joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x140007fb6
mov esi, edx
test edx, edx
jne 0x140007fbd
xor eax, eax
jmp 0x1400080aa
movsxd rax, dword [rcx + 0x3c]
mov r12, rcx
xor ebx, ebx
add rax, rcx
mov r9d, dword [rax + 0x88]
mov eax, dword [rax + 0x8c]
lea r15, [rcx + r9]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x18]
mov r14d, dword [r15 + 0x20]
mov ebp, dword [r15 + 0x1c]
mov r13d, dword [r15 + 0x24]
mov dword [rsp + 0x2c], eax
add r14, rcx
cmp dword [rsp + 0x2c], ebx
jbe 0x140007fb6
mov edi, dword [r14 + rbx*4]
mov r8d, 1
xor edx, edx
add rdi, r12
mov rcx, rdi
call fcn.140006980
mov r8d, eax
lea rax, [rbx + 1]
cmp r8d, esi
jne 0x1400080a2
add rbx, rbx
add rbx, r12
movzx eax, word [rbx + r13]
lea rax, [r12 + rax*4]
mov eax, dword [rax + rbp]
add rax, r12
mov qword [rsp + 0x38], rax
cmp rax, r15
jae 0x140008048
mov rax, qword [rsp + 0x38]
jmp 0x1400080aa
mov esi, dword [rsp + 0x28]
add rsi, r12
add rsi, r15
cmp rax, rsi
jae 0x140008041
call fcn.14000c4a0
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], ax
inc eax
mov word [rsp + 0x42], ax
mov rax, qword [0x140011140]
mov rax, qword [rax]
mov rax, qword [rax + 0x138]
test rax, rax
je 0x140007fb6
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, r12
call rax
test eax, eax
jns 0x140008041
jmp 0x140007fb6
mov rbx, rax
jmp 0x140007ff5
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180003210
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x180041020]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r8, qword [rcx + 0x18]
lea rbx, [rcx + 8]
xor eax, eax
mov qword [rsp + 0x58], 0xf
dec r8
mov qword [rsp + 0x40], rax
cmp qword [rbx + 0x10], r8
mov rdx, rbx
mov qword [rsp + 0x50], rax
cmovb r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18000325b
mov rdx, qword [rbx]
lea rcx, [rsp + 0x40]
call fcn.180001530
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call fcn.180012bf8
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800032b8
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800032b3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003414
call fcn.18000afb8
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x88], rdi
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, rcx
cmp rax, 4
jb 0x18000341a
cmp qword [rbx + 0x18], 0x10
mov r9, rbx
jb 0x1800032eb
mov r9, qword [rbx]
lea rax, str.logs
mov qword [rsp + 0x30], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.1800055b0
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call fcn.180012bf8
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180003362
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000335d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003420
call fcn.18000afb8
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 5
jb 0x180003426
cmp qword [rbx + 0x18], 0x10
jb 0x18000337d
mov rbx, qword [rbx]
lea rcx, str.dumps
mov qword [rsp + 0x30], 5
mov qword [rsp + 0x28], rcx
mov r9, rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.1800055b0
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call fcn.180012bf8
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800033f3
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800033ee
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000340e
call fcn.18000afb8
mov rdi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18000a940
add rsp, 0x70
pop rbx
ret
call fcn.180010fcc
int3
call fcn.180010fcc
int3
call fcn.1800014b0
int3
call fcn.180010fcc
int3
call fcn.1800014b0
int3
Function at 0x1800070a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x1800070e1
cmp edx, 1
jne 0x1800070d1
lea rcx, str.DBG_:_DLL_PROCESS_ATTACH.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call fcn.180006aa0
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, str.DBG_:_DLL_PROCESS_DETACH.
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor esi, esi
mov edi, 1
mov ebx, esi
xor eax, eax
lock cmpxchg dword [0x180046458], edi
je 0x180007129
cmp rbx, 0x20
jae 0x180007112
xor ecx, ecx
jmp 0x180007114
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180046458], edi
jne 0x180007108
cmp qword [0x180046460], rsi
je 0x180007139
xor ecx, ecx
call fcn.1800078bc
mov eax, esi
mov rbx, rsi
xchg dword [0x180046458], eax
xor eax, eax
lock cmpxchg dword [0x180046458], edi
je 0x180007171
cmp rbx, 0x20
jae 0x18000715a
xor ecx, ecx
jmp 0x18000715c
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180046458], edi
jne 0x180007150
cmp qword [0x180046460], rsi
je 0x1800071f1
xor ecx, ecx
call fcn.1800078bc
test eax, eax
jne 0x1800071f1
mov rcx, qword [0x180046558]
mov qword [0x180046558], rsi
test rcx, rcx
je 0x1800071b9
nop dword [rax + rax]
mov rbx, qword [rcx]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
test rbx, rbx
jne 0x1800071a0
mov r8, qword [0x180046560]
xor edx, edx
mov rcx, qword [0x180046460]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x180046460]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov qword [0x180046460], rsi
mov qword [0x180046560], rsi
mov qword [0x180046568], rsi
xchg dword [0x180046458], esi
mov rsi, qword [rsp + 0x30]
mov eax, edi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180007738
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x18000779e
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18000778f
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180007785
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180007759
mov r8, qword [rbx]
mov rcx, qword [0x180046460]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800077b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x40]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x180046560]
mov r8, qword [rbx]
mov al, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rbp, [r8 - 5]
cmove rbp, r8
lea rdi, [r8 - 5]
test al, al
lea r14, [rcx*2 + 5]
cmove rdi, r8
mov rdx, r14
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000781b
mov eax, 0xa
jmp 0x1800078a7
test esi, esi
je 0x18000783d
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18000785e
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18000785e
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180007858
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18000785e
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180007b74
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x180007b8b
cmp r8b, 0x90
je 0x180007b8b
cmp r8b, 0xcc
jne 0x180007bad
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x180007ba9
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180007bad
add edx, r10d
cmp edx, r9d
jb 0x180007b99
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x180007f14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x180007f5e
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x180046558]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x180007f9b
cmp rbx, rsi
jb 0x180007f96
cmp rbx, r15
jae 0x180007f96
cmp qword [rbx + 8], 0
jne 0x1800080f7
mov rbx, qword [rbx]
jmp 0x180007f7c
mov r14, rdi
cmp rdi, rsi
jb 0x18000801f
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, r14
div r12
sub r14, rdx
sub r14, r12
cmp r14, rsi
jb 0x180008016
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180008016
cmp dword [rbp - 0x10], 0x10000
je 0x180007fe6
mov r14, qword [rbp - 0x28]
cmp r14, r12
jb 0x180008016
jmp 0x180007fb2
test r14, r14
je 0x180008016
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800080b7
cmp r14, rsi
jae 0x180007fa3
test rbx, rbx
jne 0x1800080b7
cmp rdi, r15
ja 0x1800080f7
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800080f7
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800080f7
cmp dword [rbp - 0x10], 0x10000
je 0x18000808d
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jmp 0x180008046
test rdi, rdi
je 0x1800080f7
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x180008019
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x1800080ca
mov rax, qword [0x180046558]
mov qword [rbx], rax
mov qword [0x180046558], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x18007faf8
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x10]
call fcn.1800fefe1
outsb dx, byte [rsi]
sbb dh, dh
invalid
Function at 0x180007ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
movd edx, xmm0
mov r11d, edx
and r11d, 0x7fffff
shr edx, 0x17
and edx, 0xff
je 0x180007ed5
add edx, 0xffffff6a
test r11d, r11d
je 0x180008074
or r11d, 0x800000
jmp 0x180007ee3
mov edx, 0xffffff6b
test r11d, r11d
je 0x18000810e
imul r9d, edx, 0x4d105
sar r9d, 0x14
mov eax, 1
sub eax, r9d
mov ecx, 0x20
sub ecx, r9d
lea r8, [0x18001b1b0]
mov r10, qword [r8 + rcx*8]
imul r8d, eax, 0x1a934f
sar r8d, 0x13
add r8d, edx
mov ecx, r8d
not cl
mov rbx, r10
shr rbx, cl
lea edi, [r11 + r11]
lea eax, [r11*2 + 1]
mov ecx, r8d
shl eax, cl
shl rax, 0x20
mul r10
mov rax, rdx
shr rax, 0x20
imul rsi, rax, 0x51eb851f
shr rsi, 0x25
imul ebp, esi, 0xffffff9c
add ebp, eax
cmp ebp, ebx
jae 0x180007f72
test ebp, ebp
jne 0x180007fab
test r11b, 1
je 0x180007fab
mov eax, edx
test rax, rax
jne 0x180007fab
dec esi
mov ebp, 0x64
jmp 0x180008004
ja 0x180008004
lea eax, [rdi - 1]
imul rax, r10
mov cl, 0x40
sub cl, r8b
movzx ecx, cl
xor edx, edx
bt rax, rcx
setb dl
lea ecx, [r8 + 0x20]
neg ecx
shr rax, cl
xor ecx, ecx
test eax, eax
sete cl
not r11d
and r11d, ecx
or r11d, edx
je 0x180008004
inc r9d
imul eax, esi, 0xc28f5c29
rol eax, 0x1e
xor ecx, ecx
cmp eax, 0x28f5c28
ja 0x180007fe5
xor ecx, ecx
nop word cs:[rax + rax]
mov esi, eax
add ecx, 2
imul eax, eax, 0xc28f5c29
rol eax, 0x1e
cmp eax, 0x28f5c29
jb 0x180007fd0
imul eax, esi, 0xcccccccd
ror eax, 1
xor edx, edx
cmp eax, 0x1999999a
setb dl
cmovae eax, esi
or edx, ecx
add r9d, edx
jmp 0x18000816e
lea eax, [rsi + rsi*4]
shr ebx, 1
sub ebp, ebx
imul edx, ebp, 0x199a
add edx, 0x8002
movzx ecx, dx
shr edx, 0x10
lea eax, [rdx + rax*2]
cmp ecx, 0x1999
ja 0x18000816e
mov ecx, edi
imul r10, rcx
mov cl, 0x40
sub cl, r8b
movzx ecx, cl
bt r10, rcx
setb cl
test bpl, 1
sete r11b
xor r11b, cl
je 0x180008164
add r8d, 0x20
neg r8d
mov ecx, r8d
shr r10, cl
test r10d, r10d
sete cl
and edx, 1
and dl, cl
movzx ecx, dl
sub eax, ecx
jmp 0x18000816e
imul r9d, edx, 0x9a209
add r9d, 0xfffc01e1
sar r9d, 0x15
imul r8d, r9d, 0xffe56cb1
sar r8d, 0x13
add r8d, edx
mov eax, 0x1f
sub eax, r9d
lea rcx, [0x18001b1b0]
mov rax, qword [rcx + rax*8]
mov rcx, rax
shr rcx, 0x19
mov r11, rax
sub r11, rcx
mov cl, 0x28
sub cl, r8b
shr r11, cl
mov rsi, rax
shr rsi, 0x18
add rsi, rax
shr rsi, cl
mov ecx, edx
and ecx, 0xfffffffe
xor r10d, r10d
cmp ecx, 2
setne r10b
add r10d, r11d
mov r11d, esi
mov ecx, 0xcccccccd
imul rcx, r11
shr rcx, 0x23
lea r11d, [rcx + rcx]
lea r11d, [r11 + r11*4]
cmp r11d, r10d
jae 0x180008115
mov cl, 0x27
sub cl, r8b
shr rax, cl
inc eax
shr eax, 1
cmp edx, 0xffffffdd
jne 0x180008168
and eax, 0xfffffffe
jmp 0x18000816e
xor eax, eax
xor r9d, r9d
jmp 0x18000816e
inc r9d
imul eax, ecx, 0xc28f5c29
rol eax, 0x1e
xor edx, edx
cmp eax, 0x28f5c28
ja 0x180008145
xor edx, edx
nop dword [rax]
mov ecx, eax
add edx, 2
imul eax, eax, 0xc28f5c29
rol eax, 0x1e
cmp eax, 0x28f5c29
jb 0x180008130
imul eax, ecx, 0xcccccccd
ror eax, 1
xor r8d, r8d
cmp eax, 0x1999999a
setb r8b
cmovae eax, ecx
or r8d, edx
add r9d, r8d
jmp 0x18000816e
dec eax
jmp 0x18000816e
cmp eax, r10d
adc eax, 0
shl r9, 0x20
mov eax, eax
or rax, r9
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x180009790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, r8
mov rsi, rcx
mov eax, dword [r8]
xor ebx, ebx
sub rax, 1
cmovae rbx, rax
movzx eax, byte [r8 + 9]
and eax, 0xf
lea rcx, [0x18001bf30]
movzx ecx, byte [rax + rcx]
mov r15, rbx
shr r15, cl
mov r12, r9
mov r14, rdx
add rdi, 0xb
test r15, r15
je 0x1800097f1
lea rcx, [rsp + 0x30]
mov rdx, r14
mov r8, r15
mov r9, rdi
call fcn.1800099b0
mov r14, qword [rsp + 0x30]
cmp byte [r12], 0
je 0x1800098e4
movzx ebp, byte [r12 + 1]
mov byte [rsp + 0x2f], bpl
mov rcx, qword [r14 + 0x10]
lea rdx, [rcx + 1]
cmp qword [r14 + 0x18], rdx
jae 0x180009825
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
mov rcx, qword [r14 + 0x10]
lea rdx, [rcx + 1]
movsx eax, bpl
mov r8, qword [r14 + 8]
mov qword [r14 + 0x10], rdx
mov byte [r8 + rcx], 0x27
mov cl, 1
cmp bpl, 0x20
jb 0x1800098a7
cmp eax, 0x22
je 0x1800098a7
cmp eax, 0x5c
je 0x1800098a7
cmp eax, 0x7f
je 0x1800098a7
test bpl, bpl
js 0x1800098a7
movzx edx, bpl
cmp edx, 0xad
je 0x1800098a7
xor edx, edx
lea r8, [0x18001a800]
mov r9d, eax
nop word [rax + rax]
movzx r10d, byte [rdx + r8]
test r10b, r10b
jns 0x18000988e
and r10d, 0x7f
shl r10d, 8
movzx r11d, byte [rdx + r8 + 1]
inc rdx
or r10d, r11d
sub r9d, r10d
js 0x1800098a2
xor cl, 1
inc rdx
cmp rdx, 0x135
jb 0x180009870
test cl, cl
sete cl
cmp bpl, 0x22
setne dl
cmp bpl, 0x27
je 0x18000991b
and dl, cl
jne 0x18000991b
mov rax, qword [r14 + 0x10]
lea rdx, [rax + 1]
cmp qword [r14 + 0x18], rdx
jae 0x1800098d6
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
mov rax, qword [r14 + 0x10]
lea rdx, [rax + 1]
mov rcx, qword [r14 + 8]
mov qword [r14 + 0x10], rdx
mov byte [rcx + rax], bpl
jmp 0x18000994a
mov rax, qword [r14 + 0x10]
lea rdx, [rax + 1]
cmp qword [r14 + 0x18], rdx
jae 0x180009902
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
mov rax, qword [r14 + 0x10]
lea rdx, [rax + 1]
movzx ecx, byte [r12 + 1]
mov r8, qword [r14 + 8]
mov qword [r14 + 0x10], rdx
mov byte [r8 + rax], cl
cmp rbx, r15
jne 0x180009979
jmp 0x180009994
lea rcx, [rsp + 0x2f]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x48]
lea r8, [rsp + 0x30]
mov rdx, r14
call fcn.180009ac0
mov r14, qword [rsp + 0x48]
mov rax, qword [r14 + 0x10]
lea rdx, [rax + 1]
cmp qword [r14 + 0x18], rdx
jae 0x180009968
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
mov rax, qword [r14 + 0x10]
lea rdx, [rax + 1]
mov rcx, qword [r14 + 8]
mov qword [r14 + 0x10], rdx
mov byte [rcx + rax], 0x27
cmp rbx, r15
je 0x180009994
sub rbx, r15
lea rcx, [rsp + 0x30]
mov rdx, r14
mov r8, rbx
mov r9, rdi
call fcn.1800099b0
mov r14, qword [rsp + 0x30]
mov qword [rsi], r14
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x18000af50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r9
mov rbx, rdx
mov r13, rcx
movzx eax, byte [r9 + 8]
test al, 0xef
jne 0x18000b080
lea rax, str.true
lea r14, str.false
test r8b, r8b
cmovne r14, rax
movzx esi, r8b
xor rsi, 5
mov eax, dword [rdi]
xor r12d, r12d
sub rax, rsi
cmovae r12, rax
movzx eax, byte [rdi + 9]
and eax, 0xf
lea rcx, [0x18001bf30]
movzx ecx, byte [rax + rcx]
mov r15, r12
shr r15, cl
add rdi, 0xb
test r15, r15
mov qword [rsp + 0x20], r13
je 0x18000afdd
lea rcx, [rsp + 0x28]
mov rdx, rbx
mov r8, r15
mov r9, rdi
call fcn.1800099b0
mov rbx, qword [rsp + 0x28]
mov rax, r12
sub rax, r15
mov qword [rsp + 0x40], rax
add rsi, r14
mov rcx, qword [rbx + 0x10]
jmp 0x18000b00f
add rcx, r13
mov qword [rbx + 0x10], rcx
add r14, r13
cmp r14, rsi
je 0x18000b056
mov rbp, rsi
sub rbp, r14
lea rdx, [rcx + rbp]
mov r13, qword [rbx + 0x18]
cmp r13, rdx
jae 0x18000b032
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, qword [rbx + 0x10]
mov r13, qword [rbx + 0x18]
sub r13, rcx
cmp r13, rbp
cmovae r13, rbp
test r13, r13
je 0x18000b000
add rcx, qword [rbx + 8]
mov rdx, r14
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x10]
jmp 0x18000b000
cmp r12, r15
je 0x18000b075
lea rcx, [rsp + 0x28]
mov rdx, rbx
mov r8, qword [rsp + 0x40]
mov r9, rdi
call fcn.1800099b0
mov rbx, qword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
mov qword [r13], rbx
jmp 0x18000b0da
test byte [rdi + 0xa], 1
movzx r14d, r8b
je 0x18000b0ae
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x28], r14d
lea rdx, [rsp + 0x28]
mov rcx, rbx
mov r8, rdi
xor r9d, r9d
call fcn.180005e90
test al, al
jne 0x18000b07a
movzx eax, byte [rdi + 9]
shr eax, 4
and eax, 7
lea rcx, [0x18001b4f0]
mov eax, dword [rcx + rax*4]
shl rax, 0x20
or r14, rax
mov rcx, r13
mov rdx, rbx
mov r8, r14
mov r9, rdi
call fcn.18000b0f0
mov rax, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.2.13
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000a640
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002770
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.1400140e0
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.1400024d0
jmp 0x14000126c
mov ecx, 0x2000
call fcn.1400140e0
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.1400024d0
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi]
mov eax, 0x2000
cmp r12, rax
mov rbx, r12
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000f62c
cmp rax, rbx
jne 0x14000125e
mov rcx, qword [rdi]
call fcn.14000f3a0
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140008a90
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.14000fd6c
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14000f3a0
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000bb90
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002770
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000a320
mov rcx, r13
call fcn.1400140cc
mov rcx, rbp
call fcn.1400140cc
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret