joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400024b0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x1400024fd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x1400024f4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400024ff
add rax, 0x28
cmp rax, r9
jne 0x1400024e0
xor eax, eax
ret

Function at 0x140002500
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002590
mov rdx, qword [0x1400083e0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000257e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000257e
cmp word [rax + 0x18], 0x20b
jne 0x14000257e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002590
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002569
add rbx, 0x28
cmp rbx, rdi
je 0x140002590
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002560
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400025a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400083e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400025c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400025c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400025c0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000261d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002614
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400025c0
add rax, 0x28
cmp rax, r9
jne 0x140002600
xor eax, eax
ret

Function at 0x140002620
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400083e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000263f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002648
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000263f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002660
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400083e0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002680
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002688
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002680
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1400026d0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400026c7
test rcx, rcx
je 0x140002680
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x1400026b8
xor eax, eax
ret
Function at 0x1400026e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400083e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400026ff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002708
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002720
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400083e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002740
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002748
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002740
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002740
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002794
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400027a0
add rdx, 0x28
cmp rdx, r9
jne 0x140002780
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400027b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400083e0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400027d2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1400027e0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400027d2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400027d2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1400027d2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002835
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002848
add rdx, 0x28
cmp r10, rdx
jne 0x140002820
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002857
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002867
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000283e
test ecx, ecx
jg 0x140002850
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x69df60
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x69df6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x69df7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x69df65
lea eax, [rcx + 1]
jmp 0x69df8b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x69df9e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x69df84
sub eax, 3
jb 0x69dfbe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x69e00d
sar eax, 1
movsxd rbp, eax
jb 0x69dff4
jmp 0x69dfcc
add ebx, ebx
jne 0x69dfca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x69dff4
inc ecx
add ebx, ebx
jne 0x69dfda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x69dff4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x69dfed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x69dfdc
add ecx, 2
jmp 0x69dff9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.0069df22
jmp 0x69df6d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1f2800
mov dl, 0x27
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x69e05d
cmp rsi, rcx
jae 0x69e065
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x69e044
cmp al, 0x8f
ja 0x69e044
cmp byte [rsi - 2], 0xf
je 0x69e04a
sub al, 0xe8
cmp al, 1
ja 0x69e02e
cmp rsi, rcx
jae 0x69e065
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x69e034
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x69e065
lodsb al, byte [rsi]
jmp 0x69e044
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x293000]
mov eax, dword [rdi]
or eax, eax
je 0x69e0c2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2a2c5c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x69e072
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x69e0bc
mov qword [rbx], rax
add rbx, 8
jmp 0x69e092
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.0069e145], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.0069e145
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x69e135
sub rsp, 0xffffffffffffff80
jmp 0x4014c0
Function at 0x1800a0578
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
jmp 0x1800a7eee
sub eax, eax
ret
ret
jne 0x1800a149b
mov ecx, 0x20b
cmc
cmp ax, 0x1efe
test r11w, sp
cmp word [rax + 0x18], cx
jmp 0x1800a528c
jne 0x1800a149b
mov eax, 1
jmp 0x1800a2a10
cmp word [rcx], ax
jmp 0x1800a9461
jne 0x1800a149b
movsxd rax, dword [rcx + 0x3c]
stc
cmp r9b, sil
clc
lea rax, [rax + rcx]
test r8b, 0x36
stc
clc
cmp dword [rax], 0x4550
jmp 0x1800a47dc

Function at 0x1800a2e14
Capabilities:
Parse pe header

Disassembly:
jmp 0x18015593b
lea edx, [r8 + 2]
jmp 0x1800a049c
xor r8d, r8d
cwd
mov dh, 0x91
jmp 0x1800a237d

Function at 0x1800a6fe4
Capabilities:
Parse pe header

Disassembly:
jmp 0x18015593b
xor edx, edx
shl r8w, 0xb4
add r8b, 0xb9
sub ecx, ecx
movsx r8d, dx
lea r8d, [rdx + 1]
jmp 0x1800a05f9
mov dword [rsp + 0x18], r8d
cmp dx, 0xa2c
mov dword [rsp + 0x10], edx
test r10b, bl
jmp 0x18015595a
push rbp
shr bp, 0xdf
movsx ebp, r11w
bt bp, r14w
mov rbp, rsp
cmc
test r14b, 0x4a
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
movsx bx, al
mov ebx, ecx
test r8d, r8d
jne 0x180155a25
sub ecx, ecx
jmp 0x180155997
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x1801559a5
je 0x180155a25
mov ecx, 0x5a4d
test r10b, 0xa4
cmp word [rax], cx
jmp 0x1801559bc
jne 0x180155a25
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp rcx, 0x63b11784
jmp 0x1801559d5
cmp dword [rcx], 0x4550
jmp 0x1801559e0
jne 0x180155a25
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180155a25
cmp dword [rcx + 0x84], 0xe
jmp 0x180155a01
jbe 0x180155a25
cmp dword [rcx + 0xf8], 0
jmp 0x180155a13
je 0x180155a25
mov ecx, ebx
jmp 0x180155a20
call fcn.180155ba9
mov byte [rbp + 0x28], 0
movzx r9w, r11b
mov r8w, 0x5f60
movsx r9w, r10b
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
cmovae cx, r9w
cdqe
mov cx, si
lea rax, [rbp + 0x20]
movzx rcx, bp
cmovns dx, sp
cdq
mov qword [rbp - 0x10], rax
cdqe
movzx eax, r9w
lea rax, [rbp + 0x28]
movsx cx, r13b
cqo
not r8b
mov qword [rbp - 8], rax
movsx edx, di
mov eax, 2
mov dword [rbp - 0x2c], eax
cqo
movzx r9d, r14w
mov dword [rbp - 0x28], eax
jmp 0x180155a8c
lea r9, [rbp - 0x2c]
movsx ecx, di
movzx r8d, bx
movsxd rdx, r13d
lea r8, [rbp - 0x18]
movsxd rcx, ebx
mov cx, 0x31e
movsx ecx, r15w
lea rdx, [rbp - 0x28]
movsx ecx, r12w
lea rcx, [rbp - 0x30]
jmp 0x180155aba
call fcn.18015573c
nop
cmp r8b, 0xbb
clc
jmp 0x180155aca
cmp dword [rbp + 0x20], 0
jmp 0x180155ad3
je 0x180155afb
mov rbx, qword [rsp + 0x60]
movsx ebp, r14w
rol bpl, 0x6e
neg bpl
add rsp, 0x50
mov bpl, dil
movzx bp, al
pop rbp
jmp 0x180155afa
ret
mov ecx, ebx
call fcn.180155b08
int3
Function at 0x1800abd28
Capabilities:
Enumerate pe sections

Disassembly:
je 0x1800aa7b9
mov edx, dword [rax + 0xc]
stc
cmp r10, rdx
jb 0x1800a3249
mov ecx, dword [rax + 8]
cmc
cmp rax, 0x134f560e
add ecx, edx
cmp r10, rcx
jb 0x1800aa7bb
inc r9d
test al, 0x1c
add rax, 0x28
cmp r9d, r11d
jmp 0x1800aa7b3
jb 0x1800a3226
sub eax, eax
ret
movsxd r8, dword [rcx + 0x3c]
btc r10w, r12w
xor r9d, r9d
bts rax, r10
cmp r8b, 4
add r8, rcx
movsxd r11, r9d
sal r10b, cl
or r10b, spl
mov r10, rdx
shrd ax, bx, 0xfb
movzx eax, word [r8 + 0x14]
movzx r11d, r11w
sal r11b, 0x44
and r11, 0x8d1750f
movzx r11d, word [r8 + 6]
clc
add rax, 0x18
cmp esp, ebp
clc
lea rax, [rax + r8]
cmc
test r11d, r11d
jmp 0x1800a3220
Function at 0x180148e21
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
mov ch, 8
lea rcx, [rsp + 0x30]
jmp 0x180148e32
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
add rsp, 0x28
jmp 0x180148e46
ret

Function at 0x180149fb3
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
sal al, 0xa6
bt rax, r9
mov eax, 0x5a4d
cmp word [0x180000000], ax
jmp 0x180149fd2
jne 0x18014a0de
movsxd rcx, dword [0x18000003c]
sub rdx, rcx
and dh, 0x37
btr edx, r10d
lea rdx, [0x180000000]
jmp 0x180149ff5
add rcx, rdx
test edi, r9d
cmp dword [rcx], 0x4550
jmp 0x18014a006
jne 0x18014a0de
mov eax, 0x20b
test r11b, bpl
test r9b, 0xdb
cmp word [rcx + 0x18], ax
jmp 0x18014a021
jne 0x18014a0de
sub r8, rdx
movzx eax, word [rcx + 0x14]
adc dl, 0x3a
cqo
lea rdx, [rcx + 0x18]
lea rdx, [rdx + rax]
xor r9b, 0x75
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
btr r9d, 0xf3
btc r9, r13
lea r9, [rdx + rcx*8]
test di, bx
mov qword [rsp], rdx
test r12d, 0x4ed7309c
cmp rdx, r9
je 0x18014a09b
mov ecx, dword [rdx + 0xc]
cmc
cmp r8, rcx
jmp 0x18014a077
jb 0x18014a08d
mov eax, dword [rdx + 8]
clc
cmc
add eax, ecx
cmp r8, rax
jb 0x18014a09d
add rdx, 0x28
jmp 0x18014a096
jmp 0x18014a057
xor edx, edx
test rdx, rdx
jmp 0x18014a0a5
jne 0x18014a0b7
xor al, al
jmp 0x18014a0b2
jmp 0x18014a0ec
cmp dword [rdx + 0x24], 0
jmp 0x18014a0c0
jge 0x18014a0d2
sub al, al
jmp 0x18014a0cd
jmp 0x18014a0ec
mov al, 1
jmp 0x18014a0d9
jmp 0x18014a0ec
sub al, al
jmp 0x18014a0e5
jmp 0x18014a0ec
add rsp, 0x18
ret

Function at 0x18014adfb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
not bl
push rsi
rcr bx, 0x8b
bt bx, r8w
push rdi
cmovle rbx, rsi
dec bl
sub rsp, 0x40
movzx rbx, r11w
movsx rbx, bx
mov rbx, rcx
jmp 0x18014ae24
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rsi, qword [rbx + 0xf8]
xor dl, r13b
movzx dx, r12b
shr dl, 0
xor edi, edi
add ch, 0xa8
sub r8d, r8d
setns cl
cwd
lea rdx, [rsp + 0x60]
mov rcx, rsi
jmp 0x18014ae56
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x18014aee2
and qword [rsp + 0x38], 0
movzx edx, r8w
cdq
lea rcx, [rsp + 0x68]
stc
mov rdx, qword [rsp + 0x60]
mov r8w, bp
bt r8w, bp
movsx r9, r8w
mov r9, rax
shld r8w, r11w, 0xf3
movsx r8, sp
mov qword [rsp + 0x30], rcx
movzx cx, r12b
or cl, sil
mov r8, rsi
xchg cx, cx
inc rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
test r10b, r13b
xor ecx, ecx
jmp 0x18014aebf
mov qword [rsp + 0x20], rbx
jmp 0x18014aec9
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
inc edi
stc
cmc
clc
cmp edi, 2
jmp 0x18014aedc
jl 0x18014ae41
add rsp, 0x40
movzx rsi, bp
movzx si, bpl
pop rdi
movsx si, r8b
jmp 0x18014aefa
pop rsi
pop rbx
ret
Function at 0x18014bf10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
test bp, r8w
mov qword [rsp + 0x18], rsi
rol bpl, 0x62
sub bpl, cl
push rdi
bswap rbp
push r12
push r13
bts edi, ecx
movzx bx, r8b
push r14
rcl bp, cl
push r15
sub rsp, 0x40
xchg bpl, r14b
cmovnp bx, bp
mov rbx, qword [rsp + 0x90]
jmp 0x18014bf59
mov r12, rdx
cqo
movsx ebp, bx
movsxd rdi, r15d
mov rbp, rcx
mov r15b, 0x7b
mov r14w, ax
mov rdx, r9
xchg rcx, r14
mov rcx, rbx
bswap r14w
mov di, r8w
movzx r15w, r13b
mov rdi, r9
mov r15d, 0x31c82c33
movzx r15d, bx
mov r15d, r8d
mov r14d, dword [rbx + 0xc]
jmp 0x18014bf9d
call fcn.1800a1af7
sub r10d, r10d
mov esi, eax
stc
jmp 0x18014bfae
test r14d, r14d
jmp 0x18014bfb6
je 0x18014c1cf
mov r8, qword [rdi + 8]
cwd
movsxd r9, r14d
rol r11, 0xe
or eax, 0xffffffff
sar dx, 0x8c
movsxd r11, dword [rbx + 0x10]
add ecx, edi
shr r13b, 0x10
stc
mov r9d, eax
cwd
btr bx, 0xc6
mov r13d, eax
shr rdx, 0x14
mov edx, r14d
adc cx, r13w
lea ebx, [rdx - 1]
adc rax, 0x503d5c7e
lea rcx, [rbx + rbx*4]
inc ax
cmc
lea rax, [r8 + rcx*4]
cmp esi, dword [rax + r11 + 4]
jmp 0x18014c013
jle 0x18014c029
cmp esi, dword [rax + r11 + 8]
jmp 0x18014c023
jle 0x18014c047
mov edx, ebx
mov eax, ebx
test ebx, ebx
jmp 0x18014c034
jne 0x18014bff3
test eax, eax
jmp 0x18014c041
je 0x18014c077
lea eax, [rdx - 1]
movsx rdx, dx
neg dx
xor dl, r10b
lea rax, [rax + rax*4]
btc rdx, r15
bts rdx, rbx
lea rdx, [r11 + rax*4]
jmp 0x18014c06a
add rdx, r8
jmp 0x18014c072
jmp 0x18014c07a
mov rdx, r10
lea rcx, [r8 + r11]
mov r8d, r10d
or r11d, 0xffffffff
test r11w, bp
cmp r8b, 0x92
clc
test rdx, rdx
je 0x18014c0b8
mov eax, dword [rdx + 4]
jmp 0x18014c09f
cmp dword [rcx], eax
jmp 0x18014c0a6
jle 0x18014c0ec
mov eax, dword [rdx + 8]
cmp dword [rcx + 4], eax
jg 0x18014c0ec
cmp r15d, dword [rcx]
jmp 0x18014c0c0
jl 0x18014c0ec
cmp r15d, dword [rcx + 4]
jg 0x18014c0ec
cmp r9d, r11d
cdqe
mov eax, r8d
mov r13d, r8d
jmp 0x18014c0e0
cmovne eax, r9d
mov r9d, eax
jmp 0x18014c0ec
inc r8d
add rcx, 0x14
cmp r8d, r14d
jb 0x18014c08e
cmp r9d, r11d
not dil
lahf
cdqe
mov qword [rsp + 0x20], r12
mov eax, r10d
movzx edi, bx
movsx r14d, sp
mov qword [rsp + 0x30], r12
movsx rsi, r15w
movzx r14d, r9w
movsx r12d, r11w
cmovne eax, r9d
xchg r12b, sil
lea r11, [rsp + 0x40]
movzx r14, ax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
not r12w
mov r15d, 0xfc2479d
mov dword [rsp + 0x28], eax
bswap di
movsx rax, dx
lea eax, [r13 + 1]
movups xmm0, xmmword [rsp + 0x20]
xchg r14b, r12b
cmovne r10d, eax
xchg r14, r13
cdqe
movzx r12w, r13b
mov rax, rbp
mov r14w, r9w
mov dword [rsp + 0x38], r10d
jmp 0x18014c17d
movups xmm1, xmmword [rsp + 0x30]
movsxd rdi, eax
bswap r12
movdqu xmmword [rbp], xmm0
movdqu xmmword [rbp + 0x10], xmm1
seta dil
movzx r12d, si
mov rbp, qword [r11 + 0x38]
movsx r13w, r8b
mov rsp, r11
movsx r15, cx
jmp 0x18014c1af
pop r15
not di
movzx r13w, al
pop r14
pop r13
movsxd r12, esi
bswap r12d
jmp 0x18014c1c8
pop r12
mov dil, r8b
pop rdi
ret
call fcn.18015750d
int3
Function at 0x180153501
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
jmp 0x180153510
push rdi
movsxd rbx, r12d
movzx r10d, r15w
bt si, r11w
sub rsp, 0x30
shl dil, 6
test r15, rsp
sar sil, 0xbf
mov rdi, qword [rsp + 0x60]
rcl r10b, cl
movzx r10, r15w
dec esi
mov rsi, r8
cmp sil, al
xor r10b, al
mov ebx, edx
mov r10, qword [rdi + 8]
cmp r14, 0x6bf435d0
test dl, r9b
cmp r10, qword [r8 + 8]
ja 0x18015364e
cmp qword [rcx + 8], r10
ja 0x18015364e
mov rax, qword [r8 + 8]
xchg dx, dx
cwd
mov rdx, r10
sub rdx, qword [rcx + 8]
sub rax, r10
stc
cmp rdx, rax
jmp 0x180153583
jge 0x1801535dd
movups xmm0, xmmword [rcx]
jmp 0x180153591
movups xmmword [rsp + 0x20], xmm0
psrldq xmm0, 8
movq rax, xmm0
cmp r10, rax
jmp 0x1801535a8
jbe 0x180153642
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.1800a5f68
mov rax, qword [rsp + 0x28]
jmp 0x1801535c7
inc ebx
cmp qword [rdi + 8], rax
jmp 0x1801535d2
ja 0x1801535ae
jmp 0x180153642
movups xmm0, xmmword [rdi]
mov bl, bpl
movzx ebx, dx
mov ebx, r9d
jmp 0x1801535ee
movups xmmword [rsp + 0x20], xmm0
jmp 0x1801535f8
psrldq xmm0, 8
movq rax, xmm0
cmp qword [r8 + 8], rax
jbe 0x180153642
mov rcx, qword [rsp + 0x20]
cdq
not edx
movzx rdx, dx
lea rdx, [rsp + 0x28]
call fcn.1800a5f68
mov rcx, qword [rsp + 0x28]
jmp 0x18015362c
dec ebx
test dil, 9
clc
cmp qword [rsi + 8], rcx
jmp 0x18015363c
ja 0x18015360c
mov eax, ebx
jmp 0x180153649
jmp 0x180153652
or eax, 0xffffffff
cmc
mov rbx, qword [rsp + 0x40]
cmc
mov rsi, qword [rsp + 0x48]
sar rdi, cl
mov rdi, 0x65de2fd1
shld di, r10w, 0x53
add rsp, 0x30
jmp 0x18015367c
pop rdi
jmp 0x180153682
ret

Function at 0x180153b6c
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
setae dh
movsx r8w, r13b
xchg dl, r8b
mov ebx, ecx
movzx r9w, al
movsx r8, r10w
lea r9, [0x18007d8d0]
not rdx
mov ecx, 2
cwd
movsxd rdx, esi
cmovp rdx, rdx
lea r8, [0x18007d8c8]
mov dx, 0x5a37
cdq
lea rdx, [0x18007c448]
jmp 0x180153bb8
call fcn.18015377a
mov ecx, ebx
clc
cmp bl, r14b
test r10w, 0x17db
test rax, rax
jmp 0x180153bd1
je 0x180153bec
add rsp, 0x20
movsx rbx, r14w
pop rbx
jmp 0x180153be5
jmp qword [0x18007c288]
add rsp, 0x20
movzx bx, ah
pop rbx
jmp 0x180153bfa
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x180153c01
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
bt r9w, 0x58
push rdi
add r9b, r14b
btc r9d, 0x90
mov bl, cl
sub rsp, 0x20
movsx bx, spl
setae r9b
cmovg r9d, ebp
mov rbx, rdx
cmovs r9, r10
lea r9, [0x18007d8d8]
xchg edi, r8d
cwd
mov edi, ecx
movsx rdx, bp
lea rdx, [0x18007c458]
mov r8b, 0xf1
mov ecx, 3
jmp 0x180153c5d
lea r8, [0x18007d8d0]
jmp 0x180153c69
call fcn.18015377a
mov rdx, rbx
test dl, r12b
rcr ch, 0x35
mov ecx, edi
test rax, rax
jmp 0x180153c81
je 0x180153c92
call qword [0x18007c288]
jmp 0x180153c98
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
sbb edi, 0x60e323c0
and dil, 0xbf
add rsp, 0x20
not dil
pop rdi
jmp 0x180153cb4
ret
Function at 0x180158626
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movzx rcx, r11w
movzx ecx, sp
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
bsf cx, si
push rdi
sub rsp, 0x30
seta dil
movzx edi, r11w
mov rdi, r9
cmovs cx, r14w
movzx rcx, r14w
mov ecx, dword [rdx]
jmp 0x180158660
call fcn.18009d42c
nop
bsf ax, r15w
btc rbx, rdi
rcl sil, cl
lea rbx, [0x180096600]
shrd eax, ebx, 0xd
sbb rax, 0xef02cbb
lea rsi, str.________________________________H
rcl ax, cl
mov ah, 0x26
sal eax, 0x86
mov qword [rsp + 0x20], rbx
test cl, r8b
mov al, r12b
movsxd rax, r9d
lea rax, [0x180096608]
cmp rbx, rax
jmp 0x1801586b1
je 0x1801586eb
cmp qword [rbx], rsi
jmp 0x1801586bf
je 0x1801586dd
mov rdx, rsi
bswap cx
movsx cx, r10b
mov rcx, rbx
call fcn.18015ec02
mov qword [rbx], rax
cmc
clc
add rbx, 8
jmp 0x1801586e6
jmp 0x180158694
mov ecx, dword [rdi]
jmp 0x1801586f2
call fcn.1800a8d54
mov rbx, qword [rsp + 0x40]
or esi, r11d
rcl dil, 0x81
xor di, r11w
mov rsi, qword [rsp + 0x48]
dec dil
add rsp, 0x30
jmp 0x18015871c
pop rdi
ret
Function at 0x18015abb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sar bh, cl
mov r8b, bpl
sub rsp, 0x20
sal r8d, cl
and r8d, 0x2e4268ac
rcl r8, 0xb7
mov rbx, rcx
xchg r8b, r8b
sub edx, edx
sub r8w, bp
inc r8w
add rcx, 0x18
seta r8b
mov r8d, 0x101
jmp 0x18015abf8
call fcn.18014d7ec
sub edx, edx
jmp 0x18015ac04
lea rdi, [rbx + 0xc]
movzx rcx, r15w
movzx eax, dx
lea r9, [0x1800941e0]
movsx r8, bx
mov qword [rbx + 4], rdx
movsxd rcx, eax
mov r8, rbx
movsxd rcx, ebp
mov qword [rbx + 0x220], rdx
bswap rcx
lea ecx, [rdx + 6]
jmp 0x18015ac39
rep stosw word [rdi], ax
bswap edi
sal di, 0x17
sar dil, 0x1c
lea rax, [0x1800941f8]
movzx ecx, bx
mov edi, edx
xor cl, 0x99
movzx ecx, r14w
cmp rsp, 0x5b4d3402
sub r8, rax
xchg ecx, ecx
lea rcx, [rdi + r9]
setne al
inc rdi
clc
ror al, cl
mov al, byte [rcx + 0x18]
cmp r12w, 0x33ed
clc
jmp 0x18015ac81
mov byte [r8 + rcx + 0x30], al
cmc
cmp r9, rcx
cmp rdi, 0x101
jmp 0x18015ac96
jl 0x18015ac65
lea rax, [0x1800942f9]
sub rbx, rax
movsx cx, ah
mov ch, 0x3d
movsxd rcx, r15d
lea rcx, [rdx + r9]
mov al, 0xd9
sete al
inc rdx
or al, r11b
mov al, byte [rcx + 0x119]
cmc
mov byte [rbx + rcx + 0x232], al
cmp ax, r11w
cmp rdx, 0x100
jmp 0x18015acdd
jl 0x18015acb0
mov rbx, qword [rsp + 0x30]
sub dil, 0xc0
inc dil
add rsp, 0x20
pop rdi
jmp 0x18015acf9
ret