joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b8ec
Capabilities:
Check os version
Query environment variable

Disassembly:
push rbx
push rdi
sub rsp, 0xc8
lea rcx, str.APPDATA
mov dword [rsp + 0x20], 0x94
call fcn.0041b330
test rax, rax
mov rdi, rax
je 0x40b9c7
mov rcx, rax
call fcn.00417080
cmp rax, 2
jbe 0x40b9c7
cmp byte [rdi], 0x5c
jne 0x40b9c7
cmp byte [rdi + 1], 0x5c
jne 0x40b9c7
lea rcx, str._Extractor__Roaming_AppData_directory_detected_n
call fcn.0040bc84
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40b9d3
cmp dword [rsp + 0x24], 5
jbe 0x40b97d
lea rcx, str.LOCALAPPDATA
call fcn.0041b330
lea rcx, str._Extractor__Local_AppData_directory_resolved_to__s_n
mov rdx, rax
mov rdi, rax
call fcn.0040bc84
jmp 0x40b9d3
lea rcx, str.USERPROFILE
call fcn.0041b330
mov ecx, 0x1388
mov rbx, rax
call fcn.00416e70
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.00417140
lea rdx, str.Local_Settings
mov rcx, rdi
call fcn.0040bbe4
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.0040bbe4
jmp 0x40b9d3
lea rcx, str._Extractor__Local_AppData_directory_detected_n
call fcn.0040bc84
lea rcx, str.Validating_directory..._n
call fcn.0040bc84
lea rcx, str.Shared_dir_detected_is__s_n
mov rdx, rdi
call fcn.0040bc84
lea rcx, str._Utils__Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040bc84
mov edx, 6
mov rcx, rdi
call fcn.0041d400
test eax, eax
jne 0x40ba89
lea rcx, str.Checking_if_string_is_cAscii__s_n
mov rdx, rdi
call fcn.0040bc84
mov rcx, rdi
xor ebx, ebx
call fcn.00417080
test rax, rax
je 0x40ba43
cmp byte [rbx + rdi], 0x80
jae 0x40ba89
mov rcx, rdi
add rbx, 1
call fcn.00417080
cmp rbx, rax
jb 0x40ba2c
lea rcx, str.Checking_if__s_contains_a___n
mov rdx, rdi
call fcn.0040bc84
mov rcx, rdi
xor ebx, ebx
call fcn.00417080
test rax, rax
je 0x40ba78
cmp byte [rbx + rdi], 0x21
je 0x40ba89
mov rcx, rdi
add rbx, 1
call fcn.00417080
cmp rbx, rax
jb 0x40ba61
lea rcx, str.Shared_directory_appears_valid._n
call fcn.0040bc84
jmp 0x40bb0e
lea rcx, str.The_directory__s_appears_invalid._n
mov rdx, rdi
call fcn.0040bc84
lea rcx, str.Trying_the_short_path_instead._n
mov rdx, rdi
call fcn.0040bc84
mov ecx, 0x1388
call fcn.00416e70
mov r8d, 0x400
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40bafe
lea rcx, str.Got_short_path_of__s_n
mov rdx, rbx
call fcn.0040bc84
lea rcx, str._Utils__Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040bc84
mov edx, 6
mov rcx, rdi
call fcn.0041d400
test eax, eax
jne 0x40bafe
mov rax, rbx
jmp 0x40bb11
mov rcx, rbx
call fcn.00416e30
call fcn.0040b798
mov rdi, rax
mov rax, rdi
add rsp, 0xc8
pop rdi
pop rbx
ret
Function at 0x40df80
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40dfa7
lea rdx, str.._srchashes_sha2_sha256.c
lea rcx, str.md___NULL
mov r8d, 0xd0
call fcn.00410770
xor eax, eax
mov dword [rbx + 0x280], 0x6a09e667
mov dword [rbx + 0x284], 0xbb67ae85
mov dword [rbx + 0x288], 0x3c6ef372
mov dword [rbx + 0x28c], 0xa54ff53a
mov dword [rbx + 0x290], 0x510e527f
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x9b05688c
mov dword [rbx + 0x298], 0x1f83d9ab
mov dword [rbx + 0x29c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret

Function at 0x40e540
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40e565
lea r8d, [rcx + 0x2a]
lea rdx, str.c:users_simplehelpworkspace_runner_nativelibtomlibtomcrypt_srchashes_sha2_sha224.c
lea rcx, str.md___NULL
call fcn.00410770
xor eax, eax
mov dword [rbx + 0x280], 0xc1059ed8
mov dword [rbx + 0x284], 0x367cd507
mov dword [rbx + 0x288], 0x3070dd17
mov dword [rbx + 0x28c], 0xf70e5939
mov dword [rbx + 0x290], 0xffc00b31
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x68581511
mov dword [rbx + 0x298], 0x64f98fa7
mov dword [rbx + 0x29c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret
Function at 0x411bf0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0xc8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
test eax, eax
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
js 0x411d6e
cdq
and edx, 7
add eax, edx
and eax, 7
cmp eax, edx
jne 0x411d6e
cmp r8, 8
mov qword [rsp + 0x38], rbp
jb 0x411c91
xor ebp, ebp
nop
nop
mov eax, dword [rbx + 0xc8]
test eax, eax
je 0x411c91
cdq
add rsi, 1
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
cmp dword [rbx + 0xc8], 0x440
jne 0x411c87
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00411850
mov dword [rbx + 0xc8], ebp
sub rdi, 8
cmp rdi, 8
jae 0x411c40
cmp rdi, 0x440
jb 0x411cde
movabs rax, 0xf0f0f0f0f0f0f0f1
mul rdi
mov rbp, rdx
shr rbp, 0xa
mov rax, rbp
imul rax, rax, 0xfffffffffffffbc0
add rdi, rax
nop
nop
mov r8d, 0x11
mov rdx, rsi
mov rcx, rbx
call fcn.00411850
add rsi, 0x88
sub rbp, 1
jne 0x411cc0
cmp rdi, 8
mov rbp, qword [rsp + 0x38]
jb 0x411d2a
mov r8, rdi
shr r8, 3
mov rax, r8
imul rax, rax, 0xfffffffffffffff8
add rdi, rax
nop
nop
mov eax, dword [rbx + 0xc8]
add rsi, 1
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
sub r8, 1
jne 0x411d00
test rdi, rdi
je 0x411d58
mov eax, dword [rbx + 0xc8]
mov ecx, 8
cdq
sub cl, dil
and edx, 7
add eax, edx
movzx edx, byte [rsi]
sar eax, 3
shr dl, cl
movsxd r8, eax
xor byte [r8 + rbx], dl
add dword [rbx + 0xc8], edi
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x28
ret

Function at 0x417fe0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x418009
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418009
mov ecx, eax
call fcn.00417380
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x418a40
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418a69
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418a69
mov ecx, eax
call fcn.00417380
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x41d400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x41d446
call fcn.00417350
mov dword [rax], 0
call fcn.00417320
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], 0
call fcn.0041f540
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x41d40d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41d477
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417380
call fcn.00417320
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x41d4ab
test al, 1
je 0x41d4ab
test bl, 2
je 0x41d4ab
call fcn.00417350
mov dword [rax], 5
call fcn.00417320
mov dword [rax], 0xd
call fcn.00417320
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x41d4c0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41d4eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d4eb
mov ecx, eax
call fcn.00417380
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x41d500
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x41d529
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d529
mov ecx, eax
call fcn.00417380
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x4299b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004586e8]
jne 0x41dc9a
rol rcx, 0x10
test cx, 0xffff
jne 0x41dc96
repz ret
ror rcx, 0x10
jmp 0x429910
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0045c740]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0045c838]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x429995
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0045c740]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x4299b7
mov rax, qword [rsp + 0x88]
mov qword [0x0045c838], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0045c7d8], rax
mov rax, qword [0x0045c838]
mov qword [0x0045c6b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0045c7c0], rax
mov dword [0x0045c6a0], 0xc0000409
mov dword [0x0045c6a4], 1
mov rax, qword [0x004586e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004586f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0045c738], eax
mov ecx, 1
call fcn.0042a190
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0044ab40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0045c738], 0
jne 0x429a3e
mov ecx, 1
call fcn.0042a190
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x429a60
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0041f6d0
xor ebx, ebx
cmp qword [0x0045cc10], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x429b91
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x429ac3
xor eax, eax
jmp 0x429c71
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x429abc
mov rcx, rax
call fcn.0041f660
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0045cc10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041f660
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0045cc18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041f660
lea rcx, [rsp + 0x30]
mov qword [0x0045cc20], rax
call fcn.004182b0
test eax, eax
je 0x429b47
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f4a0
cmp dword [rsp + 0x30], 2
jne 0x429b91
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041f660
test rax, rax
mov qword [0x0045cc30], rax
je 0x429b91
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041f660
mov qword [0x0045cc28], rax
mov rcx, qword [0x0045cc28]
cmp rcx, rsi
je 0x429c23
cmp qword [0x0045cc30], rsi
je 0x429c23
call fcn.0041f730
call rax
test rax, rax
mov rbp, rax
je 0x429bee
mov rcx, qword [0x0045cc30]
call fcn.0041f730
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x429bee
test byte [rsp + 0x48], 1
jne 0x429c23
lea rcx, [rsp + 0x34]
call fcn.00418300
test eax, eax
je 0x429c10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f4a0
cmp dword [rsp + 0x34], 4
jb 0x429c1d
bts edi, 0x15
jmp 0x429c57
bts edi, 0x12
jmp 0x429c57
mov rcx, qword [0x0045cc18]
cmp rcx, rsi
je 0x429c57
call fcn.0041f730
call rax
test rax, rax
mov rbx, rax
je 0x429c57
mov rcx, qword [0x0045cc20]
cmp rcx, rsi
je 0x429c57
call fcn.0041f730
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0045cc10]
call fcn.0041f730
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x43fdf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, [0x00446160]
mov rbx, rdx
mov r11, rcx
not r8d
cmp rdx, 8
jbe 0x43fef6
mov qword [rsp + 0x10], rdi
test cl, 7
je 0x43fe44
nop word [rax + rax]
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
test r11b, 7
jne 0x43fe20
mov rdi, rbx
and ebx, 7
and rdi, 0xfffffffffffffff8
add rdi, r11
cmp r11, rdi
jae 0x43fef1
nop word [rax + rax]
xor r8d, dword [r11]
mov r10d, dword [r11 + 4]
add r11, 8
mov r9d, r8d
mov eax, r8d
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
cmp r11, rdi
jb 0x43fe60
mov rdi, qword [rsp + 0x10]
test rbx, rbx
je 0x43ff22
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub rbx, 1
jne 0x43ff00
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret

Function at 0x43ff30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
lea r14, [0x00448160]
mov rbx, rdx
mov r11, rcx
not r8
cmp rdx, 4
jbe 0x440017
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
test cl, 3
je 0x43ff85
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
test r11b, 3
jne 0x43ff60
xor esi, esi
mov rcx, rbx
and rcx, 0xfffffffffffffffc
and ebx, 3
lea rdi, [rcx + 3]
shr rdi, 2
lea rax, [rcx + r11]
cmp r11, rax
cmova rdi, rsi
test rdi, rdi
je 0x44000d
nop dword [rax]
mov r10d, dword [r11]
inc rsi
mov eax, r8d
add r11, 4
xor r10, rax
mov rax, r10
shr rax, 0x10
movzx edx, al
mov rax, r10
shr rax, 8
movzx ecx, al
mov rax, r10
shr rax, 0x18
mov r9, qword [r14 + rdx*8 + 0x800]
xor r9, qword [r14 + rcx*8 + 0x1000]
xor r9, qword [r14 + rax*8]
movzx eax, r10b
xor r9, qword [r14 + rax*8 + 0x1800]
mov rax, r8
shr rax, 0x20
mov r8, r9
xor r8, rax
cmp rsi, rdi
jb 0x43ffb0
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
test rbx, rbx
je 0x440043
nop dword [rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
sub rbx, 1
jne 0x440020
mov rbx, qword [rsp + 0x20]
not r8
mov rax, r8
pop r14
ret
Function at 0x8d78f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x8d78fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x8d790d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x8d78f5
lea eax, [rcx + 1]
jmp 0x8d791b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x8d792e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x8d7914
sub eax, 3
jb 0x8d794e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x8d799d
sar eax, 1
movsxd rbp, eax
jb 0x8d7984
jmp 0x8d795c
add ebx, ebx
jne 0x8d795a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x8d7984
inc ecx
add ebx, ebx
jne 0x8d796a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x8d7984
call r11
adc ecx, ecx
add ebx, ebx
jne 0x8d797d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x8d796c
add ecx, 2
jmp 0x8d7989
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.008d78b2
jmp 0x8d78fd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x245a00
mov dl, 0x26
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x8d79e9
cmp rsi, rcx
jae 0x8d79f1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x8d79d0
cmp al, 0x8f
ja 0x8d79d0
cmp byte [rsi - 2], 0xf
je 0x8d79d6
sub al, 0xe8
cmp al, 1
ja 0x8d79ba
cmp rsi, rcx
jae 0x8d79f1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x8d79c0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x8d79f1
lodsb al, byte [rsi]
jmp 0x8d79d0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x4ca000]
mov eax, dword [rdi]
or eax, eax
je 0x8d7a4e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4d7000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x8d79fe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x8d7a48
mov qword [rbx], rax
add rbx, 8
jmp 0x8d7a1e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x8d7a92
cmp al, 0xef
ja 0x8d7a7a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x8d7a5a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x8d7a69
mov eax, dword [rdi]
add rdi, 4
jmp 0x8d7a69
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x8d7ae6
sub rsp, 0xffffffffffffff80
jmp 0x46b580
Function at 0x1405a6d22
Capabilities:
Encrypt data using rc4 prga

Disassembly:
neg bp
xor r11w, bp
neg qword [rsp + 0x1f]
push 0x7d32cb31
lea rbp, [rsp + rbp + 0x30]
mov word [rbp + riz], bx
jl 0x14058488f

Function at 0x1405b1001
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp fcn.140587b76
lea rsp, [rsp + 8]
jmp fcn.14058664d
jmp 0x14058d784
push 0x1818c6a6
lea rsp, [rsp + 0x48]
jb fcn.140575f5b
mov r11d, 0xb32fe723
movzx ecx, r11b
sub cx, cx
mov r11, qword [r10 + rcx*4]
add cl, byte [rcx + r10 + 8]
jmp 0x14056701d
push 0x418ea2a5
inc qword [rsp]
shl r11, cl
jmp 0x140574095
mov qword [r10], r11
jmp 0x14056657b
not word [rsp + 0x19]
jmp 0x14058a014
mov word [r11], dx
jmp 0x140566102
add r10, 2
jmp 0x14056c4ad
jge 0x14056b447
or dx, cx
jmp 0x140574154
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov eax, 0xb4ee6d87
push rax
fistp qword [rdx + 0x4d]
cmp bh, byte [0x115d7d8da]
clc
out dx, al
int1
int3
Function at 0x140031a80
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140031a8d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140031a9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140031a85
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140031ab5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140031aa2
sub eax, 3
jb 0x140031acf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140031b06
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140031af6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140031af4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140031ae3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140031a42
jmp 0x140031a8d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140031b52
cmp rsi, rcx
jae 0x140031b5a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140031b39
cmp al, 0x8f
ja 0x140031b39
cmp byte [rsi - 2], 0xf
je 0x140031b3f
sub al, 0xe8
cmp al, 1
ja 0x140031b23
cmp rsi, rcx
jae 0x140031b5a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140031b29
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140031b5a
lodsb al, byte [rsi]
jmp 0x140031b39
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2f000]
mov eax, dword [rdi]
or eax, eax
je 0x140031bc3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x350a4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140031b67
jns 0x140031b9c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140031ba6
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140031bbd
mov qword [rbx], rax
add rbx, 8
jmp 0x140031b87
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140031c1b
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0