joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18011ee94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
sub bl, 0x3b
mov qword [rsp + 0x18], rsi
push rdi
xadd bx, bp
mov bh, 0xaf
dec dil
push r12
push r13
shr r12b, 0x10
ror bx, cl
sal r12d, 0xf6
push r14
rcr r12w, cl
push r15
sub rsp, 0x40
mov r14d, 0x17cd6893
mov r14w, r15w
not r12b
mov rbx, qword [rsp + 0x90]
movsx r12, r14w
movsx di, r13b
cmovbe r14w, r8w
mov r12, rdx
movzx di, r13b
mov bpl, r13b
movsxd r14, ebx
mov rbp, rcx
seto dh
cmovle dx, sp
not ch
mov rdx, r9
jmp 0x18011ef18
mov rcx, rbx
movzx di, dil
mov rdi, r9
movzx r14d, r8w
movsx r14w, r10b
mov r14d, r10d
mov r15d, r8d
movzx r14d, r10w
mov r14d, dword [rbx + 0xc]
jmp 0x18011ef3f
call fcn.18008bb77
xor r10d, r10d
xor sil, 0xfc
mov esi, eax
jmp 0x18011ef54
test r14d, r14d
je 0x18011f15c
mov r8, qword [rdi + 8]
add r9d, eax
or eax, 0xffffffff
sar r11b, 0xce
setae ch
movsxd r11, dword [rbx + 0x10]
rol dx, cl
adc dl, r9b
xchg r13b, r9b
mov r9d, eax
mov r13d, eax
bts ebx, ebp
add al, r8b
shl dl, 0x17
mov edx, r14d
bsf eax, ebx
or bl, 0xb5
sub cx, si
lea ebx, [rdx - 1]
rol cl, cl
jmp 0x18011efa0
lea rcx, [rbx + rbx*4]
adc ax, sp
lea rax, [r8 + rcx*4]
cmp bl, r12b
cmp r11b, 0xe1
cmp esi, dword [rax + r11 + 4]
jle 0x18011efc8
cmp esi, dword [rax + r11 + 8]
jle 0x18011efea
mov edx, ebx
cbw
ror ah, 0xb8
rcl ax, 0x5c
mov eax, ebx
test ebx, ebx
jmp 0x18011efdc
jne 0x18011ef96
test eax, eax
je 0x18011f00d
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
btr rdx, r9
movzx rdx, bp
ror dh, 0xc0
lea rdx, [r11 + rax*4]
add rdx, r8
jmp 0x18011f008
jmp 0x18011f018
mov rdx, r10
not cx
movzx cx, spl
lea rcx, [r8 + r11]
rcl r8w, 0x3b
or r8, r12
sal r8d, 0xc2
mov r8d, r10d
jmp 0x18011f030
or r11d, 0xffffffff
test rdx, rdx
je 0x18011f060
mov eax, dword [rdx + 4]
clc
cmp dword [rcx], eax
jmp 0x18011f048
jle 0x18011f097
mov eax, dword [rdx + 8]
jmp 0x18011f057
cmp dword [rcx + 4], eax
jg 0x18011f097
cmp r15d, dword [rcx]
jmp 0x18011f068
jl 0x18011f097
cmp r15d, dword [rcx + 4]
jmp 0x18011f077
jg 0x18011f097
cmp r9d, r11d
mov eax, r8d
mov r13d, r8d
jmp 0x18011f08b
cmovne eax, r9d
mov r9d, eax
jmp 0x18011f097
inc r8d
add rcx, 0x14
cmp r8d, r14d
jb 0x18011f034
cmp r9d, r11d
sete sil
movsxd rdi, ecx
mov qword [rsp + 0x20], r12
mov eax, r10d
mov qword [rsp + 0x30], r12
movzx ebx, r14w
cmovne eax, r9d
jmp 0x18011f0cb
lea r11, [rsp + 0x40]
xchg r15b, r12b
movzx rsi, bx
not si
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov r12w, r9w
mov dword [rsp + 0x28], eax
movzx r12d, ax
movsx r14d, si
lea eax, [r13 + 1]
movsx edi, cx
movups xmm0, xmmword [rsp + 0x20]
mov dil, 0x5e
cmovne r10d, eax
seto r15b
movsx r14d, bp
mov rax, rbp
mov dword [rsp + 0x38], r10d
bswap r13
not r15d
movups xmm1, xmmword [rsp + 0x30]
movzx r13, r9w
movsx r13, bx
movdqu xmmword [rbp], xmm0
movdqu xmmword [rbp + 0x10], xmm1
movsx bp, r15b
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
mov r13d, ebp
pop r14
xchg r12b, dil
not r13w
jmp 0x18011f151
pop r13
pop r12
pop rdi
jmp 0x18011f15b
ret
call fcn.18012a4aa
int3
Function at 0x180126a9e
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
movsxd r9, r8d
jmp 0x180126aab
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x18006c8b0]
clc
rcl rdx, 0x5e
sub ecx, ecx
movsxd rdx, r10d
cmova r8d, r10d
movzx dx, dl
lea r8, [0x18006c8a8]
movsxd rdx, r12d
mov dx, 0x4f96
lea rdx, [0x18006b420]
jmp 0x180126ae5
call fcn.1801267e1
test rax, rax
jmp 0x180126af2
je 0x180126b10
mov rcx, rbx
dec bl
add rsp, 0x20
movzx bx, ch
movsxd rbx, r10d
pop rbx
jmp qword [0x18006b288]
add rsp, 0x20
movsx ebx, cx
movzx rbx, di
movzx ebx, r15w
pop rbx
jmp 0x180126b25
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x180126c40
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
bts r8w, si
push rdi
sub rsp, 0x20
movsx r9d, di
mov rbx, rdx
movsx rdi, r8w
movsx r9d, r12w
lea r9, [0x18006c8c8]
movzx r8, r14w
movsx r8, sp
mov edi, ecx
movsx dx, spl
movsx rcx, di
lea rdx, [0x18006b448]
movsx r8, sp
movzx r8, r8w
jmp 0x180126c8c
mov ecx, 3
mov r8b, 0xd3
movsx r8, si
lea r8, [0x18006c8c0]
call fcn.1801267e1
mov rdx, rbx
rcl ecx, 0x81
bts cx, ax
mov ecx, edi
jmp 0x180126cbc
test rax, rax
jmp 0x180126cc4
je 0x180126cd5
call qword [0x18006b288]
jmp 0x180126cdb
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180128234
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movzx ecx, r15w
movsxd rcx, ecx
not ecx
mov ecx, 0x17
jmp 0x18012824b
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x180128258
je 0x18012826f
mov ecx, 5
jmp 0x180128268
int 0x29
jmp 0x18012826f
mov r8d, 1
mov edx, 0xc0000417
movsxd rcx, ecx
mov cl, ah
setne cl
lea ecx, [r8 + 1]
jmp 0x18012828b
call fcn.180127c83
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
bsf edx, r8d
or dh, 0xb4
shr dh, 0x61
mov edx, 0xc0000417
jmp 0x1801282ae
add rsp, 0x28
jmp 0x1801282b7
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x180128aab
Capabilities:
Terminate process

Disassembly:
push rbx
movzx rbx, r8w
shld rbx, r10, 0xf2
cmovg ebx, r14d
sub rsp, 0x20
movsx rbx, r15w
movzx rbx, r14w
mov ebx, ecx
jmp 0x180128acd
call fcn.180128b19
test al, al
je 0x180128afb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
movsxd rdx, r10d
movsx edx, r13w
movsx rdx, r12w
mov edx, ebx
jmp 0x180128af5
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
jmp 0x180128b02
call fcn.180128b47
mov ecx, ebx
jmp 0x180128b0e
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x18012db60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
sub bh, 0x95
push rdi
xor r8b, bl
sub rsp, 0x20
sbb bl, 0x53
ror r8b, cl
rcl r8, cl
mov rbx, rcx
shrd r8w, r13w, 0xb4
sub edx, edx
shr r8b, cl
add rcx, 0x18
setae r8b
mov r8d, 0x101
jmp 0x18012db9a
call fcn.180120818
sub edx, edx
mov ax, ax
lea rdi, [rbx + 0xc]
mov r8w, 0x15b3
jmp 0x18012dbb6
movzx eax, dx
jmp 0x18012dbc2
lea r9, [0x1800801e0]
mov qword [rbx + 4], rdx
mov r8d, r9d
mov r8, rbx
setns ch
mov qword [rbx + 0x220], rdx
movzx ecx, r11w
movsx cx, r12b
lea ecx, [rdx + 6]
rep stosw word [rdi], ax
mov ah, 0x41
and dil, bpl
and dil, 0xeb
lea rax, [0x1800801f8]
sbb ecx, 0x42ef6e50
mov edi, edx
sub r8, rax
lea rcx, [rdi + r9]
inc rdi
sub al, r11b
xor al, dl
mov al, byte [rcx + 0x18]
mov byte [r8 + rcx + 0x30], al
cmp rdi, 0x101
jl 0x18012dc08
lea rax, [0x1800802f9]
shr cl, cl
bt ecx, r14d
sub rbx, rax
lea rcx, [rdx + r9]
inc rdx
mov al, byte [rcx + 0x119]
cmp r8b, r15b
mov byte [rbx + rcx + 0x232], al
jmp 0x18012dc55
cmp rdx, 0x100
jmp 0x18012dc61
jl 0x18012dc39
mov rbx, qword [rsp + 0x30]
movsx edi, di
btc di, cx
add rsp, 0x20
cmovnp edi, esi
bswap di
pop rdi
jmp 0x18012dc83
ret
Function at 0x18012ef0a
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
jmp 0x18012ef23
mov qword [rax + 0x10], rbp
cmp spl, dil
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
jmp 0x18012ef3b
push r14
jmp 0x18012ef43
sub rsp, 0x40
jmp 0x18012ef4c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
inc rbx
sub bh, cl
mov rbx, rax
clc
jmp 0x18012ef62
test rax, rax
jmp 0x18012ef6a
jne 0x18012ef7c
sub eax, eax
jmp 0x18012ef77
jmp 0x18012f0f5
mov rbp, rbx
cmp word [rax], si
jmp 0x18012ef87
je 0x18012efcf
or rax, 0xffffffffffffffff
inc rax
cmp ah, ch
stc
cmp word [rbp + rax*2], si
jmp 0x18012efa1
jne 0x18012ef91
lea rbp, [rbp + rax*2]
test ebp, 0x47127
add rbp, 2
cmp rsp, r13
test r11b, 0x1e
test al, r8b
cmp word [rbp], si
jmp 0x18012efc9
jne 0x18012ef8d
mov qword [rsp + 0x38], rsi
bswap r8d
rcr r9b, 0x21
sub rbp, rbx
mov qword [rsp + 0x30], rsi
btr r8d, edi
add rbp, 2
bt r8w, r12w
sar rbp, 1
xor r9d, ebp
mov r8, rbx
shld r9, rcx, 0x41
sbb r9b, 0xcb
mov r9d, ebp
mov dword [rsp + 0x28], esi
cmp r10d, edi
jmp 0x18012f015
xor edx, edx
cmc
test dil, r13b
mov qword [rsp + 0x20], rsi
stc
xor ecx, ecx
jmp 0x18012f028
call fcn.18012ecfc
movsxd r14, eax
cmp r9b, r8b
stc
cmp r15b, 0x5c
test eax, eax
jmp 0x18012f03f
jne 0x18012f053
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18012ef70
mov rcx, r14
call fcn.18012b863
mov rdi, rax
cmc
test rax, rax
jmp 0x18012f067
jne 0x18012f07e
xor ecx, ecx
jmp 0x18012f074
call fcn.18012bbd3
jmp 0x18012f045
mov qword [rsp + 0x38], rsi
xor r8b, 0xf0
mov r9d, ebp
mov qword [rsp + 0x30], rsi
btc r8w, ax
sar r8w, 0x5c
movzx r8d, r14w
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
sub ecx, ecx
jmp 0x18012f0ae
mov qword [rsp + 0x20], rdi
call fcn.18012ecfc
test eax, eax
jmp 0x18012f0bf
jne 0x18012f0d2
mov rcx, rdi
call fcn.18012bbd3
jmp 0x18012f0e4
sub ecx, ecx
jmp 0x18012f0d9
call fcn.18012bbd3
mov rsi, rdi
movzx ecx, dx
mov rcx, rbx
jmp 0x18012f0ec
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
movzx di, r9b
rcr dil, cl
and r14b, 0xc2
mov rbp, qword [rsp + 0x58]
mov r14w, r9w
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
not r14b
movsxd r14, edx
pop r14
jmp 0x18012f12a
ret
Function at 0x1801355ae
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov rax, 0x32d56e53
movzx ax, r8b
cbw
mov qword [rsp + 0x18], rbp
movsx ax, r12b
push rsi
movzx rax, r10w
push rdi
setge ah
push r14
mov eax, 0x1450
jmp 0x1801355e0
call fcn.180138ea6
sub rsp, rax
not r10w
mov rax, qword [0x180080010]
bsf rsi, rbp
xor rax, rsp
xadd r10b, sil
movzx r14d, bx
sbb r10w, bp
mov qword [rsp + 0x1440], rax
movzx rsi, r12w
movsxd r10, edx
mov rdi, rcx
sal sil, cl
mov rax, r10
rcr ch, cl
mov ebp, r9d
sar rax, 6
ror dh, cl
lea rcx, [0x180082980]
sbb dl, r13b
xadd r14b, sil
and r10d, 0x3f
add rbp, r8
sbb si, 0x43ef
bts dx, di
mov rsi, r8
jmp 0x180135652
mov rax, qword [rcx + rax*8]
not dh
stc
clc
lea rdx, [r10 + r10*8]
sbb r14b, 0
mov r14, qword [rax + rdx*8 + 0x28]
cmc
xor eax, eax
clc
mov qword [rdi], rax
cmp spl, 0x53
mov dword [rdi + 8], eax
cmp r8, rbp
jae 0x18013578a
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x18013568b
jae 0x1801356f9
mov al, byte [rsi]
jmp 0x180135698
inc rsi
test bpl, 0x67
clc
stc
cmp al, 0xa
jmp 0x1801356a8
jne 0x1801356c6
inc dword [rdi + 8]
jmp 0x1801356b6
mov byte [rbx], 0xd
jmp 0x1801356be
inc rbx
jmp 0x1801356c6
mov byte [rbx], al
movzx eax, r8w
movsxd rax, r15d
mov al, r11b
inc rbx
adc al, spl
btc ax, r11w
lea rax, [rsp + 0x143f]
cmp r11, r13
test sil, cl
cmp rbx, rax
jmp 0x1801356f3
jb 0x180135683
and qword [rsp + 0x20], 0
shl r8b, cl
shrd edx, r14d, 0x1a
btc r8, 0x6d
lea rax, [rsp + 0x40]
neg ch
sub ebx, eax
movzx r9w, al
mov r8, 0x421a47d8
bswap r9
lea r9, [rsp + 0x30]
jmp 0x180135733
mov r8d, ebx
movsx cx, spl
lea rdx, [rsp + 0x40]
movzx cx, r11b
mov rcx, r14
jmp 0x18013574d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18013577e
mov eax, dword [rsp + 0x30]
test bh, 0x65
test r13b, r11b
add dword [rdi + 4], eax
cmp eax, ebx
jb 0x18013578a
cmp rsi, rbp
jb 0x18013567e
jmp 0x18013578a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
cwde
rol rax, cl
mov rax, rdi
movzx cx, dil
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1801357a2
call fcn.18011c3a9
lea r11, [rsp + 0x1450]
jmp 0x1801357bc
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
bswap r14
mov rsp, r11
jmp 0x1801357d9
pop r14
jmp 0x1801357e6
pop rdi
pop rsi
ret
Function at 0x1801357e9
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, r15d
movzx ax, r14b
mov qword [rsp + 0x18], rbp
movzx eax, r12w
push rsi
nop
movsxd rax, ecx
push rdi
movsx rax, dx
lahf
push r14
xchg ah, ah
movsx rax, dx
movzx ax, r9b
mov eax, 0x1450
jmp 0x180135822
call fcn.180138ea6
sub rsp, rax
neg ax
mov rax, qword [0x180080010]
ror di, 0xdf
and rsi, r14
xor rax, rsp
movzx si, r14b
mov qword [rsp + 0x1440], rax
test r15b, bpl
movsxd r10, edx
rol dil, 0x87
mov rdi, rcx
mov rax, r10
bsf ecx, r13d
bts r14w, r13w
mov ebp, r9d
movzx esi, r15w
xor si, r8w
sar rax, 6
bswap dx
rcl dl, cl
lea rcx, [0x180082980]
sbb dh, ch
dec dx
and r10d, 0x3f
lea rbp, [rbp + r8]
btc rdx, 0x12
cqo
mov rsi, r8
sal r14b, cl
xadd r14b, r14b
mov rax, qword [rcx + rax*8]
add r14b, 0xb1
lea rdx, [r10 + r10*8]
bt r14w, 0x68
mov r14, qword [rax + rdx*8 + 0x28]
cmp r9b, r13b
cmc
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
jmp 0x1801358c7
cmp r8, rbp
jmp 0x1801358cf
jae 0x1801359ef
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1801358e2
jae 0x180135950
movzx eax, word [rsi]
stc
add rsi, 2
cmp r15d, 0xe004791
cmp ax, 0xa
jne 0x180135924
add dword [rdi + 8], 2
test edx, 0x2079696a
shld ecx, esi, 0x69
shl cx, 0xe5
mov ecx, 0xd
cmp dh, 0x9a
mov word [rbx], cx
clc
cmc
add rbx, 2
mov word [rbx], ax
add rbx, 2
shr ah, 0x5f
not ax
movzx ax, r8b
lea rax, [rsp + 0x143e]
cmp r8b, 0xe6
cmp rbx, rax
jmp 0x18013594a
jb 0x1801358da
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
bts cx, r8w
or cx, 0x5dc6
test r8, 0x579138f2
sub rbx, rax
test dh, 0x38
lea r9, [rsp + 0x30]
bsr rdx, r13
sar rbx, 1
lea rdx, [rsp + 0x40]
shr r8w, 0x9f
add ebx, ebx
mov rcx, r14
cmova r8w, si
mov r8d, 0x31910c32
setae r8b
mov r8d, ebx
jmp 0x1801359a4
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1801359b1
je 0x1801359e0
mov eax, dword [rsp + 0x30]
test al, dil
add dword [rdi + 4], eax
cmp ax, 0x1888
cmp eax, ebx
jb 0x1801359ef
cmp rsi, rbp
jmp 0x1801359d5
jb 0x1801358d5
jmp 0x1801359ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
btr ax, ax
adc ecx, r13d
mov rax, rdi
bt cx, 0xfc
test ah, 0x53
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x180135a0a
call fcn.18011c3a9
lea r11, [rsp + 0x1450]
mov bp, 0x667a
movzx bp, cl
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movsxd r14, edx
jmp 0x180135a33
mov rsp, r11
movzx rdi, r15w
pop r14
pop rdi
not si
pop rsi
jmp 0x180135a46
ret
Function at 0x180135a47
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movsx ax, r12b
push rsi
bswap ax
push rdi
not al
push r12
movzx ax, r13b
cdqe
movzx rax, bp
push r14
bswap rax
push r15
movzx rax, r9w
mov al, 0x86
cmovle ax, di
mov eax, 0x1470
jmp 0x180135a85
call fcn.180138ea6
sub rsp, rax
btr ebx, 0xad
or rbx, r10
mov rax, qword [0x180080010]
mov bx, r12w
movsx r10, dx
sar r15d, cl
xor rax, rsp
mov qword [rsp + 0x1460], rax
test rsp, r8
movsxd r10, edx
cmovns r14, r12
inc r15
mov rbx, rcx
rol r15b, 0x56
ror dil, cl
movzx ax, r9b
mov rax, r10
not r14b
mov r14d, r9d
xor r15, 0xae244e4
rol rdi, cl
jmp 0x180135ae5
sar rax, 6
xchg ecx, r15d
lea rcx, [0x180082980]
mov dil, al
bsf edx, ebx
and r10d, 0x3f
shl dl, cl
add dil, sil
sbb dil, r12b
lea r14, [r14 + r8]
mov r15, r8
bsr dx, cx
cmp al, r11b
mov rdi, r8
cmp bpl, 0xc8
adc r12d, esi
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
stc
cmp bl, sil
sub eax, eax
clc
mov qword [rbx], rax
test sil, r13b
cmp r8, r14
jmp 0x180135b3f
mov dword [rbx + 8], eax
jmp 0x180135b47
jae 0x180135cc4
lea rax, [rsp + 0x50]
jmp 0x180135b57
cmp rdi, r14
jmp 0x180135b5f
jae 0x180135bb6
movzx ecx, word [rdi]
stc
add rdi, 2
test r12b, 0xc6
jmp 0x180135b76
cmp cx, 0xa
jne 0x180135b95
mov edx, 0xd
mov word [rax], dx
cmp ebp, 0x7b2e79b7
add rax, 2
stc
test esp, ebx
mov word [rax], cx
add rax, 2
bsr ecx, r8d
adc cl, 0xf0
rcr ch, cl
lea rcx, [rsp + 0x6f8]
cmp rax, rcx
jb 0x180135b57
and qword [rsp + 0x38], 0
shl ecx, cl
lea rcx, [rsp + 0x50]
xor r8b, 0x5b
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
sar r9b, cl
sub rax, rcx
bts cx, r12w
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
sbb r9b, cl
jmp 0x180135bf5
sar rax, 1
clc
cmp r14b, 5
mov qword [rsp + 0x20], rcx
mov r9d, eax
shr cl, 0x19
dec cl
sar ecx, cl
mov ecx, 0xfde9
sub edx, edx
call fcn.18012ecfc
mov ebp, eax
test eax, eax
jmp 0x180135c21
je 0x180135cba
sub esi, esi
stc
test eax, eax
jmp 0x180135c31
je 0x180135ca0
and qword [rsp + 0x20], 0
shr cl, cl
lea rdx, [rsp + 0x700]
xchg r9, rcx
and r8b, dl
mov ecx, esi
not r9d
add r8, r15
lea r9, [rsp + 0x40]
stc
bsr r8, rbx
mov r8d, ebp
stc
lea rdx, [rdx + rcx]
movsxd rcx, ecx
mov rcx, r12
cmc
cmp r10w, 0x436f
sub r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x180135c84
je 0x180135cba
add esi, dword [rsp + 0x40]
cmp bp, 0x6478
cmp esi, ebp
jmp 0x180135c9a
jb 0x180135c37
mov eax, edi
sub eax, r15d
mov dword [rbx + 4], eax
jmp 0x180135cad
cmp rdi, r14
jmp 0x180135cb5
jmp 0x180135b47
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
sbb ah, al
mov rax, rbx
test rbx, 0x77ea6736
mov rcx, qword [rsp + 0x1460]
cmp rsp, 0xbc84665
cmp bp, bx
test cx, ax
xor rcx, rsp
jmp 0x180135ceb
call fcn.18011c3a9
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
setno dil
movsx esi, bp
pop r15
pop r14
movsx esi, r10w
mov dil, 0xd1
pop r12
movsx di, r8b
movsx rsi, si
jmp 0x180135d25
pop rdi
pop rsi
ret
Function at 0x14000bc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000bcb0
cmp r11, r10
ja 0x14000bd26
cmp r10, rdx
ja 0x14000bd3a
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000bcb2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000bc90
jmp 0x14000bd14
ja 0x14000bcba
mov r11, r10
cmp rax, r8
jne 0x14000bc54
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000bcf0
mov rdi, r8
sub ecx, edx
jns 0x14000bd0b
jmp 0x14000bd16
cmp r8, rsi
je 0x14000bd4b
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000bd16
xor al, 1
cmp rdi, rsi
jne 0x14000bcd0
jmp 0x14000bd16
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140007110
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140006660
ud2
lea rcx, [0x1401950a8]
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140006a00
ud2
Function at 0x14000e050
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14000e26d
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1401311e0]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x14000e0c0
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1401311f0]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x14000e1ea
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x14000e1c0
movdqa xmm1, xmmword [0x1401311f0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x140131200], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14000e28b
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.14000dbe0
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140023f90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rdx + 0x10]
movzx ebp, byte [rdx + 0x18]
movzx eax, byte [0x1401d21e9]
mov rcx, qword [0x1401d2138]
test rcx, rcx
jne 0x140023fd9
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x140024218
mov rcx, rax
mov qword [0x1401d2138], rax
mov r8d, 0x5f0
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x140024218
mov rbx, rax
mov byte [rsp + 0x27], bpl
mov qword [rsp + 0x30], r14
lea r15, [rsi + 0x20]
movabs r12, 0x800000000000000
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call sub.msvcrt.dll_memset
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x28], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
nop word cs:[rax + rax]
mov ebp, 1
lock xadd qword [0x1401d2050], rbp
mov r14, rbp
xor r14, rcx
lea r11, [r14 + rdx]
mov rax, r14
rol rax, 0x10
xor rax, r11
lea r13, [rax + r8]
rol rax, 0x15
add r14, r9
mov r11, r14
xor r11, r10
rol r14, 0x20
xor rbp, r13
add rbp, r11
rol r11, 0xd
xor r13, r12
xor r11, rbp
rol rbp, 0x20
xor r13, rax
add r14, r13
rol r13, 0x10
xor r13, r14
add rbp, r13
rol r13, 0x15
add r14, r11
rol r11, 0x11
xor r13, rbp
xor r11, r14
rol r14, 0x20
xor rbp, r12
add rbp, r11
rol r11, 0xd
xor r11, rbp
rol rbp, 0x20
xor r14, 0xff
add r14, r13
rol r13, 0x10
xor r13, r14
add rbp, r13
rol r13, 0x15
add r14, r11
rol r11, 0x11
xor r11, r14
rol r14, 0x20
xor r13, rbp
add rbp, r11
rol r11, 0xd
xor r11, rbp
rol rbp, 0x20
add r14, r13
rol r13, 0x10
xor r13, r14
add rbp, r13
rol r13, 0x15
add r14, r11
rol r11, 0x11
xor r11, r14
rol r14, 0x20
xor r13, rbp
add rbp, r11
rol r11, 0xd
add r14, r13
rol r13, 0x10
xor r13, r14
rol r13, 0x15
xor r11, rbp
add r14, r11
rol r11, 0x11
mov rbp, r14
rol rbp, 0x20
xor rbp, r11
xor rbp, r13
xor rbp, r14
je 0x140024060
mov rax, qword [rsi + 0x40]
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rdi + 0x128], xmm1
movups xmmword [rdi + 0x118], xmm0
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x138], rcx
movzx ecx, byte [rsp + 0x27]
mov byte [rdi + 0x140], cl
mov qword [rdi], 0
mov qword [rdi + 8], rbx
mov qword [rdi + 0x80], 0
mov qword [rdi + 0x88], rbx
mov rcx, qword [rsp + 0x28]
mov qword [rdi + 0x100], rcx
mov qword [rdi + 0x108], rbp
mov qword [rdi + 0x110], rax
mov r8, qword [rsi + 0x48]
test r8, r8
je 0x140024206
cmp qword [rsi + 0x50], 0
je 0x140024206
mov rcx, qword [0x1401d2138]
xor edx, edx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x5f0
call fcn.1400034d0
ud2