joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rax, qword [rbp + 0x7f]
mov r10, rcx
or rcx, 0xffffffffffffffff
xor r11d, r11d
mov r9, rdx
mov r8, qword [rax]
test r8, r8
je 0x14000588e
mov rax, rcx
inc rax
cmp word [r8 + rax*2], r11w
jne 0x1400057ac
lea edx, [rax*2 + 2]
mov rax, qword [rbp + 0x77]
mov dword [rbp + 0x2f], edx
mov qword [rbp + 0x27], r8
mov dword [rbp + 0x33], r11d
mov rdx, qword [rax]
test rdx, rdx
je 0x14000589f
inc rcx
cmp word [rdx + rcx*2], r11w
jne 0x1400057d8
lea eax, [rcx*2 + 2]
mov dword [rbp + 0x1f], eax
lea rcx, str.ETW0
movzx eax, byte [r9]
xor r8d, r8d
shl eax, 0x18
mov dword [rbp - 0x21], eax
mov qword [rbp + 0x17], rdx
lea rdx, [r9 + 1]
movzx eax, word [rdx]
xor r9d, r9d
mov dword [rbp - 0x1d], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rbp - 0x19], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 9], rax
mov dword [rbp + 0x23], r11d
movzx eax, word [rax]
mov dword [rbp - 1], eax
movzx eax, word [rdx]
mov dword [rbp + 0xf], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp + 7], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x21]
mov dword [rbp + 3], 2
mov dword [rbp + 0x13], 1
mov dword [rbp - 0x29], eax
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140123570
add rsp, 0xa0
pop rbp
ret
lea r8, [0x140361390]
mov edx, 2
jmp 0x1400057bd
lea rdx, [0x140361390]
mov eax, 2
jmp 0x1400057e9
Function at 0x1400058b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rax, qword [rbp + 0x7f]
mov r9, rdx
mov qword [rbp + 0x17], rax
mov r10, rcx
mov rax, qword [rbp + 0x77]
xor r11d, r11d
mov qword [rbp + 7], rax
or rcx, 0xffffffffffffffff
mov rax, qword [rbp + 0x6f]
mov qword [rbp + 0x1f], 4
mov qword [rbp + 0xf], 4
mov rdx, qword [rax]
test rdx, rdx
je 0x1400059f8
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r11w
jne 0x140005914
lea r8d, [rax*2 + 2]
mov rax, qword [rbp + 0x67]
mov qword [rbp - 9], rdx
mov dword [rbp - 1], r8d
mov dword [rbp + 3], r11d
mov rdx, qword [rax]
test rdx, rdx
je 0x140005a0a
inc rcx
cmp word [rdx + rcx*2], r11w
jne 0x140005942
lea eax, [rcx*2 + 2]
mov dword [rbp - 0x11], eax
lea rcx, str.ETW0
movzx eax, byte [r9]
xor r8d, r8d
shl eax, 0x18
mov dword [rbp - 0x51], eax
mov qword [rbp - 0x19], rdx
lea rdx, [r9 + 1]
movzx eax, word [rdx]
xor r9d, r9d
mov dword [rbp - 0x4d], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rbp - 0x49], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 0x39], rax
mov dword [rbp - 0xd], r11d
movzx eax, word [rax]
mov dword [rbp - 0x31], eax
movzx eax, word [rdx]
mov dword [rbp - 0x21], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp - 0x29], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x2d], 2
mov dword [rbp - 0x1d], 1
mov dword [rbp - 0x59], eax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140123570
add rsp, 0xc0
pop rbp
ret
lea rdx, [0x140361390]
mov r8d, 2
jmp 0x140005926
lea rdx, [0x140361390]
mov eax, 2
jmp 0x140005953
Function at 0x140005a24
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rax, qword [rbp + 0x7f]
mov r10, rcx
xor r9d, r9d
mov r8, rdx
mov rcx, qword [rax]
test rcx, rcx
je 0x140005b20
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r9w
jne 0x140005a5d
lea edx, [rax*2 + 2]
mov rax, qword [rbp + 0x77]
mov qword [rbp + 0x17], rax
movzx eax, byte [r8]
shl eax, 0x18
mov dword [rbp - 0x21], eax
mov dword [rbp + 0x2f], edx
lea rdx, [r8 + 1]
movzx eax, word [rdx]
xor r8d, r8d
mov dword [rbp - 0x1d], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rbp - 0x19], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 9], rax
mov qword [rbp + 0x27], rcx
lea rcx, str.ETW0
mov dword [rbp + 0x33], r9d
mov qword [rbp + 0x1f], 8
movzx eax, word [rax]
mov dword [rbp - 1], eax
movzx eax, word [rdx]
mov dword [rbp + 0xf], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp + 7], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x21]
mov dword [rbp + 3], 2
mov dword [rbp + 0x13], 1
mov dword [rbp - 0x29], eax
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140123570
add rsp, 0xa0
pop rbp
ret
lea rcx, [0x140361390]
mov edx, 2
jmp 0x140005a6e

Function at 0x140005b38
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x30]
mov r10, rcx
mov rcx, qword [rax]
test rcx, rcx
je 0x140005c15
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140005b69
inc eax
and dword [rbp - 0xc], 0
xor r9d, r9d
mov dword [rbp - 0x10], eax
xor r8d, r8d
movzx eax, byte [rdx]
shl eax, 0x18
mov dword [rbp - 0x48], eax
movzx eax, word [rdx + 1]
mov dword [rbp - 0x44], eax
mov rax, qword [rdx + 3]
add rdx, 0xb
mov qword [rbp - 0x40], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x18], rcx
lea rcx, str.ETW0
movzx eax, word [rax]
mov dword [rbp - 0x30], eax
movzx eax, word [rdx]
mov dword [rbp - 0x20], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp - 0x28], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x48]
mov dword [rbp - 0x2c], 2
mov dword [rbp - 0x1c], 1
mov dword [rbp - 0x50], eax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140123570
add rsp, 0x80
pop rbp
ret
lea rcx, [0x14036228e]
mov eax, 1
jmp 0x140005b74
Function at 0x140005c2c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x3f]
sub rsp, 0xb0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [rbp + 0x7f]
mov r10, rcx
mov qword [rbp + 0x1f], rax
xor r11d, r11d
mov rax, qword [rbp + 0x77]
or rcx, 0xffffffffffffffff
mov r9, rdx
mov qword [rbp + 0x27], 4
mov r8, qword [rax]
test r8, r8
je 0x140005d5a
mov rax, rcx
inc rax
cmp word [r8 + rax*2], r11w
jne 0x140005c78
lea edx, [rax*2 + 2]
mov rax, qword [rbp + 0x6f]
mov dword [rbp + 0x17], edx
mov qword [rbp + 0xf], r8
mov dword [rbp + 0x1b], r11d
mov rdx, qword [rax]
test rdx, rdx
je 0x140005d6b
inc rcx
cmp word [rdx + rcx*2], r11w
jne 0x140005ca4
lea eax, [rcx*2 + 2]
mov dword [rbp + 7], eax
lea rcx, str.ETW0
movzx eax, byte [r9]
xor r8d, r8d
shl eax, 0x18
mov dword [rbp - 0x39], eax
mov qword [rbp - 1], rdx
lea rdx, [r9 + 1]
movzx eax, word [rdx]
xor r9d, r9d
mov dword [rbp - 0x35], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rbp - 0x31], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 0x21], rax
mov dword [rbp + 0xb], r11d
movzx eax, word [rax]
mov dword [rbp - 0x19], eax
movzx eax, word [rdx]
mov dword [rbp - 9], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp - 0x11], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x15], 2
mov dword [rbp - 5], 1
mov dword [rbp - 0x41], eax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140123570
add rsp, 0xb0
pop rbp
ret
lea r8, [0x140361390]
mov edx, 2
jmp 0x140005c89
lea rdx, [0x140361390]
mov eax, 2
jmp 0x140005cb5
Function at 0x140005d84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x3f]
sub rsp, 0xb0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [rbp + 0x7f]
mov r10, rcx
mov qword [rbp + 0x1f], rax
xor r8d, r8d
mov rax, qword [rbp + 0x77]
mov qword [rbp + 0xf], rax
mov rax, qword [rbp + 0x6f]
mov qword [rbp + 0x27], 4
mov qword [rbp + 0x17], 8
mov rcx, qword [rax]
test rcx, rcx
je 0x140005e83
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r8b
jne 0x140005dda
inc eax
mov dword [rbp + 7], eax
xor r9d, r9d
movzx eax, byte [rdx]
shl eax, 0x18
mov dword [rbp - 0x39], eax
movzx eax, word [rdx + 1]
mov dword [rbp - 0x35], eax
mov rax, qword [rdx + 3]
add rdx, 0xb
mov qword [rbp - 0x31], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 0x21], rax
mov qword [rbp - 1], rcx
lea rcx, str.ETW0
mov dword [rbp + 0xb], r8d
movzx eax, word [rax]
mov dword [rbp - 0x19], eax
movzx eax, word [rdx]
mov dword [rbp - 9], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp - 0x11], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x15], 2
mov dword [rbp - 5], 1
mov dword [rbp - 0x41], eax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140123570
add rsp, 0xb0
pop rbp
ret
lea rcx, [0x14036228e]
mov eax, 1
jmp 0x140005de5

Function at 0x140005e9c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x3f]
sub rsp, 0xb0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [rbp + 0x7f]
mov r10, rcx
xor r9d, r9d
mov qword [rbp + 0x27], reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8, rdx
mov qword [rbp + 0x17], 4
mov rcx, qword [rax]
mov rax, qword [rbp + 0x77]
mov qword [rbp + 0xf], rax
mov rax, qword [rbp + 0x6f]
mov qword [rbp + 0x1f], rcx
mov rcx, qword [rax]
test rcx, rcx
je 0x140005fab
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r9w
jne 0x140005ef8
lea edx, [rax*2 + 2]
movzx eax, byte [r8]
shl eax, 0x18
mov dword [rbp - 0x39], eax
mov dword [rbp + 7], edx
lea rdx, [r8 + 1]
movzx eax, word [rdx]
xor r8d, r8d
mov dword [rbp - 0x35], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rbp - 0x31], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 0x21], rax
mov qword [rbp - 1], rcx
lea rcx, str.ETW0
mov dword [rbp + 0xb], r9d
movzx eax, word [rax]
mov dword [rbp - 0x19], eax
movzx eax, word [rdx]
mov dword [rbp - 9], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp - 0x11], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x15], 2
mov dword [rbp - 5], 1
mov dword [rbp - 0x41], eax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140123570
add rsp, 0xb0
pop rbp
ret
lea rcx, [0x140361390]
mov edx, 2
jmp 0x140005f09
Function at 0x140005fc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x30]
mov r10, rcx
xor r9d, r9d
mov r8, rdx
mov rcx, qword [rax]
test rcx, rcx
je 0x1400060ae
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r9w
jne 0x140005ffb
lea edx, [rax*2 + 2]
movzx eax, byte [r8]
shl eax, 0x18
mov dword [rbp - 0x48], eax
mov dword [rbp - 0x10], edx
lea rdx, [r8 + 1]
movzx eax, word [rdx]
xor r8d, r8d
mov dword [rbp - 0x44], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rbp - 0x40], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x18], rcx
lea rcx, str.ETW0
mov dword [rbp - 0xc], r9d
movzx eax, word [rax]
mov dword [rbp - 0x30], eax
movzx eax, word [rdx]
mov dword [rbp - 0x20], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp - 0x28], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x48]
mov dword [rbp - 0x2c], 2
mov dword [rbp - 0x1c], 1
mov dword [rbp - 0x50], eax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140123570
add rsp, 0x80
pop rbp
ret
lea rcx, [0x140361390]
mov edx, 2
jmp 0x14000600c

Function at 0x1400060c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x3f]
sub rsp, 0xb0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword [rbp + 0x7f]
mov r10, rcx
mov qword [rbp + 0x1f], rax
xor r8d, r8d
mov rax, qword [rbp + 0x77]
mov qword [rbp + 0xf], rax
mov rax, qword [rbp + 0x6f]
mov qword [rbp + 0x27], 4
mov qword [rbp + 0x17], 4
mov rcx, qword [rax]
test rcx, rcx
je 0x1400061c7
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r8b
jne 0x14000611e
inc eax
mov dword [rbp + 7], eax
xor r9d, r9d
movzx eax, byte [rdx]
shl eax, 0x18
mov dword [rbp - 0x39], eax
movzx eax, word [rdx + 1]
mov dword [rbp - 0x35], eax
mov rax, qword [rdx + 3]
add rdx, 0xb
mov qword [rbp - 0x31], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 0x21], rax
mov qword [rbp - 1], rcx
lea rcx, str.ETW0
mov dword [rbp + 0xb], r8d
movzx eax, word [rax]
mov dword [rbp - 0x19], eax
movzx eax, word [rdx]
mov dword [rbp - 9], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp - 0x11], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x15], 2
mov dword [rbp - 5], 1
mov dword [rbp - 0x41], eax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140123570
add rsp, 0xb0
pop rbp
ret
lea rcx, [0x14036228e]
mov eax, 1
jmp 0x140006129
Function at 0x1400061e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rax, qword [rbp + 0x7f]
mov r10, rcx
mov qword [rbp + 0x27], rax
xor r9d, r9d
mov rax, qword [rbp + 0x77]
mov r11, r8
mov r8, rdx
mov qword [rbp + 0x2f], 4
mov rcx, qword [rax]
test rcx, rcx
je 0x1400062df
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r9w
jne 0x14000622c
lea edx, [rax*2 + 2]
movzx eax, byte [r8]
shl eax, 0x18
mov dword [rbp - 0x21], eax
mov dword [rbp + 0x1f], edx
lea rdx, [r8 + 1]
movzx eax, word [rdx]
mov r8, r11
mov dword [rbp - 0x1d], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rbp - 0x19], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 9], rax
mov qword [rbp + 0x17], rcx
lea rcx, str.ETW0
mov dword [rbp + 0x23], r9d
movzx eax, word [rax]
mov dword [rbp - 1], eax
movzx eax, word [rdx]
mov dword [rbp + 0xf], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp + 7], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x21]
mov dword [rbp + 3], 2
mov dword [rbp + 0x13], 1
mov dword [rbp - 0x29], eax
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140123570
add rsp, 0xa0
pop rbp
ret
lea rcx, [0x140361390]
mov edx, 2
jmp 0x14000623d
Function at 0x1400062f8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x2f]
sub rsp, 0xd0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rax, qword [rbp + 0x7f]
mov r9, rdx
mov qword [rbp + 0xf], rax
mov r10, rcx
mov rax, qword [rbp + 0x77]
xor r11d, r11d
mov qword [rbp - 1], rax
or rcx, 0xffffffffffffffff
mov rax, qword [rbp + 0x6f]
mov qword [rbp + 0x17], 4
mov qword [rbp + 7], 4
mov rdx, qword [rax]
test rdx, rdx
je 0x140006469
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r11w
jne 0x140006354
lea r8d, [rax*2 + 2]
mov rax, qword [rbp + 0x67]
mov qword [rbp - 0x11], rdx
mov dword [rbp - 9], r8d
mov dword [rbp - 5], r11d
mov rdx, qword [rax]
test rdx, rdx
je 0x14000647b
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r11w
jne 0x140006385
lea r8d, [rax*2 + 2]
mov rax, qword [rbp + 0x5f]
mov qword [rbp - 0x21], rdx
mov dword [rbp - 0x19], r8d
mov dword [rbp - 0x15], r11d
mov rdx, qword [rax]
test rdx, rdx
je 0x14000648d
inc rcx
cmp word [rdx + rcx*2], r11w
jne 0x1400063b3
lea eax, [rcx*2 + 2]
mov dword [rbp - 0x29], eax
lea rcx, str.ETW0
movzx eax, byte [r9]
xor r8d, r8d
shl eax, 0x18
mov dword [rbp - 0x69], eax
mov qword [rbp - 0x31], rdx
lea rdx, [r9 + 1]
movzx eax, word [rdx]
xor r9d, r9d
mov dword [rbp - 0x65], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rbp - 0x61], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x25], r11d
movzx eax, word [rax]
mov dword [rbp - 0x49], eax
movzx eax, word [rdx]
mov dword [rbp - 0x39], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp - 0x41], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x69]
mov dword [rbp - 0x45], 2
mov dword [rbp - 0x35], 1
mov dword [rbp - 0x71], eax
lea rax, [rbp - 0x51]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 7
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140123570
add rsp, 0xd0
pop rbp
ret
lea rdx, [0x140361390]
mov r8d, 2
jmp 0x140006366
lea rdx, [0x140361390]
mov r8d, 2
jmp 0x140006397
lea rdx, [0x140361390]
mov eax, 2
jmp 0x1400063c4
Function at 0x1400064a4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp], rax
mov rax, qword [rbp + 0x80]
mov r9, rdx
mov qword [rbp - 0x10], rax
mov r10, rcx
mov rax, qword [rbp + 0x78]
xor r11d, r11d
mov qword [rbp - 0x20], rax
or rcx, 0xffffffffffffffff
mov rax, qword [rbp + 0x70]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x68]
mov qword [rbp - 8], 8
mov qword [rbp - 0x18], 8
mov qword [rbp - 0x28], 1
mov rdx, qword [rax]
test rdx, rdx
je 0x140006687
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r11w
jne 0x140006513
lea r8d, [rax*2 + 2]
mov rax, qword [rbp + 0x60]
mov qword [rbp - 0x40], rdx
mov dword [rbp - 0x38], r8d
mov dword [rbp - 0x34], r11d
mov rdx, qword [rax]
test rdx, rdx
je 0x140006699
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r11w
jne 0x140006544
lea r8d, [rax*2 + 2]
mov rax, qword [rbp + 0x58]
mov qword [rbp - 0x50], rdx
mov dword [rbp - 0x48], r8d
mov dword [rbp - 0x44], r11d
mov rdx, qword [rax]
test rdx, rdx
je 0x1400066ab
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r11w
jne 0x140006575
lea r8d, [rax*2 + 2]
mov rax, qword [rbp + 0x50]
mov qword [rbp - 0x60], rdx
mov dword [rbp - 0x58], r8d
mov dword [rbp - 0x54], r11d
mov rdx, qword [rax]
test rdx, rdx
je 0x1400066bd
inc rcx
cmp word [rdx + rcx*2], r11w
jne 0x1400065a3
lea eax, [rcx*2 + 2]
mov dword [rbp - 0x68], eax
lea rcx, str.ETW0
mov rax, qword [rbp + 0x48]
xor r8d, r8d
mov qword [rbp - 0x80], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x70], rax
movzx eax, byte [r9]
shl eax, 0x18
mov dword [rsp + 0x38], eax
mov qword [rbp - 0x70], rdx
lea rdx, [r9 + 1]
movzx eax, word [rdx]
xor r9d, r9d
mov dword [rsp + 0x3c], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rsp + 0x40], rax
mov rax, qword [r10 + 8]
mov qword [rsp + 0x50], rax
mov dword [rbp - 0x64], r11d
mov qword [rbp - 0x78], 8
mov qword [rsp + 0x78], 8
movzx eax, word [rax]
mov dword [rsp + 0x58], eax
movzx eax, word [rdx]
mov dword [rsp + 0x68], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rsp + 0x60], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x5c], 2
mov dword [rsp + 0x6c], 1
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], SafeArrayGetDim
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140123570
add rsp, 0x110
pop rbp
ret
lea rdx, [0x140361390]
mov r8d, 2
jmp 0x140006525
lea rdx, [0x140361390]
mov r8d, 2
jmp 0x140006556
lea rdx, [0x140361390]
mov r8d, 2
jmp 0x140006587
lea rdx, [0x140361390]
mov eax, 2
jmp 0x1400065b4
Function at 0x1400069d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rax, qword [rbp + 0x7f]
mov r10, rcx
or rcx, 0xffffffffffffffff
xor r11d, r11d
mov r9, rdx
mov r8, qword [rax]
test r8, r8
je 0x140006b12
mov rax, rcx
inc rax
cmp word [r8 + rax*2], r11w
jne 0x140006a10
lea edx, [rax*2 + 2]
mov rax, qword [rbp + 0x77]
mov qword [rbp + 7], rax
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x67]
mov dword [rbp + 0x1f], edx
mov qword [rbp + 0x17], r8
mov dword [rbp + 0x23], r11d
mov rdx, qword [rax]
mov qword [rbp + 0xf], 8
mov qword [rbp - 1], 8
test rdx, rdx
je 0x140006b23
inc rcx
cmp word [rdx + rcx*2], r11w
jne 0x140006a5c
lea eax, [rcx*2 + 2]
mov dword [rbp - 0x11], eax
lea rcx, str.ETW0
movzx eax, byte [r9]
xor r8d, r8d
shl eax, 0x18
mov dword [rbp - 0x51], eax
mov qword [rbp - 0x19], rdx
lea rdx, [r9 + 1]
movzx eax, word [rdx]
xor r9d, r9d
mov dword [rbp - 0x4d], eax
mov rax, qword [rdx + 2]
add rdx, 0xa
mov qword [rbp - 0x49], rax
mov rax, qword [r10 + 8]
mov qword [rbp - 0x39], rax
mov dword [rbp - 0xd], r11d
movzx eax, word [rax]
mov dword [rbp - 0x31], eax
movzx eax, word [rdx]
mov dword [rbp - 0x21], eax
lea rax, [0x1403fcc73]
sub eax, ecx
mov qword [rbp - 0x29], rdx
mov rcx, qword [r10 + 0x20]
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x2d], 2
mov dword [rbp - 0x1d], 1
mov dword [rbp - 0x59], eax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
call qword [sym.imp.api_ms_win_eventing_provider_l1_1_0.dll_EventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140123570
add rsp, 0xc0
pop rbp
ret
lea r8, [0x140361390]
mov edx, 2
jmp 0x140006a21
lea rdx, [0x140361390]
mov eax, 2
jmp 0x140006a6d

Function at 0x140065418
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movzx eax, word [rdx + 4]
movabs rcx, 0xcbf29ce484222325
movzx r8d, word [rdx + 6]
xor r8, rax
mov eax, dword [rdx]
xor r8, rax
xor r9d, r9d
movzx eax, byte [rdx + r9 + 0x10]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, 4
jb 0x140065436
mov rax, r8
mov rdx, r8
shl rax, 6
add rcx, rax
shr rdx, 2
mov eax, 0x9e3779b9
add rax, rdx
add rax, rcx
xor rax, r8
ret

Function at 0x140066e50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 8
mov rax, qword [rdx + 0x10]
jb 0x140066e5e
mov rdx, qword [rdx]
lea r9, [rax + rax]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x140066e92
movabs r10, 0x100000001b3
movzx eax, byte [r8 + rdx]
inc r8
xor rcx, rax
imul rcx, r10
cmp r8, r9
jb 0x140066e7e
mov rax, rcx
ret