne 0x14010bde5
mov qword [0x14022a000], 0
lea rcx, [0x14022a000]
xor edx, edx
call fcn.14009cb70
lea rcx, [0x14022a008]
call fcn.140110ba8
jmp 0x14010bde5
Function at 0x1401126fd
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14011271b
je 0x140112726
call 0x140112775
mov bl, 0xc7
lahf
pop rsi
jne 0x140112706
call 0x14011271e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140112706
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140112754
je 0x140112792
invalid
je 0x1401127a3
jne 0x140112706
lea rax, [0x14011262c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14010e38d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140112844
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14011289d
je 0x1401128a3
call 0x140112894
fild qword [rdi - 0x7c]
jmp 0x17504f016
jne 0x140112866
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140112826
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140112710
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14011271b
je 0x140112726
call 0x140112775
mov bl, 0xc7
lahf
pop rsi
jne 0x140112706
call 0x14011271e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140112706
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140112754
je 0x140112792
invalid
je 0x1401127a3
jne 0x140112706
lea rax, [0x14011262c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14010e38d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140112844
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14011289d
je 0x1401128a3
call 0x140112894
fild qword [rdi - 0x7c]
jmp 0x17504f016
jne 0x140112866
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140112826
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14011273c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14011271b
je 0x140112726
call 0x140112775
mov bl, 0xc7
lahf
pop rsi
jne 0x140112706
call 0x14011271e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140112706
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140112754
je 0x140112792
invalid
je 0x1401127a3
jne 0x140112706
lea rax, [0x14011262c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14010e38d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140112844
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14011289d
je 0x1401128a3
call 0x140112894
fild qword [rdi - 0x7c]
jmp 0x17504f016
jne 0x140112866
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140112826
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140112775
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14011271b
je 0x140112726
call 0x140112775
mov bl, 0xc7
lahf
pop rsi
jne 0x140112706
call 0x14011271e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140112706
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x140112754
je 0x140112792
invalid
je 0x1401127a3
jne 0x140112706
lea rax, [0x14011262c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14010e38d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140112844
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14011289d
je 0x1401128a3
call 0x140112894
fild qword [rdi - 0x7c]
jmp 0x17504f016
jne 0x140112866
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140112826
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140148360
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14012a080
cmp rax, rbx
jne 0x1401483fc
cmp edi, 1
je 0x1401483a4
cmp edi, 2
je 0x1401483fc
mov rcx, qword [rsi + 0x40]
call fcn.1401292f8
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140111870
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140148620
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140148655
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14012a080
xor ebx, ebx
test rsi, rsi
jle 0x14014867b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x14014867b
inc rbx
cmp rsi, rbx
jne 0x14014865c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14019bb10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r14, r8
mov rbx, rdx
mov r12, rcx
mov r15, qword [rsp + 0xa0]
mov rax, qword [0x14021b038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r13, [rcx + 8]
cmp r13, rdx
je 0x14019bbb0
mov rdi, r9
lea rsi, [rbx + 0x20]
movzx eax, byte [rbx + 0x37]
mov rcx, rsi
test al, al
jns 0x14019bb62
mov rax, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, r15
call fcn.1400dfab0
test eax, eax
js 0x14019bbb0
movzx eax, byte [r15 + 0x17]
mov rcx, r15
test al, al
jns 0x14019bb8d
mov rax, qword [r15 + 8]
mov rcx, qword [r15]
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, rsi
call fcn.1400dfab0
test eax, eax
js 0x14019bbd4
mov qword [r14], rbx
mov qword [rdi], rbx
jmp 0x14019bc6b
cmp qword [r12], rbx
je 0x14019bbcc
mov rax, qword [rbx]
test rax, rax
je 0x14019bc0e
mov rdi, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x14019bbbe
jmp 0x14019bc2e
mov rdi, rbx
jmp 0x14019bc5e
mov rax, qword [rbx + 8]
test rax, rax
je 0x14019bc93
mov rdi, rax
mov rax, qword [rax]
test rax, rax
jne 0x14019bbe1
cmp rdi, r13
je 0x14019bcd5
movzx eax, byte [rdi + 0x37]
test al, al
jns 0x14019bcb9
mov rax, qword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
jmp 0x14019bcbd
lea rax, [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
cmp qword [rcx], rbx
jne 0x14019bc2b
mov rcx, qword [rax]
lea rax, [rcx + 0x10]
mov rdx, qword [rcx + 0x10]
cmp qword [rdx], rcx
je 0x14019bc1b
mov rdi, qword [rax]
lea rcx, [rdi + 0x20]
movzx eax, byte [r15 + 0x17]
mov rsi, r15
test al, al
jns 0x14019bc45
mov rax, qword [r15 + 8]
mov rsi, qword [r15]
lea rdx, [rsp + 0x28]
mov qword [rdx], rsi
mov qword [rdx + 8], rax
call fcn.1400dfab0
test eax, eax
jns 0x14019bcea
cmp qword [rbx], 0
je 0x14019bc8b
mov qword [r14], rdi
add rdi, 8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140111870
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [r14], rbx
mov rdi, rbx
jmp 0x14019bc6b
mov rdi, qword [rbx + 0x10]
cmp qword [rdi], rbx
je 0x14019bbec
lea rax, [rbx + 0x10]
mov rcx, qword [rax]
lea rax, [rcx + 0x10]
mov rdi, qword [rcx + 0x10]
cmp qword [rdi], rcx
jne 0x14019bca4
jmp 0x14019bbec
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov rcx, r15
call fcn.1400dfab0
test eax, eax
jns 0x14019bcea
cmp qword [rbx + 8], 0
je 0x14019bce1
mov qword [r14], rdi
jmp 0x14019bc6b
mov qword [r14], rbx
add rbx, 8
jmp 0x14019bc8e
mov rcx, r12
mov rdx, r14
mov r8, r15
call fcn.14015da40
mov rdi, rax
jmp 0x14019bc6b