joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016b00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140016bd3
cmp byte [rcx + 0x71], 0
je 0x140016bd3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140016bcf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140016b94
sub eax, 1
je 0x140016b98
cmp eax, 2
jne 0x140016bcf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140017400
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140016bc6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140016bcf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140016b7c
xor al, al
jmp 0x140016b7c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140017400
add rsp, 0x60
pop rbx
ret

Function at 0x140017090
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140017114
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400195d0]
cmp byte [rcx + rax], 0
je 0x140017114
dec r8
sub rdx, 1
jne 0x1400170fa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140017eb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140017f02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017f02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017f02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017f02
cmp dword [rcx + 0x84], 0xe
jbe 0x140017f02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017f04
xor al, al
add rsp, 0x28
ret
Function at 0x140063890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x1402dc010]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm6, dword [0x14028ddb8]
mov rsi, rcx
mov rdx, qword [rcx + 0x68]
movaps xmm2, xmm6
call fcn.140061fa0
mov rax, qword [rsi + 0x18]
movss xmm0, dword [rax + 0x88]
addss xmm0, xmm6
movss dword [rax + 0x88], xmm0
cmp byte [rsi + 0x78], 0
mov rax, qword [rsi + 0x18]
je 0x1400639ed
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rdi
movaps xmmword [rsp + 0x50], xmm7
movss xmm7, dword [0x14028dd58]
movaps xmmword [rsp + 0x40], xmm8
movss xmm8, dword [rax + 0x88]
movaps xmm0, xmm8
addss xmm0, xmm7
movss dword [rax + 0x88], xmm0
mov rbp, qword [rsi + 0x50]
mov rdi, qword [rsi + 0x48]
cmp rdi, rbp
je 0x140063977
mov qword [rsp + 0x88], rbx
nop dword [rax + rax]
mov rbx, qword [rdi]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + reloc.WSOCK32.dll_htonl]
test al, al
je 0x140063966
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test al, al
je 0x140063966
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x48]
add rdi, 8
cmp rdi, rbp
jne 0x140063940
mov rbx, qword [rsp + 0x88]
mov rax, qword [rsi + 0x18]
xorps xmm0, xmm0
mov rcx, qword [rsi + 0x60]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm8
movss xmm6, dword [rax + 0x88]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsi + 0x70]
addss xmm6, xmm7
movss dword [rsp + 0x28], xmm0
lea rdx, [rsp + 0x20]
movss dword [rsp + 0x2c], xmm6
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [rsi + 0x18]
movaps xmm8, xmmword [rsp + 0x40]
mov rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
movss xmm0, dword [rax + 0x88]
addss xmm0, xmm7
addss xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x50]
jmp 0x140063a38
movss xmm2, dword [rax + 0x88]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsi + 0x70]
xorps xmm0, xmm0
movss xmm1, dword [rsi + 0x3c]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm2
movss dword [rsp + 0x28], xmm1
movss dword [rsp + 0x2c], xmm2
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rax, qword [rsi + 0x18]
movss xmm0, dword [rax + 0x88]
addss xmm0, dword [0x14028dd58]
movss dword [rax + 0x88], xmm0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140239760
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rsi
ret
Function at 0x14009e900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1402dc010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rcx + 0xdb8]
movzx esi, dl
mov byte [rcx + 0xeb0], dl
mov rdi, rcx
test dl, dl
je 0x14009e94d
mov rdx, qword [rcx + 0xdd0]
mov rcx, r14
mov rax, qword [r14]
call qword [rax + 0x100]
jmp 0x14009e967
mov rbx, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rbx + 0xf8]
mov rdx, rax
mov rcx, r14
call qword [rbx + 0x100]
mov rcx, qword [rdi + 0xdc0]
movzx edx, sil
xor dl, 1
mov rcx, qword [rcx + 0xc0]
call fcn.140208db0
mov rcx, qword [rdi + 0xe58]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rdi + 0xdf0]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rbp, qword [rdi + 0xe90]
mov rbx, qword [rdi + 0xe88]
cmp rbx, rbp
je 0x14009e9d6
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
add rbx, 8
cmp rbx, rbp
jne 0x14009e9c0
mov rax, qword [rdi + 0xdc0]
movzx edx, sil
mov rcx, qword [rax + 0x80]
mov rbx, qword [rcx + 0x408]
mov rcx, qword [rdi + 0xde8]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
test sil, sil
je 0x14009ea31
mov r8d, 0x101
call qword [rax + 0x18]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rcx, qword [rdi + 0xdb8]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + 0x1e0]
jmp 0x14009ea3a
mov r8d, 0xc0
call qword [rax + 0x18]
cmp byte [rdi + 0xeb0], 0
mov rax, qword [rdi + 0xdc0]
mov rbx, qword [rax + 0x98]
je 0x14009ea76
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xa8]
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
call qword [rax + 0x190]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140239760
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c1330
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402dc010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rdx
cmp qword [rcx + 0x48], 0
je 0x1400c1396
mov r8d, 1
lea rdx, [0x140279c4c]
mov rcx, rbx
call fcn.1400267a0
mov r8d, dword [rbx + 0x10]
inc r8d
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400c1384
mov rdx, qword [rbx]
mov rax, qword [rdi + 0x48]
xor r9d, r9d
mov rcx, qword [rax + 0x10]
call qword [sym.imp.WSOCK32.dll_send]
nop
mov rcx, rbx
call fcn.1400075a0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140239760
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c1ea0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.14023a970
sub rsp, rax
mov rax, qword [0x1402dc010]
xor rax, rsp
mov qword [rbp + 0xf90], rax
mov rbx, rcx
mov word [rcx + 0x11], 0x100
mov byte [rcx + 0x10], 0
cmp dword [rcx + 0x20], 0x14
jae 0x1400c205a
mov qword [rcx + 0x3c], rdx
mov rax, rdx
shr rax, 0x20
movzx ecx, ax
movzx r10d, dl
mov eax, edx
shr eax, 8
movzx r9d, al
mov eax, edx
shr eax, 0x10
movzx r8d, al
shr edx, 0x18
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r10d
lea rcx, str.Trying_to_establish_UDP_Connection_with__d._d._d._d:_d_established_n
call fcn.1400c0f40
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], reloc.WSOCK32.dll_ntohs
mov byte [rsp + 0x30], dil
mov eax, dword [rbx + 0x18]
movups xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x14028e7b0]
movdqa xmmword [rbp - 0x80], xmm1
mov byte [rsp + 0x70], dil
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], edi
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.140007620
mov dword [rsp + 0x6c], reloc.WSOCK32.dll_sendto
mov eax, dword [rbp - 0x80]
add eax, 0x14
mov dword [rsp + 0x68], eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400c1fd0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c1fc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c1fc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140239a54
nop dword [rax]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rcx, [rsp + 0x50]
call fcn.1400c1dc0
mov rdi, qword [rbx + 0x48]
mov esi, dword [rsp + 0x68]
cmp qword [sym.imp.WSOCK32.dll_socket], 0
je 0x1400c2042
mov eax, 2
mov word [rsp + 0x30], ax
mov ecx, dword [rbx + 0x3c]
call qword [sym.imp.WSOCK32.dll_htonl]
mov dword [rsp + 0x34], eax
movzx ecx, word [rbx + 0x40]
call qword [sym.imp.WSOCK32.dll_htons]
mov word [rsp + 0x32], ax
mov dword [rsp + 0x28], reloc.WSOCK32.dll_recv
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, esi
lea rdx, [rbp - 0x70]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.WSOCK32.dll_sendto]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x24], eax
inc dword [rbx + 0x20]
lea rcx, [rsp + 0x70]
call fcn.1400075a0
jmp 0x1400c205f
call fcn.1400c2090
mov rcx, qword [rbp + 0xf90]
xor rcx, rsp
call fcn.140239760
lea r11, [rsp + 0x10a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400c21e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.14023a970
sub rsp, rax
mov rax, qword [0x1402dc010]
xor rax, rsp
mov qword [rsp + 0x1050], rax
cmp byte [rcx + 0x10], 0
mov rbx, rcx
je 0x1400c22db
mov rdi, qword [rdx + 0x10]
cmp rdi, 0xfec
jae 0x1400c22db
mov r8d, dword [rcx + 0x18]
inc r8d
mov byte [rsp + 0x43], 0
mov eax, r8d
mov byte [rsp + 0x42], r8b
sar eax, 0x10
mov byte [rsp + 0x40], al
mov eax, r8d
sar eax, 8
cmp qword [rdx + 0x18], 0x10
mov byte [rsp + 0x41], al
jb 0x1400c2257
mov rdx, qword [rdx]
mov r8, rdi
lea rcx, [rsp + 0x44]
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rbx + 0x48]
add edi, 4
cmp qword [sym.imp.WSOCK32.dll_socket], 0
mov dword [rsp + 0x1040], edi
je 0x1400c22db
mov ecx, dword [rbx + 0x3c]
mov eax, 2
mov word [rsp + 0x30], ax
call qword [sym.imp.WSOCK32.dll_htonl]
movzx ecx, word [rbx + 0x40]
mov dword [rsp + 0x34], eax
call qword [sym.imp.WSOCK32.dll_htons]
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x40]
mov word [rsp + 0x32], ax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], reloc.WSOCK32.dll_recv
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WSOCK32.dll_sendto]
cmp eax, edi
jne 0x1400c22db
mov eax, dword [rsp + 0x1040]
add dword [rbx + 0x38], eax
mov al, 1
jmp 0x1400c22dd
xor al, al
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140239760
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400c3160
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rax, qword [rdx]
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov word [rcx + 0x20], si
mov qword [rcx + 0x28], rsi
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rsi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x50], rsi
mov qword [rcx + 0x58], rsi
mov qword [rcx + 0x60], rsi
mov qword [rcx + 0x68], rsi
mov qword [rcx + 0x70], rsi
mov qword [rcx + 0x78], rsi
mov qword [rcx + 0x80], rsi
add rcx, 0x88
lea edx, [rsi + 2]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
nop
xor eax, eax
mov word [rdi + 0xd8], ax
lea ecx, [rsi + 0x60]
call fcn.140239a18
mov rbx, rax
mov qword [rsp + 0x50], rax
mov dword [rax + 8], 1
lea rax, vtable.ClientConnection_TCP.0
mov qword [rbx], rax
mov dword [rbx + 0x14], 0x9233
mov eax, 0x927f
mov word [rbx + 0x18], ax
mov dword [rbx + 0x24], 0x2dc6c0
xorps xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], reloc.WSOCK32.dll_ntohs
mov byte [rbx + 0x28], sil
mov dword [rbx + 0x50], esi
mov word [rbx + 0x54], si
mov byte [rsp + 0x48], sil
lea ecx, [rsi + 0x18]
call fcn.140239a18
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x48]
movzx edx, word [rbx + 0x18]
mov rcx, rax
call fcn.1400c0fa0
nop
mov qword [rbx + 0x48], rax
cmp byte [rsp + 0x48], sil
je 0x1400c326f
test rax, rax
je 0x1400c328f
mov rcx, qword [rax]
mov r8, qword [rcx]
lea edx, [rsi + 1]
mov rcx, rax
call r8
jmp 0x1400c328f
mov word [rbx + 0x11], 0
mov byte [rbx + 0x13], 0
mov byte [rbx + 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x58], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x5c], eax
mov qword [rdi + 8], rbx
mov byte [rsp + 0x48], 0
mov ecx, 0x18
call fcn.140239a18
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
mov rcx, rax
call fcn.1400c1a90
nop
mov qword [rdi + 0x18], rax
mov eax, esi
xchg byte [rdi + 0xd8], al
xchg byte [rdi + 0xd9], sil
mov rax, rdi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400ffbc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
test edx, edx
je 0x1400ffc00
sub edx, 1
je 0x1400ffbfa
sub edx, 1
je 0x1400ffbf2
sub edx, 1
je 0x1400ffbea
cmp edx, 1
jne 0x1400ffc00
lea r8d, [rdx + 0xf]
jmp 0x1400ffc00
mov r8d, 8
jmp 0x1400ffc00
mov r8d, 4
jmp 0x1400ffc00
mov r8d, 2
mov rcx, qword [rcx + 0x138]
mov edx, r8d
mov rax, qword [rcx]
call qword [rax + 0x140]
mov rcx, qword [rbx + 0x128]
lea rdx, [rbx + 8]
mov rcx, qword [rcx + 0xb8]
add rsp, 0x20
pop rbx
jmp fcn.1400fbaa0

Function at 0x1400ffc30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor bl, bl
mov ebp, edx
mov r14, rcx
mov edi, 0x100
test edx, edx
je 0x1400ffc6e
sub edx, 1
je 0x1400ffc69
cmp edx, 1
jne 0x1400ffc6e
mov edi, 0x400
jmp 0x1400ffc6e
mov edi, 0x200
mov rax, qword [rcx + 0x128]
mov rsi, qword [rax + 0xa8]
mov rcx, rsi
mov rax, qword [rsi]
call qword [rax + 0x60]
mov r15d, 1
mov rcx, rsi
cmp eax, edi
mov rax, qword [rsi]
cmovne ebx, r15d
call qword [rax + 0x68]
movzx ebx, bl
mov edx, edi
cmp eax, edi
mov rcx, rsi
mov rax, qword [rsi]
cmovne ebx, r15d
call qword [rax + 0x78]
mov rax, qword [rsi]
mov edx, edi
mov rcx, rsi
call qword [rax + 0x80]
test ebp, ebp
je 0x1400ffcd8
sub ebp, r15d
je 0x1400ffcd1
cmp ebp, r15d
jne 0x1400ffcdd
mov edi, 0x800
jmp 0x1400ffcdd
mov edi, 0x5e8
jmp 0x1400ffcdd
mov edi, 0x400
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x70]
mov edx, edi
mov rcx, rsi
cmp eax, edi
mov rax, qword [rsi]
je 0x1400ffcfa
call qword [rax + 0x88]
jmp 0x1400ffd04
call qword [rax + 0x88]
test bl, bl
je 0x1400ffd10
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0xa8]
mov rcx, qword [r14 + 0x128]
lea rdx, [r14 + 8]
mov rcx, qword [rcx + 0xb8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.1400fbaa0

Function at 0x1400ffd40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rbx, rcx
movss xmm6, dword [0x14028e2d0]
test edx, edx
je 0x1400ffd87
sub edx, 1
je 0x1400ffd7d
sub edx, 1
je 0x1400ffd73
cmp edx, 1
jne 0x1400ffd8f
movss xmm6, dword [0x14028e2cc]
jmp 0x1400ffd8f
movss xmm6, dword [0x14028e2c8]
jmp 0x1400ffd8f
movss xmm6, dword [0x14028e2c4]
jmp 0x1400ffd8f
movss xmm6, dword [0x14028e2c0]
mov rax, qword [rcx + 0x128]
mov rcx, qword [rax + 0x150]
movss dword [rax + 0x4bc], xmm6
test rcx, rcx
je 0x1400ffdb7
movaps xmm2, xmm6
mov edx, 1
call fcn.140211400
mov rax, qword [rbx + 0x128]
mov rcx, qword [rax + 0x150]
movss dword [rax + 0x4c0], xmm6
test rcx, rcx
je 0x1400ffddf
movaps xmm2, xmm6
mov edx, 2
call fcn.140211400
mov rcx, qword [rbx + 0x128]
lea rdx, [rbx + 8]
mov rcx, qword [rcx + 0xb8]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
jmp fcn.1400fbaa0
Function at 0x1400ffe00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
movss xmm2, dword [0x14028e270]
mov rbx, rcx
test edx, edx
je 0x1400ffe31
sub edx, 1
je 0x1400ffe29
cmp edx, 1
jne 0x1400ffe31
movss xmm2, dword [0x14028e284]
jmp 0x1400ffe31
movss xmm2, dword [0x14028e27c]
mov rax, qword [rcx + 0x128]
mov rcx, qword [rax + 0x150]
movss dword [rax + 0x4c4], xmm2
test rcx, rcx
je 0x1400ffe56
mov edx, 3
call fcn.140211400
mov rcx, qword [rbx + 0x128]
lea rdx, [rbx + 8]
mov rcx, qword [rcx + 0xb8]
add rsp, 0x20
pop rbx
jmp fcn.1400fbaa0
Function at 0x140100150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [rcx + 0x128]
mov rsi, qword [rax + 0x148]
test edx, edx
setne r8b
lea rbx, [rsi + 0x70]
mov rcx, qword [rbx]
test rcx, rcx
setne al
cmp al, r8b
je 0x1401001e5
test edx, edx
je 0x1401001cf
mov ecx, 0xa0
call fcn.140239a18
mov qword [rsp + 0x40], rax
movss xmm2, dword [0x14028dc08]
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call fcn.140009f40
mov rcx, rax
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1401001d6
mov r8, qword [rbx]
mov qword [rbx], rcx
test r8, r8
je 0x1401001e5
mov rax, qword [r8]
mov rcx, r8
jmp 0x1401001de
mov qword [rbx], 0
test rcx, rcx
je 0x1401001e5
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rdx, [rdi + 8]
mov rcx, qword [rdi + 0x128]
mov rcx, qword [rcx + 0xb8]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.1400fbaa0

Function at 0x140100210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [rcx + 0x128]
mov rsi, qword [rax + 0x148]
test edx, edx
setne r8b
lea rbx, [rsi + 0x30]
mov rcx, qword [rbx]
test rcx, rcx
setne al
cmp al, r8b
je 0x14010029d
test edx, edx
je 0x140100287
mov ecx, 0x98
call fcn.140239a18
mov qword [rsp + 0x40], rax
mov rdx, qword [rsi + 0x10]
mov rcx, rax
call fcn.14000e840
mov rcx, rax
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x14010028e
mov r8, qword [rbx]
mov qword [rbx], rcx
test r8, r8
je 0x14010029d
mov rax, qword [r8]
mov rcx, r8
jmp 0x140100296
mov qword [rbx], 0
test rcx, rcx
je 0x14010029d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rdx, [rdi + 8]
mov rcx, qword [rdi + 0x128]
mov rcx, qword [rcx + 0xb8]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.1400fbaa0
Function at 0x140119d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx ebx, dl
mov rdi, rcx
mov edx, ebx
mov byte [rcx + 0x173], bl
call fcn.140114e20
mov rcx, qword [rdi + 0x1c0]
movzx edx, bl
call fcn.140105e30
mov rcx, qword [rdi + 0x188]
movss xmm1, dword [0x14028dde4]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov rcx, qword [rdi + 0x230]
movzx esi, bl
xor sil, 1
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rax, qword [rdi + 0x178]
mov byte [rdi + 0x290], 1
mov rax, qword [rax + 0x148]
mov rcx, qword [rax + 0x90]
test bl, bl
je 0x140119e5b
xor ebx, ebx
mov dword [rcx + 0x78], ebx
mov rcx, qword [rdi + 0x1d8]
mov rax, qword [rdi + 0x1e0]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x140119e6e
mov rcx, qword [rcx + rbx*8]
movzx edx, sil
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rdi + 0x1d8]
inc rbx
mov rax, qword [rdi + 0x1e0]
sub rax, rcx
sar rax, 3
cmp rbx, rax
jb 0x140119e20
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rcx + 0x78], 0x40a00000
movzx edx, sil
mov rcx, rdi
call fcn.140114ab0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14023a374
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14023a3be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14023a3be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14023a3be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14023a3be
cmp dword [rcx + 0x84], 0xe
jbe 0x14023a3be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14023a3c0
xor al, al
add rsp, 0x28
ret
Function at 0x180008cbc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180008cec
xor eax, eax
jmp 0x180008daf
mov rbp, rbx
cmp word [rax], si
je 0x180008d11
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180008cf8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180008cf4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180008bdc
movsxd r14, eax
test eax, eax
jne 0x180008d4f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180008ce5
mov rcx, r14
call fcn.180009f4c
mov rdi, rax
test rax, rax
jne 0x180008d68
xor ecx, ecx
call fcn.180007214
jmp 0x180008d44
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180008bdc
test eax, eax
jne 0x180008d99
mov rcx, rdi
call fcn.180007214
jmp 0x180008da3
xor ecx, ecx
call fcn.180007214
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18000e500
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000e528
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18000e528
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret