joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003dad0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x142486110]
mov edx, 0x10
xor ecx, ecx
call fcn.14003f640
test rax, rax
je 0x14003dba0
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14003dd30]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call sub.KERNEL32.dll_CreateThread
mov rdx, rax
test rax, rax
jne 0x14003db93
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, qword [rbx]
test rax, rax
je 0x14003db4b
mov rcx, rdi
call rax
cmp qword [rbx + 8], 0
je 0x14003db6e
cmp qword [rbx + 0x10], 0x11
jb 0x14003db5d
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1424860d8]
xor edx, edx
mov r8, rdi
call fcn.14004d290
mov rcx, qword [0x1424860d8]
xor edx, edx
mov r8, rsi
call fcn.14004d290
call sub.KERNEL32.dll_GetLastError
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov ebx, 1
mov rax, rbx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
ud2

Function at 0x140040c50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov esi, dword [0x14005d0d0]
test esi, esi
je 0x140040cd3
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140040ccb
je 0x140040cc9
movzx eax, byte [0x142486110]
mov edx, 0xc
xor ecx, ecx
call fcn.14003f640
test rax, rax
je 0x140040cf0
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140040cc4
mov rcx, qword [0x1424860d8]
xor edx, edx
mov r8, rdi
call fcn.14004d290
mov rax, rsi
jmp 0x140040ccb
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14005d0b8]
call fcn.140030340
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140040c70
jmp 0x140040ccb
ud2

Function at 0x140040d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov esi, dword [0x14005d110]
test esi, esi
je 0x140040da9
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x140040d9c
je 0x140040d9a
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
movzx eax, byte [0x142486110]
mov edx, 0x18
xor ecx, ecx
call fcn.14003f640
test rax, rax
je 0x140040dca
movups xmmword [rax], xmm6
mov dword [rax + 0x10], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
mov ecx, esi
mov rsi, rbx
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x140040d95
mov rcx, qword [0x1424860d8]
xor edx, edx
mov r8, rdi
call fcn.14004d290
mov rax, rsi
jmp 0x140040d9c
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14005d0f8]
call fcn.140030340
mov esi, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
jbe 0x140040d29
jmp 0x140040d9c
ud2
Function at 0x140046dc0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x24]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x140046eb8
mov rdi, rax
mov qword [rsp + 0x40], rsi
movsxd r12, dword [rsp + 0x24]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0
test r12, r12
je 0x140046e98
shl r12, 3
mov ebp, 8
xor r13d, r13d
lea rbx, [rsp + 0x48]
lea r14, [rsp + 0x28]
xor esi, esi
jmp 0x140046e68
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + r13 + 0x10], xmm1
movups xmmword [rbp + r13], xmm0
inc rsi
mov qword [rsp + 0x38], rsi
add r13, 0x20
add r12, 0xfffffffffffffff8
je 0x140046e98
mov r15, qword [rdi + rsi*8]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, rbx
mov rdx, r15
mov r8, rax
call fcn.1400308a0
cmp rsi, qword [rsp + 0x28]
jne 0x140046e40
mov rcx, r14
call fcn.14004a5a0
mov rbp, qword [rsp + 0x30]
jmp 0x140046e40
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
movups xmm0, xmmword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x10], rax
jmp 0x140046ecf
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140048800
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rdi
sub rsp, 0x188
movaps xmmword [rsp + 0x170], xmm7
movaps xmmword [rsp + 0x160], xmm6
mov rsi, rcx
call fcn.140040d00
test rax, rax
je 0x140048a29
movups xmm7, xmmword [rax]
inc qword [rax]
movzx eax, byte [0x142486110]
mov edx, 0x58410
xor ecx, ecx
call fcn.14003f640
test rax, rax
je 0x140048a29
mov rdi, rax
add rdi, 0x58000
mov r8d, 0x410
mov rcx, rdi
mov dl, 0xff
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xorps xmm6, xmm6
movups xmmword [rsp + 0x100], xmm6
movups xmmword [rsp + 0x110], xmm6
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 8
mov qword [rsp + 0xa0], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xc0], 0
mov byte [rsp + 0xc8], 0
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], 0x3ff
mov qword [rsp + 0xe0], 0x380
mov qword [rsp + 0xe8], 0
movups xmmword [rsp + 0xf0], xmm7
mov qword [rsp + 0x120], 0
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x140048931
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x1400489cb
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsp + 0x110], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsp + 0x118], rax
lea rdi, [rsp + 0x90]
mov rcx, rdi
mov dl, 1
call fcn.140040dd0
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400411d0
mov r8d, 0xd0
mov rcx, rsi
mov rdx, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
movaps xmm6, xmmword [rsp + 0x160]
movaps xmm7, xmmword [rsp + 0x170]
add rsp, 0x188
pop rdi
pop rsi
ret
ud2
Function at 0x140048a30
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rsi, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x140048a75
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0x70], xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x140048b09
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsi + 0x80], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsi + 0x88], rax
mov rcx, rsi
mov dl, 1
call fcn.140040dd0
mov byte [rsp + 0x20], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x21], rax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400411d0
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rsi
ret
Function at 0x1400495d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x58], 0
lea r15, [rsp + 0x58]
mov qword [rsp + 0x20], r15
lea rcx, [0x142480bcc]
lea r9, [0x142480bb0]
xor r12d, r12d
xor edx, edx
mov r8d, 1
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x1400496e0
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x14004970a
mov rcx, r14
mov rdx, rbx
call fcn.140048ff0
mov rbx, rax
mov qword [rsp + 0x58], 0
mov rax, qword [rdi]
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], 0
xor r15d, r15d
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
test eax, eax
js 0x140049713
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x14004973d
test rbx, rbx
je 0x14004969b
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x14004976a
mov qword [rsi + 8], r14
mov byte [rsi], 0x12
jmp 0x140049751
mov edi, eax
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.oleaut32.dll_GetErrorInfo
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140049707
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r12d, edi
mov byte [rsi], 0
mov dword [rsi + 4], r12d
jmp 0x14004975a
mov ebp, eax
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.oleaut32.dll_GetErrorInfo
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14004973a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r15d, ebp
test rbx, rbx
je 0x14004974a
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
mov byte [rsi], 0
mov dword [rsi + 4], r15d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
nop
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ebx, eax
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.oleaut32.dll_GetErrorInfo
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140049791
mov rax, qword [rcx]
call qword [rax + 0x10]
mov byte [rsi], 0
mov dword [rsi + 4], ebx
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
jmp 0x140049751

Function at 0x14005b4c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, [0x1424815c0]
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.14005c2c0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]
Function at 0x14005b530
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1424861a4]
mov rbx, rcx
test esi, esi
jle 0x14005b660
mov rax, qword [0x1424861a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14005b57b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14005b605
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14005b560
mov rcx, rbx
call fcn.14005bfe0
mov rdi, rax
test rax, rax
je 0x14005b682
mov rax, qword [0x1424861a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14005c120
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1424861a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14005b667
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14005b5fe
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x14005b610
add dword [0x1424861a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1424861a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14005b5fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x142481638]
mov edx, eax
call fcn.14005b4c0
nop dword [rax]
xor esi, esi
jmp 0x14005b588
mov rax, qword [0x1424861a8]
mov edx, dword [rdi + 8]
lea rcx, [0x142481600]
mov r8, qword [rax + rbx + 0x18]
call fcn.14005b4c0
mov rdx, rbx
lea rcx, [0x1424815e0]
call fcn.14005b4c0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14005bc20
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x142486200]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1424861e0]
test rbx, rbx
je 0x14005bc84
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word cs:[rax + rax]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14005bc7b
test eax, eax
jne 0x14005bc7b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14005bc60
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14005bfe0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x142481780]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14005c000
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14005c008
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14005c000
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14005c05d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14005c054
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14005c000
add rax, 0x28
cmp rax, r9
jne 0x14005c040
xor eax, eax
ret

Function at 0x14005c060
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x142481780]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14005c07f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14005c088
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14005c07f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14005c120
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x142481780]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14005c13f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14005c148
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400051d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movss dword [rsp + 0x20], xmm3
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xa0]
mov rdi, rdx
mov edx, dword [rsp + 0x98]
test eax, eax
mov r11d, 6
mov rbp, r8
mov r10d, r11d
mov r14, rcx
cmovns r10d, eax
mov eax, edx
and eax, 0x7fffff
shr edx, 0x17
lea r9d, [rax + rax]
test edx, edx
jne 0x140005231
neg eax
sbb ecx, ecx
and ecx, 0xffffff82
jmp 0x140005234
lea ecx, [rdx - 0x7f]
mov eax, r9d
mov r15d, 0x2d
bts eax, 0x18
test edx, edx
cmovne r9d, eax
mov eax, ecx
cdq
mov esi, eax
mov eax, 0x2b
xor esi, edx
sub esi, edx
test ecx, ecx
cmovns r15d, eax
cmp esi, 0xa
jae 0x140005265
lea edx, [rax - 0x27]
jmp 0x14000526e
cmp esi, 0x64
sbb rdx, rdx
add rdx, r11
mov rcx, rbp
movsxd r8, r10d
sub rcx, rdi
cmp rcx, r8
jge 0x14000528c
mov qword [r14], rbp
mov dword [r14 + 8], 0x84
jmp 0x1400053da
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x14000527c
mov qword [rsp + 0x80], rbx
cmp r10d, r11d
jge 0x1400052d1
lea r8d, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea eax, [r8 - 1]
or eax, r9d
movzx ecx, r11b
mov edx, 1
shl edx, cl
and edx, eax
and edx, r8d
add r9d, edx
mov eax, r9d
and r9d, 0xffffff
shr eax, 0x18
add al, 0x30
mov byte [rdi], al
inc rdi
test r10d, r10d
jle 0x14000535e
mov byte [rdi], 0x2e
lea r11, str.0123456789abcdefghijklmnopqrstuvwxyz
mov eax, r9d
lea r8d, [r10 - 1]
shr rax, 0x14
mov ecx, 0x14
movzx eax, byte [rax + r11]
mov byte [rdi + 1], al
add rdi, 2
test r8d, r8d
je 0x14000535e
mov edx, 0x100000
nop word [rax + rax]
test ecx, ecx
je 0x140005348
lea eax, [rdx - 1]
sub ecx, 4
and r9d, eax
ror edx, 4
mov eax, r9d
shr rax, cl
movzx eax, byte [rax + r11]
mov byte [rdi], al
inc rdi
sub r8d, 1
jne 0x140005320
jmp 0x14000535e
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
add rdi, rbx
mov byte [rdi], 0x70
lea r9, [rsp + 0x40]
mov byte [rdi + 1], r15b
add rdi, 2
nop
dec r9
mov eax, 0xcccccccd
mul esi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub sil, cl
add sil, 0x30
mov byte [r9], sil
mov esi, edx
test edx, edx
jne 0x140005370
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rdi
cmp rax, rbx
jge 0x1400053b5
mov dword [r14 + 8], 0x84
jmp 0x1400053cf
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + 8], 0
lea rbp, [rbx + rdi]
mov qword [r14], rbp
mov rbx, qword [rsp + 0x80]
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsd qword [rsp + 0x20], xmm3
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140467300]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xa0]
mov rsi, rdx
mov rdx, qword [rsp + 0x98]
test eax, eax
mov r9, rdx
mov r11d, 0xd
mov r10d, r11d
movabs rbx, 0xfffffffffffff
cmovns r10d, eax
mov rbp, r8
and r9, rbx
shr rdx, 0x34
mov r14, rcx
test edx, edx
jne 0x140005474
mov rax, r9
neg rax
sbb ecx, ecx
and ecx, 0xfffffc02
jmp 0x14000547a
lea ecx, [rdx - 0x3ff]
mov rax, r9
movabs r8, 0x10000000000000
or rax, r8
mov r15d, 0x2d
test edx, edx
cmovne r9, rax
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x2b
xor edi, edx
sub edi, edx
test ecx, ecx
cmovns r15d, eax
cmp edi, 0xa
jae 0x1400054b4
lea edx, [rax - 0x27]
jmp 0x1400054cd
cmp edi, 0x64
jae 0x1400054c0
mov edx, 5
jmp 0x1400054cd
cmp edi, 0x3e8
sbb rdx, rdx
add rdx, 7
mov rcx, rbp
movsxd r8, r10d
sub rcx, rsi
cmp rcx, r8
jl 0x14000560b
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x14000560b
cmp r10d, r11d
jge 0x140005522
lea r8, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea rax, [r8 - 1]
or rax, r9
movzx ecx, r11b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, r8
add r9, rdx
mov rax, r9
and r9, rbx
shr rax, 0x34
add al, 0x30
mov byte [rsi], al
inc rsi
test r10d, r10d
jle 0x1400055b2
mov byte [rsi], 0x2e
lea r11, str.0123456789abcdefghijklmnopqrstuvwxyz
mov rax, r9
lea r8d, [r10 - 1]
shr rax, 0x30
mov ecx, 0x30
movzx eax, byte [rax + r11]
mov byte [rsi + 1], al
add rsi, 2
test r8d, r8d
je 0x1400055b2
movabs rdx, 0x1000000000000
nop dword [rax]
test ecx, ecx
je 0x14000559c
lea rax, [rdx - 1]
sub ecx, 4
and r9, rax
ror rdx, 4
mov rax, r9
shr rax, cl
mov eax, eax
movzx eax, byte [rax + r11]
mov byte [rsi], al
inc rsi
sub r8d, 1
jne 0x140005570
jmp 0x1400055b2
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
add rsi, rbx
mov byte [rsi], 0x70
lea r9, [rsp + 0x40]
mov byte [rsi + 1], r15b
add rsi, 2
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x1400055d0
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rsi
cmp rax, rbx
jge 0x140005615
mov dword [r14 + 8], 0x84
jmp 0x14000562f
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + 8], 0
lea rbp, [rbx + rsi]
mov qword [r14], rbp
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010eb10
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000df40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov r14, rcx
mov ecx, 0x90
call fcn.14010e9b8
mov rbx, rax
test rax, rax
je 0x14000e06e
mov rax, qword [rsi]
mov qword [rbx], rax
lea rcx, [rbx + 8]
lea rdx, [rsi + 8]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x10]
lea rdx, [rsi + 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x18]
lea rdx, [rsi + 0x18]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x20]
lea rdx, [rsi + 0x20]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x28]
lea rdx, [rsi + 0x28]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x30]
lea rdx, [rsi + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x38]
lea rdx, [rsi + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x40]
lea rdx, [rsi + 0x40]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x48]
lea rdx, [rsi + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x50]
lea rdx, [rsi + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
xor edi, edi
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
movups xmm0, xmmword [rsi + 0x58]
movups xmmword [rbx + 0x58], xmm0
movups xmm1, xmmword [rsi + 0x68]
movups xmmword [rbx + 0x68], xmm1
mov qword [rsi + 0x68], rdi
mov qword [rsi + 0x70], 0xf
mov byte [rsi + 0x58], dil
lea rcx, [rbx + 0x78]
lea rdx, [rsi + 0x78]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
lea rcx, [rbx + 0x80]
lea rdx, [rsi + 0x80]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString____ptr64____ptr64]
mov eax, dword [rsi + 0x88]
mov dword [rbx + 0x88], eax
movzx eax, byte [rsi + 0x8c]
mov byte [rbx + 0x8c], al
jmp 0x14000e072
xor edi, edi
mov ebx, edi
mov qword [rsp + 0x40], rbx
lea rsi, [r14 + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x14000a110]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r14], rax
test rax, rax
je 0x14000e0b6
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov dword [rsi], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3