joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001130
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x80], 0
mov rcx, rdx
call qword [0x1400799c0]
mov dword [rsp + 0x80], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0xffff
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [rsi + 8]
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x140001207
cmp dword [rsp + 0x88], 1
jne 0x140001207
mov edx, dword [rsp + 0x70]
shr edx, 1
mov rcx, rdi
call qword [sym.imp.mfc100u.dll_CTaskDialog::FreeStruct]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0xffff
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [rsi + 8]
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
mov ebx, eax
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.mfc100u.dll_CMFCAcceleratorKeyAssignCtrl::PreTranslateMessage]
test ebx, ebx
je 0x140001207
mov rcx, rdi
call qword [sym.imp.mfc100u.dll_CMFCTabCtrl::Draw3DTab]
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140021e40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x38
lea rax, [rsp + 0x50]
mov ecx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x1400301c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x68]
lea rdx, [r8 + r8*2]
mov rbx, rcx
mov rcx, rsi
shl rdx, 3
mov rdi, r8
call qword [sym.imp.MSVCR100.dll_realloc]
test rax, rax
jne 0x140030218
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rdx, str.sparsehash:_FATAL_ERROR:_failed_to_reallocate__lu_elements_for_ptr__p
mov r9, rsi
lea rcx, [rax + 0x60]
mov r8d, edi
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 0x68], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140042e60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x68]
lea rdx, [r8 + r8*2]
mov rbx, rcx
mov rcx, rsi
shl rdx, 3
mov rdi, r8
call qword [sym.imp.MSVCR100.dll_realloc]
test rax, rax
jne 0x140042eb8
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rdx, str.sparsehash:_FATAL_ERROR:_failed_to_reallocate__lu_elements_for_ptr__p
mov r9, rsi
lea rcx, [rax + 0x60]
mov r8d, edi
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 0x68], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140043c70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, qword [rdx + 0x18]
mov r11, rcx
cmp r9, 0x10
jb 0x140043c86
mov r8, qword [rdx]
jmp 0x140043c89
mov r8, rdx
mov rax, qword [rdx + 0x10]
add rax, r8
cmp r9, 0x10
jb 0x140043c99
mov rdx, qword [rdx]
xor r10d, r10d
cmp rdx, rax
je 0x140043cda
mov qword [rsp], rbx
mov ebx, 0x9e3779b9
nop word [rax + rax]
movsx r8, byte [rdx]
mov r9, r10
mov rcx, r10
shr rcx, 2
shl r9, 6
inc rdx
add rcx, r9
add rcx, rbx
add r8, rcx
xor r10, r8
cmp rdx, rax
jne 0x140043cb0
mov rbx, qword [rsp]
xor edx, edx
mov rax, r10
div qword [r11 + 8]
mov rax, rdx
add rsp, 8
ret
Function at 0x140045480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rax, qword [r8 + 8]
mov rsi, r9
mov rbp, r8
mov r11, qword [rax + 0x20]
add rax, 8
mov r12, rdx
mov rbx, rcx
cmp r11, 0x10
jb 0x1400454b5
mov r10, qword [rax]
jmp 0x1400454b8
mov r10, rax
mov rcx, qword [rax + 0x10]
add rcx, r10
cmp r11, 0x10
jb 0x1400454c8
mov rax, qword [rax]
xor edi, edi
cmp rax, rcx
je 0x140045506
mov r10d, 0x9e3779b9
nop word [rax + rax]
movsx r8, byte [rax]
mov r9, rdi
mov rdx, rdi
shr rdx, 2
shl r9, 6
inc rax
add rdx, r9
add rdx, r10
add r8, rdx
xor rdi, r8
cmp rax, rcx
jne 0x1400454e0
cmp qword [rbx], 0
je 0x14004555c
mov qword [rsp + 0x48], rsi
cmp rsi, qword [rbx + 0x38]
jb 0x1400455cb
mov rax, qword [rbx + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rax
shr rcx, 1
add rcx, rax
lea rax, [rsp + 0x48]
cmp rsi, rcx
mov qword [rsp + 0x40], rcx
mov rcx, rbx
cmovae rdx, rax
mov rdx, qword [rdx]
call fcn.140043d50
cmp rax, qword [rbx + 8]
je 0x1400455cb
mov rdx, rax
mov rcx, rbx
call fcn.140044ed0
jmp 0x1400455cb
mov rdx, rsi
mov rcx, rbx
call fcn.140043d50
lea rsi, [rbx + 8]
mov rcx, rbx
mov r11, rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
cmp qword [rsi], r11
cmovae rax, rsi
mov rax, qword [rax]
mov qword [rsi], rax
call fcn.140043f10
cmp qword [rbx + 0x20], 0
je 0x1400455b1
mov rax, qword [rbx]
mov qword [rbx + 0x30], rax
cmp qword [rax], 0
jne 0x1400455bf
add rax, 8
mov qword [rbx + 0x30], rax
cmp qword [rax], 0
je 0x1400455a1
jmp 0x1400455bf
mov rdx, qword [rsi]
mov rcx, qword [rbx]
lea rdx, [rcx + rdx*8]
mov qword [rbx + 0x30], rdx
mov rcx, rbx
call fcn.140052fb0
mov qword [rbx + 0x38], rax
xor edx, edx
mov rax, rdi
div qword [rbx + 8]
mov rax, qword [rbx]
lea rcx, [rax + rdx*8]
mov rdx, qword [rbp + 8]
mov qword [rbp + 8], 0
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x58]
mov qword [r12], rcx
mov qword [rdx], rax
mov qword [rcx], rdx
inc qword [rbx + 0x20]
mov qword [rbx + 0x30], rcx
mov rbx, qword [rsp + 0x50]
mov qword [r12 + 8], rdx
mov rax, r12
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x140045890
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov r13, r9
mov r10, r8
mov rsi, rdx
mov rbx, rcx
mov rdx, qword [r8 + 0x18]
cmp rdx, 0x10
jb 0x1400458c5
mov rcx, qword [r8]
jmp 0x1400458c8
mov rcx, r8
add rcx, qword [r8 + 0x10]
cmp rdx, 0x10
jb 0x1400458d7
mov rax, qword [r8]
jmp 0x1400458da
mov rax, r8
xor edi, edi
cmp rax, rcx
je 0x140045916
mov r11d, 0x9e3779b9
nop word [rax + rax]
mov r9, rdi
shl r9, 6
mov rdx, rdi
shr rdx, 2
add rdx, r9
movsx r8, byte [rax]
add rdx, r11
add r8, rdx
xor rdi, r8
inc rax
cmp rax, rcx
jne 0x1400458f0
xor edx, edx
mov rax, rdi
div qword [rbx + 8]
mov rax, qword [rbx]
lea rbp, [rax + rdx*8]
mov r8, r10
mov rdx, rbp
mov rcx, rbx
call fcn.140043ba0
test rax, rax
je 0x140045949
mov qword [rsi], rbp
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
jmp 0x140045a3a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov word [rsp + 0x38], 0
lea rcx, [rsp + 0x28]
call fcn.140043e30
mov r12, qword [rsp + 0x30]
lea rcx, [r12 + 8]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rcx
test rcx, rcx
je 0x1400459a7
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], 0
mov byte [rcx], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r13
call fcn.14002ec40
nop
mov byte [rsp + 0x39], 1
mov rax, qword [rbx + 0x20]
lea r8, [rax + 1]
mov qword [rsp + 0x80], r8
cmp r8, qword [rbx + 0x38]
jb 0x140045a10
mov rcx, rax
shr rcx, 1
add rcx, rax
mov qword [rsp + 0x70], rcx
lea rdx, [rsp + 0x70]
lea rax, [rsp + 0x80]
cmp r8, rcx
cmovae rdx, rax
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.140043d50
cmp rax, qword [rbx + 8]
je 0x140045a10
mov rdx, rax
mov rcx, rbx
call fcn.140044ed0
xor edx, edx
mov rax, rdi
div qword [rbx + 8]
mov rax, qword [rbx]
lea rbp, [rax + rdx*8]
mov rax, qword [rbp]
mov qword [r12], rax
mov qword [rbp], r12
inc qword [rbx + 0x20]
mov rax, qword [rbx + 0x30]
cmp rbp, rax
cmovb rax, rbp
mov qword [rbx + 0x30], rax
mov qword [rsi], rbp
mov qword [rsi + 8], r12
mov byte [rsi + 0x10], 1
mov rax, rsi
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140053450
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x98]
lea rdx, [r8 + r8*2]
mov rbx, rcx
mov rcx, rsi
shl rdx, 4
mov rdi, r8
call qword [sym.imp.MSVCR100.dll_realloc]
test rax, rax
jne 0x1400534ab
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rdx, str.sparsehash:_FATAL_ERROR:_failed_to_reallocate__lu_elements_for_ptr__p
mov r9, rsi
lea rcx, [rax + 0x60]
mov r8d, edi
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 0x98], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005c040
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x88]
mov rdx, r8
mov rbx, rcx
mov rcx, rsi
mov rdi, r8
imul rdx, rdx, 0x38
call qword [sym.imp.MSVCR100.dll_realloc]
test rax, rax
jne 0x14005c09a
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rdx, str.sparsehash:_FATAL_ERROR:_failed_to_reallocate__lu_elements_for_ptr__p
mov r9, rsi
lea rcx, [rax + 0x60]
mov r8d, edi
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 0x88], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400626b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400b2a68]
jne 0x140061f3a
rol rcx, 0x10
test cx, 0xffff
jne 0x140061f36
repz ret
ror rcx, 0x10
jmp 0x140062610
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400b4bd0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400b4cc8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140062695
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400b4bd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400626b7
mov rax, qword [rsp + 0x88]
mov qword [0x1400b4cc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400b4c68], rax
mov rax, qword [0x1400b4cc8]
mov qword [0x1400b4b40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400b4c50], rax
mov dword [0x1400b4b30], 0xc0000409
mov dword [0x1400b4b34], 1
mov rax, qword [0x1400b2a68]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400b2a70]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400b4bc8], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, str.0K_v_
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400b4bc8], 0
jne 0x14006273e
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140064630
Capabilities:
Delete directory
Delete file

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rax, qword [0x1400b2a68]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r8
mov rbx, rcx
cmp edx, 1
jne 0x14006467a
test r8, r8
je 0x140064673
mov dword [r8], 0
call fcn.140064fe0
mov qword [rdi + 8], rax
xor al, al
jmp 0x140064780
cmp edx, 3
je 0x140064703
cmp edx, 0xb
je 0x140064703
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
mov r8d, 0x19
lea rdx, str.boost::filesystem::remove
lea rcx, [rsp + 0x28]
call fcn.14002e730
nop
cmp qword [rbx + 0x18], 8
jb 0x1400646c3
mov rcx, qword [rbx]
jmp 0x1400646c6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete cl
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbx
call fcn.140064560
movzx ebx, al
cmp qword [rsp + 0x40], 0x10
jb 0x1400646fb
mov rcx, qword [rsp + 0x28]
call sub.mfc100u.dll_CThreadLocalObject::CThreadLocalObject
test bl, bl
je 0x14006477e
xor al, al
jmp 0x140064780
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
mov r8d, 0x19
lea rdx, str.boost::filesystem::remove
lea rcx, [rsp + 0x28]
call fcn.14002e730
nop
cmp qword [rbx + 0x18], 8
jb 0x14006473e
mov rcx, qword [rbx]
jmp 0x140064741
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
test al, al
sete cl
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbx
call fcn.140064560
movzx ebx, al
cmp qword [rsp + 0x40], 0x10
jb 0x140064776
mov rcx, qword [rsp + 0x28]
call sub.mfc100u.dll_CThreadLocalObject::CThreadLocalObject
test bl, bl
jne 0x140064673
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140061f20
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400648f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rsi, rdx
mov rdi, rcx
jb 0x14006490f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14006493e
lea rcx, [rsp + 0x30]
mov r8, rsi
mov rdx, rdi
call fcn.1400647a0
mov eax, dword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x140064952
mov dword [rsi], 0
call fcn.140064fe0
mov qword [rsi + 8], rax
bt ebx, 0xa
jae 0x140064999
mov rcx, rdi
call fcn.140063ee0
test al, al
je 0x140064984
test bl, 0x10
mov eax, 4
mov ecx, 0xb
cmovne eax, ecx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 9
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140064b00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400b2a68]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x140064b3f
mov rcx, qword [rdx]
jmp 0x140064b42
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r12d, eax
cmp eax, 0xffffffff
jne 0x140064b63
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call fcn.1400647a0
jmp 0x140064c8a
xor r14d, r14d
bt eax, 0xa
jae 0x140064c59
cmp qword [rbx + 0x18], 8
jb 0x140064b7c
mov r13, qword [rbx]
jmp 0x140064b7f
mov r13, rbx
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r14
mov word [rsp + 0x50], r14w
call fcn.140062c10
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140033bf0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x68], 8
jb 0x140064c08
mov rcx, qword [rsp + 0x50]
call sub.mfc100u.dll_CThreadLocalObject::CThreadLocalObject
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r14
mov word [rsp + 0x50], r14w
cmp rdi, 0xffffffffffffffff
jne 0x140064c33
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call fcn.1400647a0
nop
jmp 0x140064c8a
mov rcx, rbx
call fcn.140063ee0
test al, al
jne 0x140064c50
mov dword [rsi], 9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140064c8a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x140064c6b
mov dword [rbp], r14d
call fcn.140064fe0
mov qword [rbp + 8], rax
lea rax, [rsp + 0x40]
test r12b, 0x10
mov dword [rsp + 0x40], 3
jne 0x140064c86
mov dword [rsp + 0x40], 2
mov eax, dword [rax]
mov dword [rsi], eax
mov rax, rsi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140061f20
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140067210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x1400672bf
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call sub.MSVCR100.dll_memcpy
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x140067290
sub eax, ebx
jmp 0x140067292
xor eax, eax
dec r8d
mov word [rdx], ax
jne 0x140067280
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x1400672b4
sub eax, ebx
jmp 0x1400672b6
xor eax, eax
dec edx
mov word [rcx], ax
jne 0x1400672a4
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x1400673af
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.140066fc0
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x140067327
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x14006733d
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x140067230
mov ecx, dword [rdi + 0x1718]
mov esi, dword [rdi + 0x58]
cmp ecx, esi
jae 0x1400673af
mov eax, dword [rdi + 0x94]
lea ebx, [r9 + rax]
cmp ecx, ebx
jae 0x140067381
sub esi, ebx
mov eax, 0x102
mov ecx, ebx
cmp esi, eax
cmova esi, eax
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, esi
call sub.MSVCR100.dll_memset
lea r11d, [rsi + rbx]
mov dword [rdi + 0x1718], r11d
jmp 0x1400673af
lea eax, [rbx + 0x102]
cmp ecx, eax
jae 0x1400673af
sub ebx, ecx
sub esi, ecx
mov eax, 0x102
add ebx, eax
cmp ebx, esi
cmova ebx, esi
add rcx, qword [rdi + 0x50]
xor edx, edx
mov r8d, ebx
call sub.MSVCR100.dll_memset
add dword [rdi + 0x1718], ebx
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140010aec
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14004bec8]
call fcn.14003e570
test rax, rax
je 0x140010b11
mov rdx, rax
mov rcx, rbx
call fcn.140010a6c
add rsp, 0x20
pop rbx
ret

Function at 0x140011f24
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor r8d, r8d
lea r9, [0x14005c930]
mov r10d, r8d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x140011f37
inc r8d
mov dword [r9], r10d
add r9, 4
cmp r8d, 0x100
jl 0x140011f2e
repz ret

Function at 0x140011f6c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, r8
mov rbp, rdx
mov ebx, ecx
cmp dword [0x14005c934], esi
jne 0x140011f97
call fcn.140011f24
lea r9, [0x14005c930]
jmp 0x140011fc1
test bpl, 7
je 0x140011fc6
movzx ecx, byte [rbp]
movzx eax, bl
dec rdi
xor rcx, rax
mov eax, ebx
mov ebx, dword [r9 + rcx*4]
shr eax, 8
xor ebx, eax
inc rbp
cmp rdi, rsi
ja 0x140011fa0
cmp rdi, 8
jb 0x140012051
mov r8, rdi
shr r8, 3
mov rax, r8
imul rax, rax, 0xfffffffffffffff8
add rdi, rax
xor ebx, dword [rbp]
add rbp, 8
movzx eax, bl
shr ebx, 8
mov ecx, dword [r9 + rax*4]
xor ecx, ebx
movzx eax, cl
shr ecx, 8
mov edx, dword [r9 + rax*4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [r9 + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [r9 + rax*4]
xor edx, dword [rbp - 4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [r9 + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [r9 + rax*4]
xor edx, ecx
movzx eax, dl
shr edx, 8
mov ecx, dword [r9 + rax*4]
xor ecx, edx
movzx eax, cl
shr ecx, 8
mov ebx, dword [r9 + rax*4]
xor ebx, ecx
sub r8, 1
jne 0x140011fe1
cmp rdi, rsi
jbe 0x140012073
movzx ecx, byte [rsi + rbp]
movzx eax, bl
inc rsi
xor rcx, rax
mov eax, ebx
mov ebx, dword [r9 + rcx*4]
shr eax, 8
xor ebx, eax
cmp rsi, rdi
jb 0x140012056
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400120bc
Capabilities:
Encode data using add xor sub operations

Disassembly:
inc rdx
mov r8d, 4
lea r9, [0x14005c930]
movzx eax, byte [rdx - 1]
mov eax, dword [r9 + rax*4]
xor dword [rcx + 0x204], eax
movzx eax, byte [rdx]
add rdx, 4
mov eax, dword [r9 + rax*4]
xor dword [rcx + 0x208], eax
movzx eax, byte [rdx - 3]
mov eax, dword [r9 + rax*4]
xor dword [rcx + 0x20c], eax
movzx eax, byte [rdx - 2]
mov eax, dword [r9 + rax*4]
xor dword [rcx + 0x210], eax
sub r8, 1
jne 0x1400120cc
repz ret
Function at 0x140012464
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov ebx, dword [rcx + 0x204]
mov r11d, dword [rcx + 0x208]
mov esi, dword [rdx + 8]
mov ebp, dword [rdx + 0xc]
xor r11d, dword [rdx + 4]
xor esi, dword [rcx + 0x20c]
xor ebp, dword [rcx + 0x210]
mov edi, ebx
mov r9, rdx
xor edi, dword [rdx]
xor r13d, r13d
mov r10, rcx
lea r14d, [r13 + 0x20]
mov rax, r13
mov edx, ebp
inc r13
and eax, 3
rol edx, 0xb
mov r8d, dword [r10 + rax*4 + 0x204]
add edx, esi
xor edx, r8d
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx r12d, byte [rax + r10 + 0x104]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [rax + r10 + 0x104]
mov eax, edx
shr eax, 8
shl ecx, 8
movzx eax, al
or r12d, ecx
movzx ecx, dl
movzx eax, byte [rax + r10 + 0x104]
shl r12d, 8
mov edx, esi
or r12d, eax
movzx eax, byte [rcx + r10 + 0x104]
shl r12d, 8
or r12d, eax
xor r12d, edi
ror edx, 0xf
mov edi, esi
xor edx, ebp
mov esi, r12d
add edx, r8d
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx r8d, byte [rax + r10 + 0x104]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [rax + r10 + 0x104]
mov eax, edx
shr eax, 8
shl ecx, 8
or r8d, ecx
movzx eax, al
movzx ecx, dl
movzx eax, byte [rax + r10 + 0x104]
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx + r10 + 0x104]
shl r8d, 8
or r8d, eax
xor r8d, r11d
sub r14, 1
mov r11d, ebp
mov ebp, r8d
jne 0x1400124b5
xor ebx, r12d
mov rdx, r9
mov rcx, r10
mov dword [r9], ebx
mov eax, dword [r10 + 0x208]
xor eax, r8d
mov dword [r9 + 4], eax
mov eax, dword [r10 + 0x20c]
xor eax, edi
mov dword [r9 + 8], eax
xor r11d, dword [r10 + 0x210]
mov dword [r9 + 0xc], r11d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
jmp fcn.1400120bc