joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030458
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r15, rcx
mov ebp, edx
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov ecx, dword [r11 + 0x30]
mov r10, qword [rax + 8]
mov r12, qword [r11]
movsxd rax, dword [r10 + 0x30]
mov r8d, ecx
mov dword [rsp + 0x80], ecx
cmp eax, ecx
mov r14, rax
cmovl r8d, eax
xor ebx, ebx
mov dword [rsp + 0x88], r8d
imul rbp, rax
cmp eax, ecx
je 0x1400304c2
cmp byte [r12 + 0x10], bl
lea eax, [rbx + 8]
cmovne ebx, eax
mov rdi, rbp
sub rdi, r14
jmp 0x1400305b8
cmp rdi, rbp
jge 0x1400305c0
and qword [rsp + 0x20], 0
movsxd r13, ecx
mov rax, rdi
cqo
idiv r13
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 8]
mov eax, 0x40000000
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x1400305ae
lea r8, [rsp + 0x20]
xor r9d, r9d
mov edx, r10d
mov rcx, r12
call qword [r12 + 0x108]
mov ebx, eax
test eax, eax
jne 0x14003059f
mov rcx, qword [rsp + 0x20]
call fcn.140022a44
mov ebx, eax
test eax, eax
jne 0x14003059f
mov rax, qword [rsp + 0x20]
movsxd r8, dword [rsp + 0x88]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv r14
add rdx, qword [rsp + 0x90]
call fcn.1400c9a1e
mov r11, qword [rsp + 0x20]
mov rax, qword [r11 + 0x10]
mov byte [rax], bl
test rdi, rdi
jne 0x14003059f
cmp dword [rsp + 0x98], edi
jne 0x14003059f
mov rax, qword [r15 + 0x28]
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0x3c]
mov eax, edx
mov byte [rsi + 0x1f], dl
shr eax, 0x18
mov byte [rsi + 0x1c], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0x1d], al
mov eax, edx
shr eax, 8
mov byte [rsi + 0x1e], al
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1400305ae
call fcn.14002242c
mov ecx, dword [rsp + 0x80]
add rdi, r13
test ebx, ebx
je 0x1400304cd
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140091c88
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
lea rax, [rsp + 0x78]
mov r15d, r8d
mov r14, r9
mov qword [rsp + 0x28], rax
lea r8, str.SafenetSafeNetKSPSlots
xor r9d, r9d
mov dword [rsp + 0x20], 0x20119
mov rsi, rcx
call fcn.14000e7cc
xor r12d, r12d
cmp eax, r12d
je 0x140091f20
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x74]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], r12
call fcn.14000ea60
cmp eax, r12d
je 0x140091eff
mov eax, dword [rsp + 0x70]
lea ecx, [r12 + 0x40]
inc eax
mov dword [rsp + 0x70], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [0x1400d1648]
mov rbx, rax
cmp rax, r12
je 0x140091f13
mov edi, r12d
cmp dword [rsp + 0x74], r12d
jbe 0x140091ef4
mov ecx, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x80]
mov dword [rsp + 0x80], ecx
mov qword [rsp + 0x30], r12
mov rcx, rsi
mov r9, rbx
mov r8d, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.14000ef2c
cmp eax, r12d
je 0x140091ee8
lea rcx, str._n_____s_
mov rdx, rbx
call fcn.14000c030
mov rcx, rbx
call fcn.140012dc8
mov rbp, rax
cmp rax, r12
je 0x140091ee8
mov rcx, rax
call qword [0x1400d1480]
lea rcx, [rsp + 0xa0]
mov r13d, eax
call fcn.1400c880e
mov r12d, 0x5b6
lea rcx, [rsp + 0xa0]
mov r8d, r13d
mov rdx, rbp
call fcn.1400c8808
sub r12, 1
jne 0x140091def
lea rcx, [rsp + 0xa0]
call fcn.1400c8802
mov r11, r12
lea ecx, [r12 + 0x10]
lea rax, [0x1400d5f88]
mov al, byte [r11 + rax]
inc r11
xor al, byte [rsp + r11 + 0xf7]
sub rcx, 1
mov byte [rsp + r11 + 0x8f], al
jne 0x140091e1d
lea edx, [rcx + 0x10]
lea rcx, [rsp + 0x90]
xor r8d, r8d
call fcn.140012f68
lea rcx, [0x14010110c]
call fcn.14000c030
mov rdx, qword [rsp + 0x78]
lea r11, [rsp + 0x88]
mov qword [rsp + 0x28], r11
xor r9d, r9d
mov r8, rbx
mov rcx, rsi
mov dword [rsp + 0x20], 0x20019
call fcn.14000e7cc
cmp eax, r12d
je 0x140091ecb
lea rcx, [0x1400d27a8]
call fcn.14000c030
mov rdx, qword [rsp + 0x88]
lea r8, [rsp + 0x90]
mov r9d, r15d
mov rcx, rsi
mov qword [rsp + 0x20], r14
call fcn.140091f44
mov rdx, qword [rsp + 0x88]
mov rcx, rsi
call fcn.14000f310
jmp 0x140091edf
call qword [0x1400d1650]
lea rcx, [0x140101110]
mov edx, eax
call fcn.14000c030
mov rcx, rbp
call qword [0x1400d1638]
inc edi
cmp edi, dword [rsp + 0x74]
jb 0x140091d65
mov rcx, rbx
call qword [0x1400d1638]
jmp 0x140091f13
call qword [0x1400d1650]
lea rcx, str.ERROR_kuhl_m_dpapi_safenet_ksp_registryparser___kull_m_registry_RegQueryInfoKey__0x_08x__n
mov edx, eax
call fcn.14000c030
mov rdx, qword [rsp + 0x78]
mov rcx, rsi
call fcn.14000f310
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14009280c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rbp, rdx
mov esi, ecx
call fcn.140092a8c
mov r11, qword [rbp]
lea r8, [rsp + 0x40]
lea rdx, str.server
mov rcx, rbp
call qword [r11 + pe_nt_image_headers64]
test eax, eax
jne 0x14009295a
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14009295a
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x40]
test eax, eax
jne 0x14009295a
xor ebx, ebx
cmp dword [rsp + 0x20], ebx
jle 0x14009295a
mov rbp, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x28]
mov edx, ebx
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
jne 0x140092946
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140092946
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
call qword [rax + 0x50]
test eax, eax
jne 0x14009293b
cmp dword [rsp + 0x38], 1
jne 0x14009293b
mov rcx, qword [rsp + 0x28]
lea r8, [rsp + 0x50]
lea rdx, str.properties
mov rax, qword [rcx]
call qword [rax + 0x128]
test eax, eax
jne 0x140092923
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140092923
lea rdx, str.name
call fcn.140014904
mov rdi, rax
test rax, rax
je 0x140092923
lea edx, [rsi + rsi]
lea r8, [0x1400e17cc]
lea rcx, str._s__s_n
mov r9, rax
call fcn.14000c030
mov rcx, rdi
call qword [0x1400d1638]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x28]
lea ecx, [rsi + 1]
mov r9, rbp
call fcn.140092a8c
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
inc ebx
cmp ebx, dword [rsp + 0x20]
jl 0x140092887
mov rbp, qword [rsp + 0x88]
mov rax, qword [rbp]
lea r8, [rsp + 0x48]
lea rdx, str.group
mov rcx, rbp
call qword [rax + pe_nt_image_headers64]
test eax, eax
jne 0x140092a7c
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140092a7c
mov rax, qword [rcx]
lea rdx, [rsp + 0x24]
call qword [rax + 0x40]
test eax, eax
jne 0x140092a7c
xor ebx, ebx
cmp dword [rsp + 0x24], ebx
jle 0x140092a7c
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x30]
mov edx, ebx
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
jne 0x140092a70
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140092a70
mov rax, qword [rcx]
lea rdx, [rsp + 0x3c]
call qword [rax + 0x50]
test eax, eax
jne 0x140092a65
cmp dword [rsp + 0x3c], 1
jne 0x140092a65
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
lea rdx, str.properties
mov rax, qword [rcx]
call qword [rax + 0x128]
test eax, eax
jne 0x140092a48
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140092a48
lea rdx, str.name
call fcn.140014904
mov rdi, rax
test rax, rax
je 0x140092a48
lea edx, [rsi + rsi]
lea r8, [0x1400e17cc]
lea rcx, str._s__s__n
mov r9, rax
call fcn.14000c030
mov rcx, rdi
call qword [0x1400d1638]
mov r9, qword [rsp + 0x98]
mov r8d, dword [rsp + 0x90]
mov rdx, qword [rsp + 0x30]
lea ecx, [rsi + 1]
call fcn.14009280c
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
inc ebx
cmp ebx, dword [rsp + 0x24]
jl 0x1400929a8
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400be7fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call qword [0x1400d1578]
xor esi, esi
lea r9, [rsp + 0x60]
mov rdx, rbx
mov dword [rsp + 0x30], esi
mov r8, rax
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 4
call qword [0x1400d1568]
cmp eax, esi
je 0x1400be950
mov rcx, qword [rsp + 0x60]
lea edx, [rsi + 4]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0x61c
call qword [0x1400d14d8]
mov rdi, rax
cmp rax, rsi
je 0x1400be92f
lea ecx, [rsi + 0x40]
mov edx, 0x610
call qword [0x1400d1648]
mov rbx, rax
cmp rax, rsi
je 0x1400be924
lea rdx, [rdi + 0xc]
mov rcx, rax
mov r8d, 0x610
call fcn.1400c9a1e
lea r8d, [rsi + 1]
mov edx, 0x610
mov rcx, rbx
call fcn.1400c861a
cmp eax, esi
jl 0x1400be90d
mov eax, dword [rbx + 0x400]
lea rdx, [rbx + 0x404]
cmp eax, esi
jbe 0x1400be8df
mov r8, rdx
mov r9, rax
mov cl, byte [r8]
mov al, cl
xor al, sil
mov sil, cl
xor al, 0x43
mov byte [r8], al
inc r8
sub r9, 1
jne 0x1400be8c6
mov eax, dword [rbx + 0x604]
mov r9d, dword [rbx + 0x400]
lea r8, [rbx + 0x200]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rcx, str._Username__:__s_n_Domain____:__s_n_Password__:__.s_n_flags_type:_0x_08x_n
mov rdx, rbx
call fcn.14000c030
jmp 0x1400be91b
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___RtlDecryptMemory:_0x_08x_n
mov edx, eax
call fcn.14000c030
mov rcx, rbx
call qword [0x1400d1638]
mov rcx, rdi
call qword [0x1400d14d0]
jmp 0x1400be943
call qword [0x1400d1650]
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___MapViewOfFile__0x_08x__n
mov edx, eax
call fcn.14000c030
mov rcx, qword [rsp + 0x60]
call qword [0x1400d1640]
jmp 0x1400be964
call qword [0x1400d1650]
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___DuplicateHandle__0x_08x__n
mov edx, eax
call fcn.14000c030
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ce128
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1400ce175
cmp rcx, 0xffffffffffffffff
je 0x1400ce175
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400ce16d
cmp dword [rcx + 0x3c], edx
jl 0x1400ce16d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400ce16d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400ce175
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180092b96
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
ret
mov eax, 0x5a4d
stc
cmp word [rcx], ax
jne 0x18008fb14
movsxd rax, dword [rcx + 0x3c]
cmp r8b, cl
add rax, rcx
clc
cmp dword [rax], 0x4550
jne 0x18008fb14
mov ecx, 0x20b
clc
cmp word [rax + 0x18], cx
jmp 0x1800943ef
jne 0x18008fb14
mov eax, 1
ret

Function at 0x180092ef8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
movsx edx, r12w
cmovne edx, edi
lea edx, [r8 + 2]
jmp 0x180096350
jmp 0x180139b6c

Function at 0x180092f50
Capabilities:
Parse pe header

Disassembly:
jmp 0x180139b6c
sub edx, edx
test dil, 0xe6
bswap r8w
sub ecx, ecx
lea r8d, [rdx + 1]
jmp 0x180090d8d
mov dword [rsp + 0x18], r8d
test r15w, 0x4f84
clc
mov dword [rsp + 0x10], edx
test r12b, r15b
test r9w, 0x4557
push rbp
rcl bpl, cl
bswap rbp
xor bpl, cl
mov rbp, rsp
test spl, dl
test ch, 0xab
cmp dil, r11b
sub rsp, 0x50
jmp 0x180139ba4
mov qword [rbp - 0x20], 0xfffffffffffffffe
cmc
mov qword [rsp + 0x60], rbx
movsx rbx, r12w
mov ebx, ecx
test r8d, r8d
jmp 0x180139bc0
jne 0x180139c4e
xor ecx, ecx
jmp 0x180139bcd
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180139c4e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180139c4e
movsxd rcx, dword [rax + 0x3c]
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jmp 0x180139bfd
jne 0x180139c4e
mov eax, 0x20b
cmp dil, 0xb9
cmp r14b, r8b
cmp word [rcx + 0x18], ax
jmp 0x180139c18
jne 0x180139c4e
cmp dword [rcx + 0x84], 0xe
jmp 0x180139c2a
jbe 0x180139c4e
cmp dword [rcx + 0xf8], 0
jmp 0x180139c3c
je 0x180139c4e
mov ecx, ebx
jmp 0x180139c49
call fcn.180139da1
mov byte [rbp + 0x28], 0
mov r8w, dx
jmp 0x180139c5b
lea rax, [rbp + 0x18]
bswap r9w
cdq
movsx ecx, di
mov qword [rbp - 0x18], rax
cdq
cwd
lea rax, [rbp + 0x20]
movsx dx, bpl
movzx r8w, r14b
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
movzx r9w, spl
jmp 0x180139c8e
mov qword [rbp - 8], rax
setle r8b
cwd
movsx eax, r8w
mov eax, 2
cdq
setle r8b
mov dword [rbp - 0x2c], eax
movsxd r8, edx
mov dword [rbp - 0x28], eax
xchg r8b, r9b
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
mov dl, r10b
cwd
lea rdx, [rbp - 0x28]
mov cl, 0x21
seta ch
jmp 0x180139ccd
lea rcx, [rbp - 0x30]
jmp 0x180139cd6
call fcn.180139963
nop
test r9d, r8d
cmp dword [rbp + 0x20], 0
je 0x180139cfd
mov rbx, qword [rsp + 0x60]
xadd bpl, bpl
add rsp, 0x50
pop rbp
jmp 0x180139cfc
ret
mov ecx, ebx
call fcn.180139d0a
int3

Function at 0x180096607
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, qword [rdx]
jmp 0x18009a461
jmp fcn.18013227b
Function at 0x180097ff1
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x180094bae
mov ecx, dword [rax + 8]
clc
add ecx, edx
stc
cmp r10, rcx
jmp 0x180094ba8
cmp r10, rdx
jmp 0x18008fb48
jb 0x18009a230
inc r9d
stc
add rax, 0x28
clc
cmp si, 0x77ee
test rdx, rax
cmp r9d, r11d
jmp 0x180099975
movsxd r8, dword [rcx + 0x3c]
sbb r10w, r10w
sub r11b, 0x73
mov r10w, si
sub r9d, r9d
bts eax, r8d
lea r8, [r8 + rcx]
movzx r10w, r14b
sar r10b, 0xee
btr ax, r14w
mov r10, rdx
movzx eax, word [r8 + 0x14]
movsx r11w, dl
movzx r11d, word [r8 + 6]
clc
test r9w, sp
add rax, 0x18
clc
test di, 0x69a
lea rax, [rax + r8]
cmc
stc
test r11d, r11d
je 0x18009997b
mov edx, dword [rax + 0xc]
jmp 0x18008ff0f
jb 0x18009804a
xor eax, eax
jmp 0x18009a230
ret
Function at 0x18012d129
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
mov rcx, 0x455103da
setl cl
lea rcx, [rsp + 0x30]
jmp 0x18012d141
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
clc
jmp 0x18012d152
add rsp, 0x28
ret

Function at 0x18012e2af
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
sbb rax, r8
mov eax, 0x5a4d
test r8b, 0xb7
cmp word [0x180000000], ax
jmp 0x18012e2ce
jne 0x18012e3d9
movsxd rcx, dword [0x18000003c]
bts rdx, rdx
add dh, 0x5a
lea rdx, [0x180000000]
cmc
add rcx, rdx
cmp dword [rcx], 0x4550
jmp 0x18012e2f8
jne 0x18012e3d9
mov eax, 0x20b
clc
cmc
cmp word [rcx + 0x18], ax
jmp 0x18012e30e
jne 0x18012e3d9
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
cmp esi, r12d
shrd r9w, r11w, 0xe2
add rdx, rax
and r9d, 0x7ed75eea
movzx eax, word [rcx + 6]
shld ecx, r9d, 0x70
mov r9b, bl
setno r9b
lea rcx, [rax + rax*4]
adc r9w, 0x2a58
ror r9b, 0x46
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
jmp 0x18012e360
je 0x18012e39c
mov ecx, dword [rdx + 0xc]
test r12b, 0x77
cmp r8, rcx
jmp 0x18012e375
jb 0x18012e38e
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jmp 0x18012e388
jb 0x18012e3a2
add rdx, 0x28
jmp 0x18012e397
jmp 0x18012e354
xor edx, edx
cmp r13b, 0xf7
test rdx, rdx
jmp 0x18012e3aa
jne 0x18012e3bc
xor al, al
jmp 0x18012e3b7
jmp 0x18012e3e8
cmp dword [rdx + 0x24], 0
jge 0x18012e3d2
xor al, al
jmp 0x18012e3cd
jmp 0x18012e3e8
mov al, 1
jmp 0x18012e3e8
sub al, al
jmp 0x18012e3e0
jmp 0x18012e3e8
add rsp, 0x18
ret
Function at 0x180130211
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
bsr rbx, rbx
sal ebx, cl
mov qword [rsp + 0x10], rbp
movzx bx, bpl
mov qword [rsp + 0x18], rsi
not bl
push rdi
mov bpl, 0x6f
not dil
push r12
test dil, 0x64
mov edi, r9d
push r13
clc
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rsp + 0x90]
jmp 0x180130255
mov r12, rdx
mov rbp, rcx
mov rdx, r9
mov rcx, rbx
movsx r15d, ax
xchg r15d, r14d
movsxd r14, r8d
mov rdi, r9
movzx r14, r11w
mov r15d, r8d
mov r14d, dword [rbx + 0xc]
jmp 0x18013027e
call fcn.18009a1f0
sub r10d, r10d
bsf rsi, rbp
btc rsi, r9
cmp sil, 0x9b
mov esi, eax
jmp 0x18013029a
test r14d, r14d
jmp 0x1801302a2
je 0x1801304e0
mov r8, qword [rdi + 8]
movzx r13w, r13b
or eax, 0xffffffff
movsx edx, r11w
btc dx, 0xaf
cmp dil, bpl
movsxd r11, dword [rbx + 0x10]
movsx cx, r9b
adc bx, dx
sar r13, 0xbc
mov r9d, eax
mov edx, r10d
mov r13d, eax
mov edx, r14d
lea ebx, [rdx - 1]
rol ecx, cl
dec al
add cl, 0x2e
lea rcx, [rbx + rbx*4]
dec al
cdqe
neg al
lea rax, [r8 + rcx*4]
cmp r9b, dil
cmc
cmp rax, 0x152c0d42
cmp esi, dword [rax + r11 + 4]
jle 0x180130315
cmp esi, dword [rax + r11 + 8]
jle 0x180130338
mov edx, ebx
sal eax, cl
xor al, 0xeb
mov eax, ebx
clc
test ebx, ebx
jmp 0x180130325
jne 0x1801302dc
test eax, eax
jmp 0x180130332
je 0x180130358
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
movsx edx, bx
lea rdx, [r11 + rax*4]
jmp 0x18013034b
add rdx, r8
jmp 0x180130353
jmp 0x180130368
mov rdx, r10
movzx cx, dil
btc cx, di
rcr rcx, 0x67
lea rcx, [r8 + r11]
shrd r8w, si, 0x9e
sbb r8d, esp
mov r8d, r10d
stc
test sp, r11w
or r11d, 0xffffffff
test eax, 0x1a464788
test r12b, r14b
test rdx, rdx
jmp 0x180130391
je 0x1801303b6
mov eax, dword [rdx + 4]
cmp r14w, si
cmp dword [rcx], eax
jle 0x180130403
mov eax, dword [rdx + 8]
test spl, 0xae
cmp dword [rcx + 4], eax
jg 0x180130403
cmp r15d, dword [rcx]
jmp 0x1801303be
jl 0x180130403
cmp r15d, dword [rcx + 4]
jmp 0x1801303cd
jg 0x180130403
cmp r9d, r11d
bswap r13w
cmova r13w, sp
cdqe
mov eax, r8d
movzx r13, r8w
mov r13d, r8d
jmp 0x1801303f0
cmovne eax, r9d
setnp r9b
dec r9b
mov r9d, eax
jmp 0x180130403
inc r8d
add rcx, 0x14
test r12b, 0xf9
cmp r8d, r14d
jmp 0x180130416
jb 0x180130389
cmp r9d, r11d
mov qword [rsp + 0x20], r12
mov eax, r10d
bswap bx
mov qword [rsp + 0x30], r12
cmovne eax, r9d
movzx r11, r12w
lea r11, [rsp + 0x40]
cmovp r14d, ebp
movsx edi, di
movzx esi, bp
mov rbx, qword [r11 + 0x30]
movsxd rdi, r9d
mov rsi, qword [r11 + 0x40]
movsxd r14, r11d
movzx r15w, r9b
mov r14w, 0x65d3
mov dword [rsp + 0x28], eax
movsx r15, r8w
mov eax, 0x570f42f8
lea eax, [r13 + 1]
movsx r12, r12w
movups xmm0, xmmword [rsp + 0x20]
cmovne r10d, eax
movsx di, r13b
mov rax, rbp
movzx r13w, sil
movsx r15w, al
mov dword [rsp + 0x38], r10d
movsx edi, si
xchg r12b, r13b
movzx r12, ax
movups xmm1, xmmword [rsp + 0x30]
movdqu xmmword [rbp], xmm0
movsxd r14, eax
movdqu xmmword [rbp + 0x10], xmm1
movzx r15, si
mov rbp, qword [r11 + 0x38]
movzx r13w, r14b
mov rsp, r11
bswap r14
pop r15
seto r12b
pop r14
bswap r13d
pop r13
movzx r12, r11w
movsx r12d, cx
pop r12
pop rdi
jmp 0x1801304df
ret
call fcn.18013b754
int3
Function at 0x18013227b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
or r10b, dl
bsr r10, r10
bswap r10d
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
sar bx, 0x7c
bts bx, ax
bt r10, r15
cmp dword [rcx + 0x10], 0
movzx rbx, r8w
setnp bl
bswap ebx
mov rbx, r8
not r10
mov r10, rdx
jmp 0x1801322bf
je 0x180132421
movsxd r9, dword [rcx + 0x10]
lea r14, [0x180000000]
mov rdi, qword [rdx + 8]
mov ch, 0x5c
neg cx
ror ah, cl
sub esi, esi
lea r9, [r9 + rdi]
movsx ecx, r15w
or edx, 0xffffffff
sub r8d, r8d
cmc
movsx rax, bx
movzx ecx, byte [r9]
and eax, 0x11b423d7
adc al, r15b
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0x728a0]
mov cl, byte [rcx + r14 + 0x728b0]
movsx r11d, dx
sub r9, rax
dec r11b
cmp r14, r14
movzx r11d, r9w
mov r11d, dword [r9 - 4]
cmp r9d, 0xd4227ff
jmp 0x180132332
shr r11d, cl
clc
test r11d, r11d
jmp 0x18013233e
je 0x180132421
mov rax, qword [r10 + 0x10]
xor cx, cx
rol ch, cl
mov r10d, dword [rax]
sbb ah, 0x9a
btc eax, 0x79
cdqe
movzx ecx, byte [r9]
and ecx, 0xf
bswap eax
xor ah, bl
movsx rax, byte [rcx + r14 + 0x728a0]
clc
mov cl, byte [rcx + r14 + 0x728b0]
sub r9, rax
movzx eax, bp
sbb ax, 0x2272
mov eax, dword [r9 - 4]
shr eax, cl
add esi, eax
adc ax, r13w
cmp r14w, 0x7e23
mov eax, esi
lea rax, [rax + r10]
clc
cmc
jmp 0x18013239f
add rax, rdi
test al, r12b
stc
jmp 0x1801323ab
cmp rbx, rax
jmp 0x1801323b3
jb 0x18013240c
movzx ecx, byte [r9]
inc r8d
stc
cqo
rcr rdx, cl
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0x728a0]
movzx rdx, si
btc edx, 0x77
shld dx, r14w, 0xdb
mov cl, byte [rcx + r14 + 0x728b0]
sub r9, rax
and dl, dil
mov edx, dword [r9 - 4]
test bx, 0x6fe5
shr edx, cl
dec edx
test ch, 0x6e
cmp r8d, r11d
jmp 0x180132406
jb 0x180132359
test r8d, r8d
jmp 0x180132414
je 0x180132421
mov eax, edx
jmp 0x180132428
or eax, 0xffffffff
movzx ebx, r13w
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
setge dil
mov rdi, qword [rsp + 0x18]
not r14b
mov r14, qword [rsp + 0x20]
jmp 0x180132448
ret
Function at 0x180137cad
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
rcr r8, cl
and r8w, si
or dh, 0xcd
sub rsp, 0x20
movsx ebx, di
shl r8b, 0x8f
mov rbx, rcx
ror r9w, 0xd8
clc
lea r9, [0x1800738b0]
bsf dx, sp
bts r8w, dx
bswap r8d
xor ecx, ecx
lea r8, [0x1800738a8]
xchg dx, dx
movsx edx, r14w
lea rdx, [0x180072420]
jmp 0x180137cfc
call fcn.180137a06
test rax, rax
jmp 0x180137d09
je 0x180137d26
mov rcx, rbx
or bl, 0xe9
add rsp, 0x20
pop rbx
jmp 0x180137d1f
push qword [0x180072288]
ret
add rsp, 0x20
movsx ebx, r10w
jmp 0x180137d33
pop rbx
jmp 0x180137d39
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x180137dc0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
movsx r8d, r14w
cmovs r8w, r14w
mov ebx, ecx
cwd
setl r9b
movsxd r8, esp
lea r9, [0x1800738c0]
mov ecx, 2
lea r8, [0x1800738b8]
movsx rdx, di
xchg dl, dl
lea rdx, [0x180072438]
jmp 0x180137dff
call fcn.180137a06
mov ecx, ebx
test sil, dil
test rax, rax
jmp 0x180137e11
je 0x180137e34
add rsp, 0x20
jmp 0x180137e27
pop rbx
jmp 0x180137e2d
push qword [0x180072288]
ret
add rsp, 0x20
movsx bx, sil
movzx rbx, r15w
not ebx
pop rbx
jmp 0x180137e49
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x180137e50
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
btr r8, 0x8f
bts r8d, esp
setae bl
push rdi
sub rsp, 0x20
setnp r8b
xchg r9w, bx
bswap bx
mov rbx, rdx
cdq
setbe dil
xchg dil, dl
lea r9, [0x1800738c8]
mov edi, ecx
setle r8b
movzx rdx, r9w
movsx cx, r9b
lea rdx, [0x180072448]
mov ecx, 3
lea r8, [0x1800738c0]
call fcn.180137a06
mov rdx, rbx
sub rcx, r9
neg ch
rol cx, cl
mov ecx, edi
test rax, rax
jmp 0x180137ebf
je 0x180137ed0
call qword [0x180072288]
jmp 0x180137ed6
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
btc rdi, rsp
add rsp, 0x20
bswap di
movzx edi, r10w
setbe dil
pop rdi
jmp 0x180137ef4
ret