joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058170
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10, r8
mov rdi, r9
imul r10d, edx
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x1400581ca
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400581b6
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x20]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x20]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x18]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call fcn.1400d9910
add dword [rdi + 0x24], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400582a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400582ab
xor eax, eax
ret
lea r11, [0x14024c7f0]
not ecx
cmp r8d, 8
jb 0x140058381
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400582d0
test r8d, r8d
je 0x1400583ad
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x140058390
not ecx
mov eax, ecx
ret
Function at 0x140059860
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x1400598b0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400598aa
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x1400598e7
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x24]
mov ecx, dword [rcx + 0x20]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x1400598c6
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x18]
lea rcx, [rsp + 0x50]
mov ebp, edi
call fcn.1400d9910
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x24], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x140059908
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x1400598fe
cmp byte [rbx + 0x10], 0
je 0x1400598fe
mov eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x140074450
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x140317e98]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x38], 0
mov rbx, rcx
je 0x140074541
cmp qword [rcx + 0x28], 0
je 0x140074541
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400744b0
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400d76d0
sub rsp, rcx
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x140074541
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
add rcx, 0x280
call fcn.14002d570
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x100]
mov rdx, qword [rbx + 0x28]
lea r8, str.textchanged
mov byte [rsp + 0x30], 1
mov rcx, rax
mov byte [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], 0
call fcn.140037330
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x100]
mov rcx, rax
call fcn.140032c80
test al, al
je 0x140074541
mov rcx, qword [rbx + 0x28]
call fcn.140042680
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400d7670
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x140074f20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400457c0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x290]
test al, al
jne 0x140074f61
cmp qword [rbx + 0x888], 0
je 0x140074f61
mov rcx, qword [rbx + 0xe0]
xor r9d, r9d
mov r8b, 1
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400376d0
add rsp, 0x20
pop rbx
ret

Function at 0x1400750e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400461a0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x290]
test al, al
jne 0x140075121
cmp qword [rbx + 0x888], 0
je 0x140075121
mov rcx, qword [rbx + 0xe0]
xor r9d, r9d
mov r8b, 1
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400376d0
add rsp, 0x20
pop rbx
ret
Function at 0x1400830c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, edx
mov ecx, edx
and r10d, 7
je 0x140083126
mov r8d, dword [rbx + 0x14]
cmp edx, r10d
jge 0x140083114
mov r9, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r9
jb 0x1400830f0
xor cl, cl
jmp 0x1400830f9
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
mov ecx, edx
shl eax, cl
add edx, 8
or eax, r8d
mov dword [rbx + 0x10], edx
mov dword [rbx + 0x14], eax
mov r8d, eax
cmp edx, 0x18
jle 0x1400830e4
mov ecx, r10d
shr r8d, cl
sub edx, r10d
mov dword [rbx + 0x14], r8d
mov dword [rbx + 0x10], edx
mov ecx, edx
xor r9d, r9d
test edx, edx
jle 0x14008315e
mov edx, dword [rbx + 0x14]
lea r8, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rbx + 0x14]
inc r9d
shr edx, 8
sub ecx, 8
mov byte [r8], al
lea r8, [r8 + 1]
mov dword [rbx + 0x14], edx
test ecx, ecx
jg 0x140083140
mov dword [rbx + 0x10], ecx
movsxd rcx, r9d
cmp rcx, 4
jge 0x140083192
mov r8, qword [rbx + 8]
nop dword [rax + rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14008317c
xor dl, dl
jmp 0x140083185
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x140083170
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
je 0x1400831d5
lea rax, str.zlib_corrupt
mov qword [0x140320670], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x140083204
lea rax, str.read_past_buffer
mov qword [0x140320670], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x14008321e
mov rcx, rbx
call fcn.1400869f0
test eax, eax
je 0x1400831f7
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.1400d9910
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400881a0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x30
mov r15d, r8d
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1400881d4
mov dword [rsp + 0x20], edx
xor r9d, r9d
lea edx, [rsi + 2]
xor r8d, r8d
call fcn.14008afd0
xor al, al
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
mov qword [rsp + 0x58], rbp
call fcn.140087580
xor edx, edx
mov qword [rdi + 8], 0xffffffffffffffff
mov rcx, rsi
lea r8d, [rdx + 2]
call fcn.1400ec4a8
mov rcx, rsi
call fcn.1400eca00
xor r8d, r8d
movsxd rbp, eax
xor edx, edx
mov rcx, rsi
call fcn.1400ec4a8
test ebp, ebp
jg 0x14008823a
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0xc]
call fcn.14008afd0
mov rbp, qword [rsp + 0x58]
xor al, al
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
lea eax, [rbp + 1]
mov qword [rsp + 0x50], rbx
movsxd rcx, eax
mov qword [rsp + 0x60], r14
call fcn.1400d7860
mov r9, rsi
mov r8d, 1
mov rdx, rbp
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.1400ec198
mov rcx, rbx
cmp rax, 1
je 0x140088295
call fcn.1400d7558
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 2]
call fcn.14008afd0
xor al, al
jmp 0x1400882ed
mov byte [rbp + rbx], 0
mov rax, rbx
movzx edx, byte [rbx]
test dl, dl
je 0x1400882c9
inc rax
lea r8, [rcx + 1]
cmp dl, 0xd
jne 0x1400882bd
mov byte [rcx], 0xa
cmp byte [rax], 0xa
jne 0x1400882bf
inc rax
jmp 0x1400882bf
mov byte [rcx], dl
movzx edx, byte [rax]
mov rcx, r8
test dl, dl
jne 0x1400882a4
mov byte [rcx], 0
mov r9d, r15d
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x10]
mov rcx, rbx
call fcn.1400d7558
cmp byte [rdi + 0x68], 0
sete al
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x140097de0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x140097b1b
movzx ecx, byte [rbx]
call fcn.1400a4860
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140097b00
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140097e16
call fcn.140098160
test al, al
jne 0x140097e16
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400980b0
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x140097ae0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400a1b30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x728], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1400a1b8e
mov dl, 1
call fcn.1400942b0
mov rax, qword [rdi + 0x680]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x728]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1400942b0
mov eax, ebx
jmp 0x1400a1bdb
mov edx, ebx
test ebx, ebx
je 0x1400a1b9e
sub edx, 1
je 0x1400a1b9e
cmp edx, 1
jne 0x1400a1bd9
mov r9, qword [rdi + 0x678]
lea rax, [0x14025c590]
mov edx, 2
lea rcx, [rbx + rbx*2]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.1400ecc58
mov r9, qword [rdi + 0x678]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.1400ecc58
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400a4010
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
mov rbx, rdx
mov rcx, r8
call fcn.1400a4090
mov r8d, eax
mov rdx, rbx
mov ecx, edi
call fcn.1400f86c8
mov rbx, qword [rsp + 0x30]
cdqe
add rsp, 0x20
pop rdi
ret
Function at 0x1400b2a80
Capabilities:
Encode data using xor

Disassembly:
push r14
push r15
sub rsp, 0x1f8
mov rax, qword [0x140317e98]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp byte [0x140320a40], 0
mov r14, rcx
jne 0x1400b2ab9
call fcn.1400b5bf0
test al, al
je 0x1400b2ad7
mov byte [0x140320a40], 1
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400d7670
add rsp, 0x1f8
pop r15
pop r14
ret
mov rcx, qword [r14 + 0xcf8]
test rcx, rcx
je 0x1400b2af6
mov edx, 0x400
call fcn.14015e9b0
call fcn.1400b5bf0
test al, al
jne 0x1400b2ab9
mov qword [rsp + 0x218], rbx
xor r15d, r15d
mov qword [rsp + 0x220], rbp
mov qword [rsp + 0x228], rsi
mov qword [rsp + 0x1f0], rdi
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x1d0], xmm7
movsd xmm7, qword [0x140260520]
nop dword [rax]
nop word [rax + rax]
mov rsi, r15
lea rbp, [rsp + 0x80]
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.1400a4f60
mov ecx, 1
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x20], xmm6
call fcn.1400a1ae0
lea rcx, [rsp + 0x40]
lea rdi, [rsi + 3]
call fcn.1400a4f60
lea rcx, [rsp + 0x50]
movsxd rbx, dword [rax + 8]
call fcn.1400a4f60
mov rdx, rbx
lea rcx, [rdi - 2]
add rdx, qword [rax]
movq rax, xmm6
imul rdx, rdi
imul rcx, rax
shl rdx, 8
xor rdx, rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
call fcn.1400a4f60
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.1400a4f60
mov ecx, dword [rbx + 8]
lea rbp, [rbp + 0x10]
add ecx, dword [rax]
lea eax, [rsi + 4]
imul ecx, eax
lea eax, [rsi + 2]
imul eax, dword [rsp + 0x28]
inc rsi
shl ecx, 0x10
xor ecx, eax
mov dword [rsp + 0x28], ecx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbp - 0x10], xmm0
cmp rsi, 4
jb 0x1400b2b50
movaps xmm2, xmm7
lea rcx, [rsp + 0x80]
mov edx, 0x40
call fcn.14015d640
call fcn.1400b5bf0
test al, al
je 0x1400b2b40
mov edx, 0x100
mov byte [rsp + 0xc0], r15b
lea rcx, [rsp + 0xc0]
call fcn.14015e740
movaps xmm7, xmmword [rsp + 0x1d0]
movaps xmm6, xmmword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x228]
mov rbp, qword [rsp + 0x220]
mov rbx, qword [rsp + 0x218]
cmp byte [rsp + 0xc0], r15b
je 0x1400b2c8d
mov edx, 0x400
lea rcx, [rsp + 0xc0]
call fcn.14015e9b0
call fcn.1400b5bf0
test al, al
jne 0x1400b2ab9
lea rdx, str.libcurl_is_now_using_a_weak_random_seed__n
mov rcx, r14
call fcn.1400a1d00
call fcn.1400b5bf0
test al, al
mov ecx, 0x23
cmovne ecx, r15d
mov eax, ecx
jmp 0x1400b2abb

Function at 0x1400b7310
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x140317e98]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1400f2804
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1400b7376
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1400b7376
lea rcx, [rsp + 0x20]
call qword [case.0x140098419.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400d7670
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400d7670
add rsp, 0x148
ret
jmp 0x1400b7310
Function at 0x1400b7390
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x140317e98]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.1400f2804
mov byte [rsp + 0x20], 0
test rax, rax
je 0x1400b7376
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x1400b7376
lea rcx, [rsp + 0x20]
call qword [case.0x140098419.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400d7670
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400d7670
add rsp, 0x148
ret
jmp 0x1400b7310

Function at 0x1400d5780
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1400ed01c]
mov rdi, rax
test rax, rax
jne 0x1400d57c2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400d5809
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400d5862
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x1400d5820
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400d58a3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14026648a]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14026648b]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400d5870
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400e1160
Capabilities:
Encode data using xor

Disassembly:
pop rax
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov rcx, 0x963228e
mov rbx, 0x96e5972
xor rcx, rbx
sub rax, rcx
mov rdi, rax
mov rcx, 0x7605c16
mov rdx, 0x7445ede
xor rcx, rdx
add rax, rcx
mov r10, qword [rax]
mov rcx, 0x45d65b6
mov rbx, 0x4659fb6
xor rcx, rbx
add rdi, rcx
mov rcx, rdi
mov rdx, 0x5864687
mov rbx, 0x5842152
xor rdx, rbx
mov r8, 0x40
lea r9, [rbp - 8]
call r10
xor rax, rax
test rax, rax
je 0x1400e11e5
jne 0x1400e11da
jmp 0x1400f97ff
mov cl, byte [rdi + rax]
xor cl, 0x56
mov dl, 0x21
xor cl, dl
mov byte [rdi + rax], cl
inc rax
mov rdx, 0x5864687
mov rbx, 0x5842152
xor rdx, rbx
cmp rax, rdx
jb 0x1400e11e5
jmp rdi
popfq
cli
invalid
sal byte [rbp + 0x64], 0x8b
loopne 0x1400f978b
sal byte [rbp + rbp - 0x7d], 0xf8
add eax, 0xf9e81b75
invalid

Function at 0x1400eb934
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400eb954
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e8a9c
or eax, 0xffffffff
jmp 0x1400eb956
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400f53f0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400f521c
Function at 0x1400fe264
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400fdf8a
call fcn.1400e8b0c
mov dword [rax], 0x16
call fcn.1400de95c
jmp 0x1400fe0d5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400fe0d5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400fe0d5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400fdfb9
lock or dword [rcx + 0x14], 0x10
jmp 0x1400fe0d5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400fdfcd
call fcn.1400fe628
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1400fdfdd
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1400fdfe0
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1400fbf8c
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400f86c8
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1400fe0c3
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400fe071
mov rcx, rbx
call fcn.1400fbf8c
cmp eax, 0xffffffff
je 0x1400fe05c
mov rcx, rbx
call fcn.1400fbf8c
cmp eax, 0xfffffffe
je 0x1400fe05c
mov rcx, rbx
call fcn.1400fbf8c
movsxd rdi, eax
lea r14, [0x140321b50]
mov rcx, rbx
sar rdi, 6
call fcn.1400fbf8c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400fe063
lea rdx, [0x140318360]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400fe071
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1400fe095
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1400fe095
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1400fe095
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1400fe0b3
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1400fe0be
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1400fe0da
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400fdf54
Function at 0x14016ad00
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1400d76d0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140172a70
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1400d76d0
sub rsp, rax
lea rcx, [0x140325040]
add rsp, 0x28
jmp fcn.14016ab60

Function at 0x140188f00
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140188f27
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x140188f10
movzx eax, r9b
ret
Function at 0x1401a2d80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.1400d76d0
sub rsp, rax
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x1401a2dbf
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
lea ecx, [rax - 0x2b]
lea r8d, [rdx - 4]
call fcn.140161b30
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x1401a2dd2
mov dword [rdx], r8d
cmp r9, 1
jne 0x1401a2df4
test r11, r11
je 0x1401a2dea
movzx eax, byte [r10]
test r8d, r8d
je 0x1401a2de8
neg al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov eax, ebx
test cl, cl
jne 0x1401a2e11
mov eax, 1
mov ebx, eax
jmp 0x1401a2ebf
cmp cl, 0xff
jne 0x1401a2efd
mov eax, 1
lea rcx, [r9 - 1]
mov edx, ebx
cmp r9, rax
jbe 0x1401a2eaf
cmp rcx, 8
jb 0x1401a2ea0
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
movd xmm1, dword [rax + r10]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm2, xmm1
movd xmm1, dword [rax + r10 + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x1401a2e43
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x1401a2eaf
nop
movzx ecx, byte [rax + r10]
inc rax
or edx, ecx
cmp rax, r9
jb 0x1401a2ea0
test edx, edx
mov eax, ebx
setne al
test edx, edx
setne bl
test edx, edx
je 0x1401a2efd
movzx ecx, byte [r10 + 1]
and ecx, 0x80
cmp r8d, ecx
jne 0x1401a2efd
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
mov ecx, 0xd
lea r8d, [rdx - 5]
call fcn.140161b30
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov ecx, eax
sub r9, rcx
test r11, r11
je 0x1401a2f51
neg r8d
mov qword [rsp + 0x30], rdi
lea r8, [rbx + r10]
sbb edi, edi
add r8, r9
movzx edi, dil
mov ecx, edi
and ecx, 1
test r9, r9
je 0x1401a2f4c
mov rdx, r8
sub rdx, rbx
sub rdx, r10
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, edi
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x1401a2f30
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rax, r9
add rsp, 0x38
ret