joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400861f0
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, r8
mov r10, rdx
lea rcx, [rsp + 0x30]
mov rbx, r9
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r10
mov r9d, 0xf003f
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008623b
mov rcx, qword [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret

Function at 0x140086260
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, r8
mov r10, rdx
lea rcx, [rsp + 0x38]
mov rdi, r9
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r10
mov r9d, 1
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x14008632d
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x30], 0x9c40
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
movsxd r11, dword [rsp + 0x30]
mov rcx, 0xffffffffffffffff
add r11, 2
mov eax, 2
mul r11
cmovo rax, rcx
mov rcx, rax
call fcn.14015562c
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov r8, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov r11, rbx
sub rdi, rbx
movzx eax, word [r11]
add r11, 2
mov word [rdi + r11 - 2], ax
test ax, ax
jne 0x140086300
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400891d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x14008928c
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call sub.MSVCR90.dll_memcpy
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop dword [rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x140089250
sub eax, ebx
jmp 0x140089252
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x140089240
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x140089280
sub eax, ebx
jmp 0x140089282
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x140089270
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x140089306
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.140088dd0
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x1400892f0
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x140089306
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x1400891f0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c3c90
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov r14, r8
mov r12, rdx
mov r15, rcx
xor esi, esi
mov ebx, 0x78
mov dword [rax + 0x18], ebx
test r8, r8
jne 0x1400c3ce0
mov dword [rax - 0x48], 8
lea rdx, [0x140252440]
lea rcx, [rax - 0x48]
call sub.MSVCR90.dll__CxxThrowException
xor edi, edi
mov qword [rsp + 0x28], rdi
xor r13d, r13d
nop word [rax + rax]
cmp r13, 0xa
je 0x1400c3d9d
cmp qword [r12 + 0x20], 8
jb 0x1400c3d0c
lea rbx, [r12 + 8]
mov rdx, qword [rbx]
jmp 0x1400c3d14
lea rbx, [r12 + 8]
mov rdx, rbx
xor r8d, r8d
mov rcx, qword [r15 + 0x20]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400c3d41
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x80], eax
xor esi, esi
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400c3d8b
cmp qword [r12 + 0x20], 8
jb 0x1400c3d4c
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.1400d2ee0
mov rbx, rax
cmp rax, rdi
je 0x1400c3d64
mov rcx, rdi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov rdi, rbx
mov qword [rsp + 0x28], rbx
test rbx, rbx
jne 0x1400c3d93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x80], eax
xor esi, esi
lea ecx, [rdi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r13
jmp 0x1400c3cf0
xor edi, edi
mov qword [r14], rbx
xor ebx, ebx
lea esi, [rdi + 1]
mov rcx, rdi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
nop
jmp 0x1400c3db3
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400c3de0
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov r14, r8
mov r12, rdx
mov r15, rcx
xor esi, esi
mov edi, 0x78
mov dword [rax + 0x18], edi
test r8, r8
jne 0x1400c3e30
mov dword [rax - 0x48], 8
lea rdx, [0x140252440]
lea rcx, [rax - 0x48]
call sub.MSVCR90.dll__CxxThrowException
xor ebx, ebx
mov qword [rsp + 0x28], rbx
xor r13d, r13d
nop word [rax + rax]
cmp r13, 0xa
je 0x1400c3eff
cmp qword [r12 + 0x20], 8
jb 0x1400c3e5c
lea rdi, [r12 + 8]
mov rdx, qword [rdi]
jmp 0x1400c3e64
lea rdi, [r12 + 8]
mov rdx, rdi
xor r8d, r8d
mov rcx, qword [r15 + 0x30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400c3e91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x80], eax
xor esi, esi
lea ecx, [rsi + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400c3ee6
cmp qword [r12 + 0x20], 8
jb 0x1400c3e9c
mov rdi, qword [rdi]
mov rcx, rdi
call fcn.1400cd980
mov rdi, rax
cmp rax, rbx
je 0x1400c3ebf
test rbx, rbx
je 0x1400c3ebf
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [r8]
mov rbx, rdi
mov qword [rsp + 0x28], rbx
test rdi, rdi
jne 0x1400c3eee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x80], eax
xor esi, esi
lea ecx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r13
jmp 0x1400c3e40
xor ebx, ebx
mov qword [r14], rdi
xor edi, edi
mov dword [rsp + 0x80], edi
lea esi, [rbx + 1]
test rbx, rbx
je 0x1400c3f12
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
jmp 0x1400c3f1f
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400c42c0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov r12, r8
mov rdi, rdx
mov rbp, rcx
xor esi, esi
mov rbx, rsi
mov qword [rax - 0x48], rbx
mov qword [rax + 0x20], rsi
lea r9d, [rsi + 0xa]
lea r8, [rax + 0x20]
call fcn.1400c3c90
test eax, eax
je 0x1400c4371
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x1400c4317
xor ecx, ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x20], rbx
mov r8, r12
mov rdx, rbx
mov rcx, rbp
call fcn.1400c4390
lea r11, vtable.SpeedBit::Chrome::Extension::Loader.0
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], rbp
lea rax, [r12 + 0x190]
mov qword [rsp + 0x40], rax
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
nop
mov esi, eax
cmp qword [rdi + 0x20], 8
jb 0x1400c4366
mov rcx, qword [rdi + 8]
jmp 0x1400c436a
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rcx, rbx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, esi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x1400dde70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, edx
mov ebx, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova ebx, ecx
cmp ebx, dword [rdi]
jne 0x1400ddea4
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1402605e0]
test rax, rax
je 0x1400ddeb2
call rax
shl ebx, 4
mov ecx, ebx
call fcn.1400da290
mov rcx, qword [0x1402605e8]
mov rbx, rax
test rcx, rcx
je 0x1400ddecd
call rcx
test rbx, rbx
je 0x1400dde97
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.1400da600
mov rcx, rbx
mov qword [rdi + 0x10], rbx
call qword [0x14025a240]
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rdi], esi
shl r8, 4
call sub.MSVCR90.dll_memset
mov r8, qword [rdi + 8]
xor r11d, r11d
mov qword [rdi + 8], r11
test r8, r8
je 0x1400ddfe3
mov qword [rsp + 0x30], rbp
lea rbp, [0x1401be8d0]
nop word [rax + rax]
mov r9d, dword [r8 + 0x20]
mov r10, qword [r8 + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x1400ddf5e
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x1400ddf40
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rbx
je 0x1400ddfb6
mov eax, dword [r9]
test eax, eax
je 0x1400ddf7e
mov rcx, qword [r9 + 8]
jmp 0x1400ddf81
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x1400ddfb6
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400ddfac
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x1400ddfd2
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x1400ddfd2
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400ddfca
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
mov r8, r10
test r10, r10
jne 0x1400ddf30
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400de160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x20
mov r10d, dword [rcx]
mov r12, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
lea r14, [0x1401be8d0]
test r10d, r10d
je 0x1400de1c9
xor eax, eax
mov r9, rdx
test r8d, r8d
jle 0x1400de1bf
nop
movzx ecx, byte [r9]
dec r8d
inc r9
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x1400de1a0
xor edx, edx
div r10d
mov r13d, edx
jmp 0x1400de1cc
xor r13d, r13d
mov r9d, r13d
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.1400de000
mov r11, rax
test rax, rax
je 0x1400de26f
mov rdi, qword [rax + 0x10]
test r12, r12
jne 0x1400de25f
mov rax, qword [rax + 8]
test rax, rax
je 0x1400de208
mov rcx, qword [r11]
mov qword [rax], rcx
jmp 0x1400de20f
mov rax, qword [r11]
mov qword [rbx + 8], rax
mov rcx, qword [r11]
test rcx, rcx
je 0x1400de21f
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400de241
mov ecx, r13d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], r11
jne 0x1400de23f
mov rax, qword [r11]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, r11
call fcn.1400da600
add dword [rbx + 4], 0xffffffff
jne 0x1400de267
mov rcx, rbx
call fcn.1400ddda0
mov rax, rdi
jmp 0x1400de336
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbp
mov rax, rdi
jmp 0x1400de336
test r12, r12
je 0x1400de334
mov ecx, 0x28
call fcn.1400da290
mov rdi, rax
test rax, rax
jne 0x1400de292
mov rax, r12
jmp 0x1400de336
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov qword [rax + 0x10], r12
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x1400de2f4
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x1400de2f4
add edx, edx
mov rcx, rbx
call fcn.1400dde70
test eax, eax
je 0x1400de2f4
xor eax, eax
test esi, esi
jle 0x1400de2ed
nop word [rax + rax]
movzx ecx, byte [rbp]
dec esi
inc rbp
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test esi, esi
jg 0x1400de2d0
xor edx, edx
div dword [rbx]
mov r13d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400de314
mov edx, r13d
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.1400dde00
jmp 0x1400de334
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x1400de328
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x1400e0220
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov rsi, rdx
mov ebx, r12d
mov edi, r12d
call fcn.1400de360
mov rcx, rsi
test eax, eax
je 0x1400e025c
call fcn.1400de3d0
mov rbp, rax
jmp 0x1400e0281
call fcn.1400de3d0
mov rsi, rax
test rax, rax
je 0x1400e0328
mov rcx, rax
call fcn.1400de5b0
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.MSVCR90.dll_free]
test rbp, rbp
je 0x1400e0328
call fcn.1400de360
test eax, eax
je 0x1400e02d0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400e02b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x1400e030a
inc ebx
cmp ebx, 5
jge 0x1400e030a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400e0293
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400e02f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x1400e030a
inc ebx
cmp ebx, 5
jge 0x1400e030a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400e02d0
mov rcx, rbp
call qword [sym.imp.MSVCR90.dll_free]
cmp esi, 0xffffffff
jne 0x1400e031d
cmp edi, 2
je 0x1400e0323
mov r12d, 0xa0a
mov eax, r12d
jmp 0x1400e032d
mov eax, 7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400e0620
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x168
mov rax, qword [0x14025a030]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x40]
mov r8d, 0x104
mov dword [rsp + 0x34], 0x200
call fcn.1400e0490
test eax, eax
jne 0x1400e07e2
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x160], rdi
call fcn.1400de360
xor esi, esi
test eax, eax
je 0x1400e068e
lea rcx, [rsp + 0x40]
call fcn.1400de3d0
mov rbx, rax
jmp 0x1400e0739
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rcx, rbx
add rcx, rcx
call qword [sym.imp.MSVCR90.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400e06f0
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1400e0725
mov rcx, rdi
call qword [sym.imp.MSVCR90.dll_free]
mov eax, 0x200
mov rsi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140155650
add rsp, 0x168
ret
mov rcx, rdi
call fcn.1400de5b0
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCR90.dll_free]
test rbx, rbx
je 0x1400e06f0
call fcn.1400de360
test eax, eax
je 0x1400e078a
mov rax, rbx
cmp word [rbx], si
je 0x1400e0764
nop
cmp word [rax], 0x5c
je 0x1400e0761
add rax, 2
cmp word [rax], si
jne 0x1400e0750
jmp 0x1400e0764
mov word [rax], si
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov edi, eax
jmp 0x1400e07c8
mov rax, rbx
cmp byte [rbx], sil
je 0x1400e07a4
cmp byte [rax], 0x5c
je 0x1400e07a1
inc rax
cmp byte [rax], sil
jne 0x1400e0792
jmp 0x1400e07a4
mov byte [rax], sil
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.MSVCR90.dll_free]
test edi, edi
je 0x1400e06f0
mov eax, dword [rsp + 0x34]
jmp 0x1400e06f5
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140155650
add rsp, 0x168
ret
Function at 0x1401104e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14011063e
test rdx, rdx
je 0x14011063e
movzx edx, word [rcx + 2]
mov r8d, 0x800
movzx eax, dx
and ax, r8w
cmp ax, r8w
je 0x1401105ab
movzx ecx, word [rbx + 2]
movzx eax, cx
and ax, r8w
cmp ax, r8w
je 0x1401105ab
xor cl, dl
test cl, 0x10
jne 0x1401105ab
movzx eax, byte [rbx]
cmp byte [rdi], al
jne 0x1401105ab
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.1401104e0
test eax, eax
jne 0x1401105ab
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.1401104e0
test eax, eax
jne 0x1401105ab
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.140110660
test eax, eax
jne 0x1401105ab
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x1401105ab
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x1401105ab
movzx r10d, word [rdi + 2]
mov edx, 0x400
movzx eax, r10w
and ax, dx
cmp ax, dx
jne 0x1401105bb
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
jne 0x1401105ab
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x1401105f7
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi], 0x98
je 0x1401105f7
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1401105f7
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
je 0x1401105ab
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1401105ab
call fcn.1400dd1d0
test eax, eax
je 0x1401105f7
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbx + 2]
mov ecx, 0x100
and ax, cx
and r10w, cx
cmp r10w, ax
je 0x14011061d
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r10w, r10w
je 0x140110631
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x1401105ab
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1401151c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r10d, r10d
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov rbx, rdx
test rdx, rdx
je 0x140115201
cmp byte [rdx], r10b
je 0x1401151f9
inc rbx
cmp byte [rbx], r10b
jne 0x1401151f1
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x14011533d
mov qword [rsp + 0x40], r14
lea r14, [0x1401be8d0]
nop dword [rax]
cmp edi, 2
jge 0x14011522e
mov r9d, edi
xor r9d, 1
jmp 0x140115231
mov r9d, edi
test rbp, rbp
je 0x140115294
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
mov rdx, rbp
shl rcx, 5
mov r8, qword [rcx + rax]
movzx ecx, byte [rbp]
test cl, cl
je 0x14011527f
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x14011527f
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x140115260
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x140115311
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
cmp qword [r10 + 0x18], 0
je 0x1401152ea
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x1401152df
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x1401152c0
xor edx, edx
mov eax, r8d
div dword [r10 + 8]
jmp 0x1401152ec
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 8]
mov r8d, ebx
mov rdx, rsi
call fcn.1400de000
test rax, rax
je 0x14011530e
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x14011531c
jmp 0x140115311
xor r10d, r10d
inc edi
cmp edi, r13d
jl 0x140115220
mov r14, qword [rsp + 0x40]
mov rax, r10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, r10
jmp 0x140115324
Function at 0x140115420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
xor r9d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x140115458
cmp byte [rdx], r9b
je 0x140115450
inc rbx
cmp byte [rbx], r9b
jne 0x140115448
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x14011557c
mov qword [rsp + 0x40], r12
mov r12, qword [rcx + 0x10]
mov qword [rsp + 0x48], r14
lea r14, [0x1401be8d0]
nop dword [rax]
cmp edi, 2
jge 0x14011548c
mov eax, edi
xor eax, 1
jmp 0x14011548e
mov eax, edi
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r12 + 0x18]
test rbp, rbp
je 0x1401154e4
movzx ecx, byte [rbp]
mov r8, qword [r8 + r12]
mov rdx, rbp
test cl, cl
je 0x1401154cf
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x1401154cf
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x1401154b0
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x140115551
cmp qword [r10 + 0x30], 0
je 0x14011552a
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x14011551f
nop word [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x140115500
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x14011552c
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov r8d, ebx
mov rdx, rsi
call fcn.1400de000
test rax, rax
je 0x14011554e
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x14011555c
jmp 0x140115551
xor r9d, r9d
inc edi
cmp edi, r13d
jl 0x140115480
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x140115569
Function at 0x140121e10
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x140121e2f
cmp byte [rdx], 0
je 0x140121e28
inc rax
cmp byte [rax], 0
jne 0x140121e20
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x78]
mov r8d, eax
add rcx, 0x50
jmp fcn.1400de0d0