joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e57bb
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
jmp 0x140475613
mov rdx, rcx
test rcx, rcx
je 0x1400b2b73
movzx r8d, word [rcx]
cmp bx, bx
cmp dl, 0xcf
test r8w, r8w
jmp 0x14066b6c6
ret
je 0x1400b2b73
mov r9d, 0x811c9dc5
rcr al, cl
lea eax, [r8 - 0x41]
btr rcx, rcx
setnp cl
and rcx, 0x4a142b75
cmp ax, 0x19
cdqe
mov al, ah
cbw
lea ecx, [r8 + 0x20]
cmovno rax, r8
lea rdx, [rdx + 2]
cmova cx, r8w
btc rax, 0xd1
add r8d, 0x52691c7b
movsxd rax, r9d
movzx r8d, word [rdx]
btr ax, 0xa3
movzx eax, cx
test dx, 0x6380
xor eax, r9d
imul r9d, eax, 0x1000193
clc
test r8w, r8w
jmp 0x1408638d7
jne 0x14066b6d4
mov eax, r9d
ret

Function at 0x1403b5fe5
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
dec rdx
test rcx, rcx
jmp 0x14019a0fc
xor eax, eax
ret
jne 0x14047e655
mov eax, r10d
jmp 0x1402c6f3c
je 0x1401293d7
movzx r9d, word [rcx]
cmp r11d, r9d
test r9w, r9w
jmp 0x14047e642
ret
mov r8, rcx
test r8b, 0x77
cmc
test rcx, rcx
jmp 0x140248409
je 0x1401293d7
mov r10d, 0x811c9dc5
cmc
movzx ecx, r15w
cbw
lea eax, [r9 - 0x41]
dec ch
cmp ax, 0x19
xchg cx, ax
lea ecx, [r9 + 0x20]
movsxd rax, r14d
movzx eax, r9w
not ax
lea r8, [r8 + 2]
movsx ax, r12b
cmova cx, r9w
add ah, 0x26
movzx r9d, word [r8]
movzx eax, cx
xor eax, r10d
sal r10b, cl
rcr r10w, cl
imul r10d, eax, 0x1000193
test r9w, r9w
jmp 0x14048e0d1
je 0x14019a102
mov rcx, rdx
jmp 0x140115f20

Function at 0x14044c0ad
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
movzx ecx, al
jmp 0x140146b30
je 0x140756e55
mov r10d, 0x811c9dc5
cmp r15b, 0x90
stc
clc
movzx edx, r9b
shld eax, esp, 0x5a
sub r9b, 0x41
adc ah, 0x48
cmp r9b, 0x19
movsx rcx, r12w
movzx rax, ax
lea eax, [rdx + 0x20]
jmp 0x1400e233b
test r9b, r9b
jmp 0x1403e926e
cmova ecx, edx
inc r8
movzx eax, cl
shl r9b, 0xf1
xor eax, r10d
imul r10d, eax, 0x1000193
inc r9b
mov r9b, byte [r8]
test ax, r15w
test dx, 0x668
jmp 0x1401427be
je 0x140756e55
mov r9b, byte [rcx]
clc
cmp r11b, 0x21
cmp r14w, r10w
test r9b, r9b
jmp 0x14011f91a
jne 0x14011f92c
mov eax, r10d
ret
mov r8, rcx
test rcx, rcx
jmp 0x14018b963
sub eax, eax
jmp 0x1407b501f
ret

Function at 0x1404c44fb
Capabilities:
Hash data using fnv

Disassembly:
ret
ret
xor eax, eax
jmp 0x1401252ae
je 0x140389a2d
inc rcx
cmp bl, r12b
movzx eax, al
stc
xor eax, edx
sar dh, 0xe7
rcr dx, 0x31
imul edx, eax, 0x1000193
sbb al, al
mov al, byte [rcx]
test bpl, 0x6a
test ebx, esp
test al, al
jmp 0x1407074cc
test rcx, rcx
je 0x140389a2d
mov al, byte [rcx]
adc dx, bx
sar dx, 0x22
mov edx, 0x811c9dc5
test ecx, r13d
test al, al
jmp 0x1403f0b8e
jne 0x1403f0b94
mov eax, edx
jmp 0x140346d84

Function at 0x140607f29
Capabilities:
Hash data using fnv

Disassembly:
ret
test ax, ax
jmp 0x140480ae8
jne 0x1406144a4
mov eax, edx
jmp 0x1405250e6
ret
sub eax, eax
jmp 0x14008cb9e
test rcx, rcx
jmp 0x140614488
je 0x1405c09fc
movzx eax, word [rcx]
btr dx, 0xb
mov edx, 0x811c9dc5
test ax, ax
je 0x1405c09fc
movzx eax, ax
test r13w, 0x5742
cmp r14b, 0xde
lea rcx, [rcx + 2]
test r15b, dl
xor eax, edx
ror rdx, cl
xor dl, r11b
movzx dx, r13b
imul edx, eax, 0x1000193
setbe ah
bts ax, r14w
shl al, 0x11
movzx eax, word [rcx]
jmp 0x1402e0251
Function at 0x1407ab216
Capabilities:
Hash data using fnv

Disassembly:
jb 0x1402db506
mov eax, ecx
jmp 0x14048a87d
inc r8
cmp dl, ah
xor eax, ecx
movzx cx, r13b
and cl, dil
imul ecx, eax, 0x1000193
cmp r8, rdx
jmp 0x1401b87a7
je 0x1401b87ad
movzx eax, byte [r8 + r9]
jmp 0x1402a8844
ret
jne 0x1406c21ba
xor eax, eax
ret
mov ecx, 0x811c9dc5
test rdx, rdx
jmp 0x1402db500
xor r8d, r8d
shl r9d, 0x6f
shld r9w, bx, 0xdb
mov r9, rcx
cmc
test rcx, rcx
jmp 0x140554030

Function at 0x14089228f
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
test r14b, bpl
mov qword [rax + 8], rbx
cmc
jmp 0x1408922a8
mov qword [rax + 0x10], rbp
movzx bp, sil
and rbp, 0x58d7a49
cmp r11b, 0xf9
mov qword [rax + 0x18], rsi
test dl, 0x10
mov bp, 0x51fa
mov qword [rax + 0x20], rdi
add sil, 0x80
push r14
lahf
and rsi, rbp
sub rsp, 0x20
rcr ebp, 9
mov rax, qword gs:[0x60]
stc
rcl si, cl
mov r14b, r8b
mov ebp, ecx
sub sil, spl
rcl si, cl
mov rsi, qword [rax + 0x18]
cmp di, bx
test dx, r12w
stc
test rsi, rsi
jmp 0x140892308
je 0x1408923b7
add rsi, 0x10
ror bl, cl
ror bh, 0xdd
sub edi, edi
xor ebp, 0x75ede3db
sbb ebx, r12d
mov rbx, qword [rsi]
cmp r14w, bp
test r8b, r8b
jmp 0x140892331
je 0x140892371
call 0x1403b849d
jmp 0x140892371
movzx edx, word [rbx + 0x58]
rcr ch, 0x5e
mov rcx, qword [rbx + 0x60]
shr rdx, 1
jmp 0x140892355
call fcn.1403b5fe5
cmp eax, ebp
jmp 0x140892361
je 0x140892384
mov rbx, qword [rbx]
test ax, 0x2e4e
cmp r14d, r14d
cmp rbx, rsi
jmp 0x140892379
jne 0x140892342
jmp 0x14089238c
mov rdi, rbx
cmc
test r9b, 0x1d
test r14b, r14b
jmp 0x140892394
je 0x14089239f
call 0x14056ed8b
test rdi, rdi
je 0x1408923b7
mov rax, qword [rdi + 0x30]
jmp 0x1408923b2
jmp 0x1408923c3
sub eax, eax
bt si, r9w
or bx, 0x23ea
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
adc dil, r8b
mov rsi, qword [rsp + 0x40]
shl r14b, cl
btc edi, 0xf4
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
mov r14d, 0x38ff656a
pop r14
jmp 0x1408923f2
ret
Function at 0x140892c3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
test r15w, r15w
cmc
mov qword [rax + 8], rbx
bswap rbx
movzx ebx, r14w
sal bh, cl
mov qword [rax + 0x10], rsi
sar bh, cl
add bx, 0x7483
mov qword [rax + 0x18], rdi
ror di, cl
jmp 0x140892c6e
push rbp
lea rbp, [rax - 0x5f]
inc rdi
xor ebx, 0x5475298d
sub rsp, 0x90
xor esi, esi
movsxd rbx, r11d
mov dword [rbp + 7], 0x4b005c
bts bx, r10w
mov qword [rbp + 0x7f], rsi
rcl di, 0x44
ror dil, 0xd6
mov rbx, r8
cmp r13w, 0x54d5
mov dword [rbp + 0xb], 0x6f006e
mov rdi, rcx
mov dword [rbp + 0xf], 0x6e0077
test r12b, 0x2a
mov dword [rbp + 0x13], 0x6c0044
cmc
cmp bpl, 0xd
stc
mov dword [rbp + 0x17], 0x73006c
cmp r14w, r8w
test spl, 0x56
mov dword [rbp + 0x1b], 0x320033
jmp 0x140892ce6
mov word [rbp + 0x1f], si
test r14b, r10b
test dl, dl
jne 0x140892cfd
mov word [rbp + 0x1b], si
cmovl rcx, rdx
lea rdx, [rbp + 7]
mov cx, r8w
lea rcx, [rbp - 0x19]
call 0x14069843c
lea rax, [rbp - 0x19]
jmp 0x140892d18
mov dword [rbp + 0x27], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
lea r8, [rbp + 0x27]
mov qword [rbp + 0x2f], rsi
movsxd rdx, r13d
cwd
mov dx, r10w
mov edx, 3
movsx ecx, bp
mov dword [rbp + 0x3f], 0x40
lea rcx, [rbp + 0x7f]
jmp 0x140892d4f
movdqu xmmword [rbp + 0x47], xmm0
call fcn.140794332
test eax, eax
js 0x140892dfb
mov rdx, rdi
setb cl
movsxd rcx, ebp
jmp 0x140892d6f
lea rcx, [rbp - 9]
jmp 0x140892d78
call 0x14024c3da
mov rax, qword [rbp + 0x7f]
movsxd r8, r8d
movsx r8, r9w
lea r8, [rbp + 0x27]
mov qword [rbp + 0x2f], rax
jmp 0x140892d96
xorps xmm0, xmm0
lea rax, [rbp - 9]
movzx cx, bl
not cx
mov dword [rbp + 0x27], 0x30
mov cl, 0x30
jmp 0x140892db2
mov edx, 0xf
movzx ecx, r14w
jmp 0x140892dc0
mov qword [rbp + 0x37], rax
mov rcx, rbx
mov dword [rbp + 0x3f], 0x40
jmp 0x140892dd3
movdqu xmmword [rbp + 0x47], xmm0
call fcn.14058eefb
mov rcx, qword [rbp + 0x7f]
jmp 0x140892de6
mov ebx, eax
jmp 0x140892ded
call fcn.1402fb9ff
mov eax, ebx
movzx rbp, ax
not rbp
lea r11, [rsp + 0x90]
setne bl
mov rbx, qword [r11 + 0x10]
cmovo si, ax
mov rsi, qword [r11 + 0x18]
setae bpl
not bpl
movsx edi, r15w
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
jmp 0x140892e2a
ret
Function at 0x14089619a
Capabilities:
Execute anti-debugging instructions
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
setnp r8b
mov qword [rsp + 0x18], rbp
sal r8d, cl
mov qword [rsp + 0x20], rsi
mov r10w, 0x7d7
push rdi
ror bpl, 0x9d
xchg rsi, rdi
movsx di, bpl
push r14
mov si, 0x7020
btr r9w, r15w
movzx edi, ax
mov r8, rdx
bsf edi, esi
btc esi, ecx
setge r14b
mov r9, rdx
sal si, 0x5b
movzx edi, r8w
adc sil, 0xc5
shr r8, 3
movsx r10, sp
mov rdi, rcx
xchg si, r10w
movabs rsi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
movsx r14d, r13w
sete r10b
movabs r14, 0x7080100200400801
mov r10d, eax
mov r10d, 8
jmp 0x14089622f
jmp 0x1408962fb
dec r8
bt r11d, 0x36
rdtsc
bswap cx
shl rdx, 0x20
test r10b, 0x55
test bpl, r11b
movsx r11d, dx
lea r11, [rsp + 0x18]
shl ecx, cl
sar ch, cl
sbb bl, r15b
or rax, rdx
mov rbx, r10
rcr rdx, cl
movsx ecx, si
clc
mov rcx, rax
ror rcx, 3
cdq
xor rcx, rax
neg dx
cbw
shld dx, r12w, 0xaf
mov rax, r14
rol dl, cl
rcr dh, cl
adc dx, 0x10e8
mul rcx
cmp r15d, esi
movzx ecx, r8w
mov rcx, rsi
clc
xor rdx, rax
movsx ax, r11b
setp al
mov qword [rsp + 0x18], rdx
movsx ax, dil
movsx eax, ax
inc rax
movzx eax, byte [r11]
jmp 0x1408962bd
inc r11
stc
xor rcx, rax
cmp r8, rbp
stc
imul rcx, rbp
stc
sub rbx, 1
jmp 0x1408962d6
jne 0x1408962b4
xor rcx, rdx
test r12b, 0xb2
jmp 0x1408962ec
mov qword [rdi], rcx
test r11b, r9b
lea rdi, [rdi + r10]
clc
test ax, r15w
test r8, r8
jmp 0x140896303
jne 0x140896234
and r9d, 7
jmp 0x140896312
je 0x1408963c5
rdtsc
ror rcx, cl
shl rdx, 0x20
or rax, rdx
cmc
xchg ecx, edx
mov rcx, rax
ror rcx, 3
xor rcx, rax
adc eax, r10d
mov rax, r14
sal edx, cl
mul rcx
stc
lea rcx, [rsp + 0x18]
test r11w, si
xor rdx, rax
movsx eax, r13w
mov qword [rsp + 0x18], rdx
bswap ax
movzx eax, byte [rcx]
jmp 0x14089635d
inc rcx
test rdx, r13
xor rsi, rax
cmp bh, 0xe8
clc
imul rsi, rbp
jmp 0x140896373
sub r10, 1
jmp 0x14089637c
jne 0x140896355
xor rdx, rsi
clc
cmp r8b, 0xe9
cmc
mov qword [rsp + 0x18], rdx
test r15b, sil
jmp 0x14089639c
test rdi, rdi
jmp 0x1408963a4
je 0x1408963c5
lea rsi, [rsp + 0x18]
movsx rbx, r9w
mov ch, bh
movsxd rbp, esi
mov rcx, r9
movsx r14w, r9b
not rbx
rep movsb byte [rdi], byte [rsi]
mov rbx, qword [rsp + 0x20]
xchg bp, di
movsx rdi, di
movzx rbp, di
mov rbp, qword [rsp + 0x28]
movsx si, spl
mov r14d, 0x3dcf4d59
movzx edi, bp
mov rsi, qword [rsp + 0x30]
pop r14
pop rdi
jmp 0x1408963f5
ret
Function at 0x14089890f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov eax, 0x3e1f0356
bts ax, di
test ebp, r13d
mov qword [r11 + 8], rbx
sbb al, r15b
mov qword [r11 + 0x20], r9
mov rax, r8
mov qword [r11 + 0x10], rdx
adc ah, 0x10
shld ax, sp, 0xcf
push rbp
cdqe
push rsi
and ah, 0x3d
btr ax, dx
push rdi
push r14
adc bp, 0x2488
neg bpl
movzx ebp, r11w
push r15
bsr ax, sp
sar bp, cl
btr eax, 0x63
sub rsp, 0x20
xchg bpl, bpl
add ax, bx
sbb ax, 0x35a
mov rax, qword [r8 + 0x18]
mov rbp, rcx
test si, bp
cmp r11w, 0x57db
jmp 0x140898982
mov qword [r11 + 0x20], rax
cmp r12d, 0x3f4b69da
cmc
test rax, rax
jmp 0x140898996
jne 0x1408989a1
jmp 0x140898b45
lea rbx, [rcx + 0x30]
mov rcx, rbx
jmp 0x1408989ad
call 0x14027ed1e
mov rcx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x60]
cmp rcx, rsi
je 0x140898b34
mov rdx, qword [rsp + 0x68]
mov rax, qword [rcx]
test r14b, 0xbf
cmp qword [rax + 0x38], rdx
jmp 0x1408989d9
je 0x1408989ed
add rcx, 0x10
cmc
cmp rcx, rsi
jne 0x1408989c8
cmp rcx, rsi
je 0x140898b34
lea rdi, [rcx + 0x10]
or r15d, 0xffffffff
stc
cmp rdi, rsi
jmp 0x140898a07
je 0x140898acd
mov rcx, qword [rdi + 8]
sub r14d, 0x452a25a5
and qword [rdi + 8], 0
cmc
movsx r14, r12w
dec r14
mov rax, qword [rdi]
xor r14b, 0xd0
test bp, 0x57f4
and qword [rdi], 0
mov qword [rdi - 0x10], rax
mov r14, qword [rdi - 8]
jmp 0x140898a42
mov qword [rsp + 0x58], rcx
cmp bl, r12b
jmp 0x140898a50
mov qword [rdi - 8], rcx
clc
test dil, 0x3e
test r14, r14
je 0x140898ab7
mov eax, r15d
lock xadd dword [r14 + 8], eax
add eax, r15d
jmp 0x140898a73
jne 0x140898ab7
mov rax, qword [r14]
movsx cx, sil
movsx ecx, r14w
mov rcx, r14
jmp 0x140898a8d
call qword [rax]
mov eax, r15d
lock xadd dword [r14 + 0xc], eax
add eax, r15d
jmp 0x140898aa0
jne 0x140898ab7
mov rax, qword [r14]
not cx
mov rcx, r14
jmp 0x140898ab4
call qword [rax + 8]
add rdi, 0x10
cmp rdi, rsi
jmp 0x140898ac3
jne 0x140898a0d
mov rsi, qword [rbp + 0x60]
mov rdi, qword [rsi - 8]
test rdi, rdi
jmp 0x140898ad9
je 0x140898b29
mov eax, r15d
test r13w, cx
test ch, 0x7f
lock xadd dword [rdi + 8], eax
add eax, r15d
jmp 0x140898af6
jne 0x140898b29
mov rax, qword [rdi]
mov rcx, rdi
jmp 0x140898b07
call qword [rax]
mov eax, r15d
stc
lock xadd dword [rdi + 0xc], eax
add eax, r15d
jmp 0x140898b1a
jne 0x140898b29
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
add qword [rbp + 0x60], 0xfffffffffffffff0
test dh, 0x8d
cmp r13b, r9b
test rbx, rbx
je 0x140898b45
mov rcx, rbx
call 0x1408378ca
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
movzx rbp, cx
pop r14
mov rbp, 0x252e329e
bswap bp
not sil
pop rdi
movzx rbp, r10w
pop rsi
movsx rbp, r10w
xchg bpl, bpl
movzx ebp, r11w
pop rbp
jmp 0x140898b7b
ret
Function at 0x1408a69e2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
jmp 0x1408a6a0d
push rsi
push rdi
not ax
setl al
mov ax, dx
push r12
nop
movzx eax, r13w
push r13
push r14
movzx rax, r13w
not ax
push r15
mov al, 0xe2
mov eax, 0x2040
jmp 0x1408a6a39
call fcn.140056160
nop
bswap r13w
sub rsp, rax
setne r12b
adc r15d, 0x17d85b83
bsf bp, r15w
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2080], rbx
rol bp, 0x2d
bt bx, bx
mov rbx, r9
add r12b, 0x23
mov r15, r8
mov r13, rdx
xadd r12b, bpl
mov rbp, rcx
rcr r12w, cl
sbb r12b, spl
mov dword [rsp + 0x2090], 4
inc cx
mov r12d, dword [r8]
xor r14b, r14b
bsf dx, ax
cwd
and dword [r9], 0
and dword [r9 + 4], 0
shr dl, cl
btc dx, 0x69
sub dl, cl
and dword [r8], 0
add al, 0x26
sar al, 0xc
and dword [rsp + 0x2098], 0
mov rax, r10
cdq
mov rax, qword [rbp + 0x58]
lea rcx, [rsp + 0x2090]
movzx r8, bx
cqo
movsxd r9, ebp
mov qword [rsp + 0x20], rcx
cwd
movzx edx, bx
lea r9, [rsp + 0x2098]
movsx r8, sp
mov r8d, 0x2000
mov dl, 0xd7
movsx rdx, bp
movsx cx, r14b
lea rdx, [rsp + 0x40]
movzx cx, cl
movsxd rcx, ecx
mov rcx, qword [rbp + 0x88]
jmp 0x1408a6b1f
call rax
nop
test eax, eax
jmp 0x1408a6b29
jne 0x1408a6cad
mov edx, dword [rsp + 0x2090]
stc
test edx, edx
jmp 0x1408a6b3e
js 0x1408a6ca0
cmp edx, 1
jmp 0x1408a6b4c
jg 0x1408a6c51
test r14b, r14b
jmp 0x1408a6b5a
jne 0x1408a6c25
mov esi, dword [rsp + 0x2098]
test esi, esi
jmp 0x1408a6b6e
je 0x1408a6c25
mov r8d, dword [r15]
rcr ax, 0xf6
cbw
cdqe
lea eax, [r8 + rsi]
clc
jmp 0x1408a6b8a
cmp eax, r12d
jbe 0x1408a6ba0
mov r14b, 1
jmp 0x1408a6b9b
jmp 0x1408a6c25
mov rcx, rsi
mov rdi, r8
add rdi, r13
jmp 0x1408a6bae
je 0x1408a6bf8
test esi, esi
je 0x1408a6bf8
lea rsi, [rsp + 0x40]
cmovae r8w, bp
mov r8w, 0x33a0
jmp 0x1408a6bd0
rep movsb byte [rdi], byte [rsi]
mov r8d, dword [r15]
movsx edx, bp
bts cx, ax
cmp r10, 0x16db615c
mov edx, dword [rsp + 0x2090]
mov esi, dword [rsp + 0x2098]
cmp dil, 0x9f
cmp bpl, r13b
mov ecx, esi
stc
cmp rbx, rbx
test esi, esi
jmp 0x1408a6c05
je 0x1408a6c14
lea rdi, [rsp + 0x40]
xor eax, eax
rep stosb byte [rdi], al
lea eax, [r8 + rsi]
test cx, si
test r12, 0x72d0691a
mov dword [r15], eax
test edx, edx
jmp 0x1408a6c2c
jne 0x1408a6abf
test r14b, r14b
jmp 0x1408a6c3a
je 0x1408a6cce
mov dword [rbx + 4], 0x6f
jmp 0x1408a6c4c
jmp 0x1408a6cbd
cmp edx, 4
jmp 0x1408a6c59
jne 0x1408a6ca0
mov byte [rbp + 0xcc], 1
cdq
mov rdx, rbx
mov rcx, rbp
jmp 0x1408a6c72
call fcn.1408a7131
nop
cbw
movsxd rax, esp
movzx rax, sp
mov dword [rbx], 0xd000122f
movzx eax, word [rbp + 0xc8]
jmp 0x1408a6c93
mov dword [rbx + 4], eax
jmp 0x1408a6c9b
jmp 0x1408a6cce
mov dword [rbx + 4], edx
jmp 0x1408a6ca8
jmp 0x1408a6cbd
mov dword [rbx + 4], eax
or r15b, 0x5b
xor dil, r8b
shld r12w, r15w, 0x78
mov dword [rbx], 0xd0001207
sal r13b, cl
test r13w, cx
rcl di, 0xfe
mov rbx, qword [rsp + 0x2080]
movsx r14w, r8b
clc
adc bp, si
add rsp, 0x2040
pop r15
pop r14
mov bpl, r13b
pop r13
mov r12, 0x2604460f
bswap rsi
pop r12
movzx bp, r14b
pop rdi
pop rsi
bswap ebp
pop rbp
jmp 0x1408a6d0a
ret
Function at 0x1400014c5
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400014f8
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x1400014fd
call fcn.14002e740
mov ecx, dword [0x141b8dffc]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov byte [rcx + 0x60], 1
mov qword [rcx + 0x68], rax
mov qword [rcx + 0x70], rdx
add rsp, 0x38
ret

Function at 0x140009920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400099b0
cmp r10, r11
jb 0x140009a26
cmp r10, rdx
ja 0x140009a3a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x1400099b2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140009990
jmp 0x140009a14
ja 0x1400099ba
mov r11, r10
cmp rax, r8
jne 0x140009954
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400099f0
mov rdi, r8
sub ecx, edx
jns 0x140009a0b
jmp 0x140009a16
cmp r8, rsi
je 0x140009a4b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140009a16
xor al, 1
cmp rdi, rsi
jne 0x1400099d0
jmp 0x140009a16
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, [0x141b76980]
mov rcx, r11
mov rdx, r10
call fcn.14005f2f0
ud2
lea r8, [0x141b76980]
mov rcx, r10
call fcn.14005f080
ud2
lea rcx, [0x141b7dd28]
lea r8, [0x141b76968]
mov edx, 0x2b
call fcn.14005f100
ud2
Function at 0x14000b53e
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r9, r8
mov rax, rdx
not ecx
lea rdi, [0x141b77510]
mov ebx, 0xff
lea rsi, [0x141b774f8]
cmp r9, 0x40
jb 0x14000b66e
mov r14d, 4
sub r14, 1
jb 0x14000b563
cmp r9, 0xf
jbe 0x14000b69b
movzx edx, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
mov ebp, dword [rdi + r8*4 + 0x400]
xor ebp, dword [rdi + rdx*4]
movzx edx, byte [rax + 0xd]
xor ebp, dword [rdi + rdx*4 + 0x800]
movzx edx, byte [rax + 0xc]
xor ebp, dword [rdi + rdx*4 + 0xc00]
movzx edx, byte [rax + 0xb]
xor ebp, dword [rdi + rdx*4 + 0x1000]
movzx edx, byte [rax + 0xa]
xor ebp, dword [rdi + rdx*4 + 0x1400]
movzx edx, byte [rax + 9]
xor ebp, dword [rdi + rdx*4 + 0x1800]
movzx edx, byte [rax + 8]
xor ebp, dword [rdi + rdx*4 + 0x1c00]
movzx edx, byte [rax + 7]
xor ebp, dword [rdi + rdx*4 + 0x2000]
movzx edx, byte [rax + 6]
xor ebp, dword [rdi + rdx*4 + 0x2400]
movzx edx, byte [rax + 5]
xor ebp, dword [rdi + rdx*4 + 0x2800]
movzx edx, byte [rax + 4]
xor ebp, dword [rdi + rdx*4 + 0x2c00]
mov edx, ecx
shr edx, 0x18
movzx r8d, byte [rax + 3]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3000]
mov edx, ecx
shr edx, 0x10
and edx, ebx
movzx r8d, byte [rax + 2]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3400]
mov edx, ecx
shr edx, 8
and edx, ebx
movzx r8d, byte [rax + 1]
xor r8d, edx
xor ebp, dword [rdi + r8*4 + 0x3800]
and ecx, ebx
movzx edx, byte [rax]
xor edx, ecx
xor ebp, dword [rdi + rdx*4 + 0x3c00]
mov rcx, rax
mov rdx, r9
mov r8, rsi
call fcn.14000bb8e
mov r9, rdx
mov ecx, ebp
jmp 0x14000b573
xor edx, edx
cmp r9, rdx
je 0x14000b68c
mov r8b, byte [rax + rdx]
xor r8b, cl
movzx r8d, r8b
shr ecx, 8
xor ecx, dword [rdi + r8*4]
inc rdx
jmp 0x14000b670
not ecx
mov eax, ecx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, [0x141b774e0]
mov ecx, 0xf
mov rdx, r9
call fcn.14005ef80
ud2
Function at 0x140014210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x14001426b
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14001426b
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x140014286
cmp eax, 0x42
jne 0x14001426b
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x140014336
cmp byte [r9 + r11], 0x5f
jne 0x140014336
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14001439e
mov rcx, rsi
xor edx, edx
call fcn.14000f920
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.14000f920
test al, al
jne 0x140014431
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400142c2
lea rdx, [0x141b7d53b]
mov r8d, 1
call fcn.1400076a0
test al, al
jne 0x140014431
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14001427a
xor r14d, r14d
lea rbx, [0x141b7d8f0]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400142f4
cmp byte [rax + rcx], 0x45
je 0x140014453
sub r14, 1
jb 0x140014319
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140014319
mov r8d, 2
mov rdx, rbx
call fcn.1400076a0
test al, al
jne 0x140014431
mov rcx, rsi
call fcn.1400111f0
test al, al
jne 0x140014431
mov rax, qword [rsi]
test rax, rax
jne 0x1400142e0
jmp 0x14001427a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x1400143f8
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x140014392
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14001437c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14001436b
add dl, 0xa9
jmp 0x14001437a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1400143f8
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1400143f8
movzx edx, bl
add rax, rdx
jae 0x140014340
jmp 0x1400143f8
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1400143f8
cmp rax, rcx
jae 0x1400143f5
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14001444b
cmp qword [rsi + 0x20], 0
je 0x140014444
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140014210
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14001427c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140014439
lea rax, [0x141b7d8a0]
lea rdx, [0x141b7d8b0]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.1400076a0
test al, al
je 0x140014439
mov dil, 2
jmp 0x14001427a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14001427a
mov dil, 1
xor r8d, r8d
jmp 0x1400143fa
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14001427a
Function at 0x140019d90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x141b80180]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140019e03
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140019e3a
test eax, eax
js 0x140019e14
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140019e2d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x141b801e0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140017e20
mov rcx, rax
call fcn.140017f60
mov ecx, 7
int 0x29
ud2