joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e620
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov r14, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call fcn.14004b2b0
mov rcx, rax
test rax, rax
je 0x14000e81f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
lea rdx, [0x140187ec1]
cmp rdx, 0x10000
jae 0x14000e683
movzx edx, dx
mov rcx, r14
call fcn.14004c0d0
jmp 0x14000e6a5
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x14000e690
mov r8d, eax
mov rcx, r14
call fcn.14004bc90
nop
mov esi, 1
mov dword [rsp + 0x20], esi
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call fcn.14011b3b0
lea r9, [rsi - 2]
lea r8, str.b2bdc38627114cb19c71d49e1b350104
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.1401299ec
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], ax
lea rcx, [rsp + 0x30]
call fcn.14003c120
mov r8, rax
mov edx, 0x104
lea r9, [rsi - 2]
lea rcx, [rsp + 0x60]
call fcn.140129838
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 0xb
rep stosb byte [rdi], al
lea rdi, [rsp + 0x3c]
mov ecx, 0x16
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14012a3cc
mov rdi, rax
lea r8, [rsp + 0x60]
test rax, rax
je 0x14000e788
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8]
add ecx, esi
mov esi, ecx
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xfff1
sub esi, eax
lea r8, [r8 + 1]
add ebx, esi
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
sub rdi, 1
jne 0x14000e750
shl ebx, 0x10
add ebx, esi
xor eax, eax
mov qword [rsp + 0x24], rax
mov dword [rsp + 0x2c], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], eax
mov word [rsp + 0x44], ax
lea rcx, [rsp + 0x24]
call fcn.14003fbf0
mov rdi, rax
lea rcx, [rsp + 0x30]
call fcn.14002f7c0
mov rdx, rax
mov r9, rdi
mov r8d, ebx
mov rcx, r14
call fcn.14004b060
nop
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 7
rep stosb byte [rdi], al
lea rdi, [rsp + 0x38]
mov ecx, 0xe
rep stosb byte [rdi], al
lea rdi, [rsp + 0x24]
mov ecx, 4
rep stosb byte [rdi], al
lea rdi, [rsp + 0x28]
mov ecx, 8
rep stosb byte [rdi], al
mov rax, r14
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14001eef0
int3
Function at 0x14004cc80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.140118a30
sub rsp, rax
movsxd rsi, r8d
mov rdi, rcx
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], r14b
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], r14b
jne 0x14004ccd3
lea rcx, [rsp + 0x70]
call fcn.140004130
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.14004c340
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14004cd33
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cd2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cf24
call fcn.140118214
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x60]
call fcn.14011b3b0
mov edx, r14d
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
sub r9, r8
je 0x14004cd85
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x60]
sub r8, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, r9
jb 0x14004cd70
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xc20]
call fcn.14011b3b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x820]
call fcn.14011b3b0
mov dword [rsp + 0x37], 0x41324443
mov word [rsp + 0x3b], 0x4537
mov dword [rsp + 0x47], 0x46434243
mov dword [rsp + 0x30], 0x37383843
mov word [rsp + 0x3e], 0x3646
mov word [rsp + 0x4f], 0x39
mov word [rsp + 0x34], 0x3444
mov dword [rsp + 0x43], 0x42413436
mov word [rsp + 0x4c], 0x4638
mov word [rsp + 0x41], 0x4232
mov byte [rsp + 0x4e], 0x39
mov byte [rsp + 0x36], 0x32
mov byte [rsp + 0x4b], 0x36
mov byte [rsp + 0x3d], 0x39
mov byte [rsp + 0x40], 0x44
lea r8, [rsp + 0x30]
mov edx, 0x400
lea rcx, [rbp + 0x820]
call fcn.1401296fc
lea rcx, [rbp + 0x3a0]
call fcn.140095060
nop
mov dword [rsp + 0x20], 0x10
mov r9d, 0x20
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0x820]
lea rcx, [rbp + 0x3a0]
call fcn.1400950a0
mov r9, qword [rsp + 0x60]
sub r9, qword [rsp + 0x58]
mov dword [rsp + 0x20], 1
lea r8, [rbp + 0xc20]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x3a0]
call fcn.140096870
lea rdx, [rbp + 0xc20]
add rdx, rsi
mov qword [rdi], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14004cea4
mov r8, rbx
mov rcx, rdi
call fcn.140004130
nop
lea rcx, [rbp + 0x3a0]
call fcn.140095080
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14004cefe
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cef9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cf1e
call fcn.140118214
mov rax, rdi
lea r11, [rsp + 0x1120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1401293fc
nop
call fcn.1401293fc
nop
int3
Function at 0x1400943d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rdx
xor edi, edi
mov dword [rbp - 0x30], edi
lea rdx, [rbp - 0x28]
call fcn.140094530
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
mov dword [rbp - 0x30], 1
lea ecx, [rdi + 0x30]
call fcn.1401181d8
mov qword [rbx + 0x10], 0x20
mov qword [rbx + 0x18], 0x2f
movzx ecx, byte [rbx]
mov byte [rax], cl
mov qword [rbx], rax
mov qword [rbx + 0x10], rdi
nop word [rax + rax]
mov dword [rbp - 0xd], 0x65646362
mov dword [rbp - 0x18], 0x33323130
mov word [rbp - 9], 0x66
mov word [rbp - 0x10], 0x3938
mov word [rbp - 0x13], 0x3635
mov byte [rbp - 0x11], 0x37
mov byte [rbp - 0xe], 0x61
mov byte [rbp - 0x14], 0x34
movzx esi, byte [rbp + rdi - 0x28]
mov eax, esi
shr rax, 4
movzx r9d, byte [rbp + rax - 0x18]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400944a9
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x14009449e
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400944b8
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.14001d4a0
and esi, 0xf
movzx r9d, byte [rbp + rsi - 0x18]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400944ed
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1400944e2
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400944fc
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.14001d4a0
inc rdi
cmp rdi, 0x10
jl 0x140094440
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400965e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x40
cmp byte [rcx + 8], 0
mov r12, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400967f5
test r9, r9
je 0x1400967d2
movsxd r8, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
div r8
test rdx, rdx
jne 0x1400967d2
mov ecx, dword [rsp + 0x80]
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
cmp ecx, 1
jne 0x1400966f2
mov r15d, ebp
test rax, rax
je 0x1400966d5
lea r14, [rbx + 0x3f8]
nop dword [rax + rax]
mov rax, r14
cmp byte [rbx + 8], bpl
je 0x140096818
mov edx, ebp
test r8d, r8d
jle 0x140096695
mov r8, rsi
sub r8, r14
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, dword [rbx + 0x3d0]
jl 0x140096680
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.140095ed0
movsxd r8, dword [rbx + 0x3d0]
mov rdx, rdi
mov rcx, r14
call fcn.14011ad00
movsxd r8, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div r8
add rsi, r8
movsxd rcx, r15d
add rdi, r8
cmp rcx, rax
jb 0x140096660
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
cmp ecx, 2
jne 0x140096792
mov r15d, ebp
test rax, rax
je 0x1400966d5
mov r8, rdi
lea rdx, [rbx + 0x3f8]
mov rcx, rbx
call fcn.140095ed0
mov rcx, rdi
cmp byte [rbx + 8], bpl
je 0x14009683b
mov eax, dword [rbx + 0x3d0]
mov edx, ebp
test eax, eax
jle 0x140096757
mov r8, rsi
sub r8, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
inc edx
xor byte [rcx], al
lea rcx, [rcx + 1]
mov eax, dword [rbx + 0x3d0]
cmp edx, eax
jl 0x140096740
movsxd r8, eax
lea rcx, [rbx + 0x3f8]
mov rdx, rdi
call fcn.14011ad00
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x140096703
jmp 0x1400966d5
test rax, rax
je 0x1400966d5
nop dword [rax + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140095ed0
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc ebp
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, ebp
cmp rcx, rax
jb 0x1400967a0
jmp 0x1400966d5
mov rdx, qword [str.Data_not_multiple_of_Block_Size]
lea rcx, [rsp + 0x20]
call fcn.140096ae0
lea rdx, [0x1401c4b08]
lea rcx, [rsp + 0x20]
call fcn.140119b2c
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.140096ae0
lea rdx, [0x1401c4b08]
lea rcx, [rsp + 0x20]
call fcn.140119b2c
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.140096ae0
lea rdx, [0x1401c4b08]
lea rcx, [rsp + 0x20]
call fcn.140119b2c
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.140096ae0
lea rdx, [0x1401c4b08]
lea rcx, [rsp + 0x20]
call fcn.140119b2c
int3
Function at 0x140096870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
sub rsp, 0x40
cmp byte [rcx + 8], 0
mov r12, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140096a75
test r9, r9
je 0x140096a52
movsxd rcx, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
div rcx
test rdx, rdx
jne 0x140096a52
mov ecx, dword [rsp + 0x80]
mov qword [rsp + 0x60], rbp
xor ebp, ebp
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r15
cmp ecx, 1
jne 0x140096977
mov r15d, ebp
test rax, rax
je 0x14009695a
nop dword [rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140096250
mov rcx, rdi
cmp byte [rbx + 8], bpl
je 0x140096a98
mov eax, dword [rbx + 0x3d0]
mov edx, ebp
test eax, eax
jle 0x140096928
lea r8, [rbx + 0x3f8]
sub r8, rdi
movzx eax, byte [r8 + rcx]
inc edx
xor byte [rcx], al
lea rcx, [rcx + 1]
mov eax, dword [rbx + 0x3d0]
cmp edx, eax
jl 0x140096911
movsxd r8, eax
lea rcx, [rbx + 0x3f8]
mov rdx, rsi
call fcn.14011ad00
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x1400968e0
mov r14, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
cmp ecx, 2
jne 0x140096a0f
mov r15d, ebp
test rax, rax
je 0x14009695a
nop dword [rax + rax]
mov r8, rdi
lea rdx, [rbx + 0x3f8]
mov rcx, rbx
call fcn.140095ed0
mov rax, rdi
cmp byte [rbx + 8], bpl
je 0x140096abb
mov ecx, dword [rbx + 0x3d0]
mov edx, ebp
test ecx, ecx
jle 0x1400969d8
mov r8, rsi
sub r8, rdi
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
mov ecx, dword [rbx + 0x3d0]
cmp edx, ecx
jl 0x1400969c1
movsxd r8, ecx
mov rdx, rsi
lea rcx, [rbx + 0x3f8]
call fcn.14011ad00
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x140096990
jmp 0x14009695a
test rax, rax
je 0x14009695a
nop dword [rax + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.140096250
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r12
inc ebp
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, ebp
cmp rcx, rax
jb 0x140096a20
jmp 0x14009695a
mov rdx, qword [str.Data_not_multiple_of_Block_Size]
lea rcx, [rsp + 0x20]
call fcn.140096ae0
lea rdx, [0x1401c4b08]
lea rcx, [rsp + 0x20]
call fcn.140119b2c
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.140096ae0
lea rdx, [0x1401c4b08]
lea rcx, [rsp + 0x20]
call fcn.140119b2c
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.140096ae0
lea rdx, [0x1401c4b08]
lea rcx, [rsp + 0x20]
call fcn.140119b2c
int3
mov rdx, qword [str.Object_not_Initialized]
lea rcx, [rsp + 0x20]
call fcn.140096ae0
lea rdx, [0x1401c4b08]
lea rcx, [rsp + 0x20]
call fcn.140119b2c
int3
Function at 0x140096b50
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov rax, rcx
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x140096ba0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rax, r8
xor ecx, ecx
mov rdi, rdx
mov r8, r9
mov rdx, rax
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x28], rcx
mov rcx, rbx
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
call fcn.140096cc0
mov rdx, rdi
mov rcx, rbx
call fcn.140096db0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140099d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
movsxd rbx, edx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x200
call fcn.14011b3b0
mov r10d, 0x6f
mov dword [rbp + 0x1e0], 0x200
mov eax, 0x68
mov dword [rsp + 0x70], 0x740066
mov word [rbp - 0x76], ax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x30]
mov dword [rbp - 0x7a], 0x700061
lea r8d, [r10 + 3]
mov dword [rsp + 0x74], 0x43005c
mov word [rsp + 0x68], r8w
lea r12d, [r10 - 0x22]
mov word [rbp - 0x7c], r8w
mov r9d, 0x20019
xor r8d, r8d
mov dword [rsp + 0x6a], 0x73006f
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x58], 0x410057
mov dword [rsp + 0x78], 0x790072
mov dword [rsp + 0x60], 0x4d005c
mov dword [rsp + 0x7c], 0x740070
mov dword [rsp + 0x64], 0x630069
mov dword [rbp - 0x80], 0x67006f
mov dword [rsp + 0x5c], 0x450052
mov dword [rsp + 0x50], 0x4f0053
mov dword [rsp + 0x54], 0x540046
mov dword [rbp - 0x74], 0x79
mov word [rsp + 0x6e], r10w
mov qword [rsp + 0x20], rax
call fcn.140052750
test eax, eax
jne 0x140099f55
mov rcx, qword [rsp + 0x30]
lea r9, [rbp + 0x1e8]
mov eax, 0x68
mov dword [rsp + 0x40], 0x6e0069
mov word [rsp + 0x3e], ax
lea rdx, [rsp + 0x38]
lea rax, [rbp + 0x1e0]
mov dword [rsp + 0x4c], 0x64
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp - 0x70]
mov dword [rsp + 0x44], 0x470065
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3a], 0x630061
mov dword [rsp + 0x48], 0x690075
mov word [rsp + 0x38], r12w
call fcn.140052870
test eax, eax
je 0x140099f35
lea rax, [rsp + 0x30]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call fcn.140052750
test eax, eax
jne 0x140099f55
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e8]
lea rax, [rbp - 0x70]
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140052870
test eax, eax
jne 0x140099f55
mov rdx, rbx
lea r8, [rbp - 0x70]
mov r9, 0xffffffffffffffff
mov rcx, rdi
call fcn.140145e80
mov rcx, qword [rsp + 0x30]
call fcn.140052b00
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009c2d2
Capabilities:
Parse pe header

Disassembly:
ja 0x14009c310
invalid
jb 0x14009c374
push 0x7a224059
pop r12
jp 0x14009c396
jle 0x14009c386
js 0x14009c399
xor cl, byte [rbp + 0x31]
invalid
invalid

Function at 0x14009c3c9
Capabilities:
Parse pe header

Disassembly:
or dword [rsi - 0x7b], 0x52
jle 0x14009c412
add byte [rsi + 0x79], 0x4e
jp 0x14009c41e
add dword [rdi + 0x7e], 0x50
xchg dword [rdi + 0x7c], eax
jns 0x14009c430
add byte [rbx + rax*4 + 0x45], 0x80
jg 0x14009c42b
xchg dword [rbx - 0x80], eax
invalid

Function at 0x14009c423
Capabilities:
Parse pe header

Disassembly:
imul ebx, dword [rbp + 0x59], 0x6b5c6c28
jo 0x14009c451
jb 0x14009c45a
insb byte [edi], dx
xor ah, byte [rcx + 0x5a]
imul ebp, dword [rax + 0x6e], 0x2c
and al, 0x59
jo 0x14009c483
outsb dx, byte [rsi]
push rsp
xor dword [rbx], esp
xor byte [esi + ebp*2], bh

Function at 0x14009c43d
Capabilities:
Parse pe header

Disassembly:
outsb dx, byte [rsi]
xor dword [rcx + rax*2], ebp
push rax
jp 0x14009c469
jge 0x14009c457
jge 0x14009c457
jnp 0x14009c478
jbe 0x14009c43a
and byte ss:[rdx], dh
insd dword [rdi], dx
push rsi
invalid
mov ebx, 0xc179b976
jl 0x14009c402
jl 0x14009c403
jns 0x14009c3fd
jp 0x14009c3fe
sub dword [rdi + rdx*2], 0x7020575a
sub ch, byte [rdi + 0x72]
pop rax
xor byte [rdi + riz*2], ah
and byte [rbx + 0x54], dh
and al, 0x44
pop rdx
jl 0x14009c49f
outsd dx, dword [rsi]
sub al, 0x5a
cmp bh, byte [rsi]
push rbx
wait
pop rcx
xchg edi, eax
pop rsi
xchg esp, eax

Function at 0x14009c44b
Capabilities:
Parse pe header

Disassembly:
outsb dx, byte [rsi]
xor dword [rcx + rax*2], ebp
push rax
jp 0x14009c469
jge 0x14009c457
jge 0x14009c457
jnp 0x14009c478
jbe 0x14009c43a
and byte ss:[rdx], dh
insd dword [rdi], dx
push rsi
invalid
mov ebx, 0xc179b976
jl 0x14009c402
jl 0x14009c403
jns 0x14009c3fd
jp 0x14009c3fe
sub dword [rdi + rdx*2], 0x7020575a
sub ch, byte [rdi + 0x72]
pop rax
xor byte [rdi + riz*2], ah
and byte [rbx + 0x54], dh
and al, 0x44
pop rdx
jl 0x14009c49f
outsd dx, dword [rsi]
sub al, 0x5a
cmp bh, byte [rsi]
push rbx
wait
pop rcx
xchg edi, eax
pop rsi
xchg esp, eax

Function at 0x14009c4a5
Capabilities:
Parse pe header

Disassembly:
sub byte [rbp + 0x5c], al
pop rcx
pop r14
je 0x14009c4eb
invalid
fiadd word [rsi + rbx*8 + 0x40]
ror dword [rsi - 0x22], cl
loopne 0x14009c543
fiadd dword [rbx - 0x23]
invalid
push rsp
push bp
outsb dx, byte [rsi]
pop rcx
insd dword [rdi], dx
outsb dx, byte [rsi]
pop rax
outsd dx, dword [rsi]
invalid

Function at 0x14009c4c4
Capabilities:
Parse pe header

Disassembly:
xchg esp, eax
pop rax
nop
pop r12
sar dword [rbx - 0x24], cl
js 0x14009c4a6
js 0x14009c49c
insd dword [rdi], dx
shr byte [rdi + 0x46], 1
jp 0x14009c546
pop rdx
jp 0x14009c551
jnp 0x14009c4fc
imul r9d, dword [rdx + 0x57], 0x73
invalid
fiadd word [r8 - 0x28]
ror byte [r9 - 0x2f], cl
loopne 0x14009c547
rol dword [rsi - 0x2f], cl
fmul dword [rdx - 0x20]
fimul word [rbp - 0x21]
fadd qword [rdx - 0x28]
fild dword [rdx - 0x22]
push bp
push rbp
pop rax
insb byte [rdi], dx
insd dword [rdi], dx
movsxd r9, dword [rdi + 0x65]
push rcx
outsb dx, byte [rsi]
outsb dx, byte [rsi]
jno 0x14009c5b5
jno 0x14009c5be
invalid
push rdi
push 0x51
Function at 0x14009c4ce
Capabilities:
Parse pe header

Disassembly:
xchg esp, eax
pop rax
nop
pop r12
sar dword [rbx - 0x24], cl
js 0x14009c4a6
js 0x14009c49c
insd dword [rdi], dx
shr byte [rdi + 0x46], 1
jp 0x14009c546
pop rdx
jp 0x14009c551
jnp 0x14009c4fc
imul r9d, dword [rdx + 0x57], 0x73
invalid
fiadd word [r8 - 0x28]
ror byte [r9 - 0x2f], cl
loopne 0x14009c547
rol dword [rsi - 0x2f], cl
fmul dword [rdx - 0x20]
fimul word [rbp - 0x21]
fadd qword [rdx - 0x28]
fild dword [rdx - 0x22]
push bp
push rbp
pop rax
insb byte [rdi], dx
insd dword [rdi], dx
movsxd r9, dword [rdi + 0x65]
push rcx
outsb dx, byte [rsi]
outsb dx, byte [rsi]
jno 0x14009c5b5
jno 0x14009c5be
invalid
push rdi
push 0x51

Function at 0x14009c51a
Capabilities:
Parse pe header

Disassembly:
jl 0x14009c583
outsb dx, byte [rsi]
sub ebx, dword [rbp + 0x7c]
push rcx
push rsp
pop r12
push rdx
je 0x14009c59f
outsd dx, dword [rsi]
invalid
push rbx
invalid
pop rcx
insd dword [rdi], dx
imul r11, qword [r9 + 0x6f], 0x53
insb byte [rdi], dx
push rsi
outsb dx, byte fs:[rsi]
push rbp
push 0x63566b54
push rbp
push 0x6a576253
push rcx
jo 0x14009c60b
push 0x57
push rcx
pop rax
push rax
imul ecx, dword [rsi + 0x6a], 0x64596858
push rdx
jno 0x14009c619
insb byte [rdi], dx
pop rdx
insd dword [rdi], dx
pop rcx
imul ecx, dword [rdi + riz*2 + 0x58], 0x596f4c64
push rbx
push rax
imul edx, dword [rdi + 0x67], 0x4e
push 0x705a7055
push rbx
push 0x675a635a
push rcx
outsb dx, byte [rsi]
push rdx
outsd dx, dword [rsi]
pop rdx
pop rax
invalid
pop rax
outsd dx, dword [rsi]
outsd dx, dword [rsi]
push rsi
imul ecx, dword [rbx + 0x70], 0x62566953
push rdx
insd dword [rdi], dx
push rcx
outsb dx, byte [rsi]
invalid
Function at 0x1400b95b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xad6], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x1400b9679
cmp qword [rcx + 0x270], 0
je 0x1400b962e
mov qword [rsp + 0x40], rbx
call fcn.1400a25d0
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.1400a2a60
mov rcx, qword [rdi + 0x1d8]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x270]
movzx edx, bl
mov rcx, rdi
call fcn.1400a2a60
mov rbx, qword [rsp + 0x40]
jmp 0x1400b9679
mov ecx, esi
test edx, edx
je 0x1400b963e
sub ecx, 1
je 0x1400b963e
cmp ecx, 1
jne 0x1400b9679
mov r9, qword [rdi + 0x1d0]
lea rax, [0x14018f738]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call fcn.140146988
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call fcn.140146988
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400bdb40
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.140164f84
cdqe
add rsp, 0x28
ret
Function at 0x1400c1330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, rdx
movzx edx, byte [rcx]
test dl, dl
je 0x1400c1365
lea r9, [0x14018fee0]
movzx eax, byte [r8]
test al, al
je 0x1400c1365
movzx eax, byte [rax + r9]
movzx edx, dl
cmp byte [rdx + r9], al
jne 0x1400c1377
movzx edx, byte [rcx + 1]
inc rcx
inc r8
test dl, dl
jne 0x1400c1341
xor edx, edx
mov eax, edx
cmp byte [rcx], al
sete al
cmp byte [r8], dl
setne dl
xor eax, edx
ret
xor eax, eax
ret