joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11990
Capabilities:
Delete file

Disassembly:
sub rsp, 0x68
mov rdx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor ecx, ecx
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x240
mov qword [rsp + 0x40], rax
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x68
ret

Function at 0x119e4
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xb0
mov rsi, rcx
and qword [rax + 0x18], 0
mov rax, cr8
test al, al
je 0x11a11
mov eax, 0xc0000001
jmp 0x11b83
mov edx, 0x1018
mov ecx, 1
mov r8d, 0x666c726e
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x11a39
mov eax, 0xc000009a
jmp 0x11b83
xor edx, edx
mov r8d, 0x1018
mov rcx, rax
call fcn.00017cd0
or rcx, 0xffffffffffffffff
lea r8, [0x0001a150]
xor eax, eax
mov rdi, r8
mov edx, 0x104
repne scasw ax, word [rdi]
not rcx
dec rcx
add ecx, ecx
mov dword [rbx + 0x10], ecx
lea rcx, [rbx + 0x14]
call fcn.00011008
and qword [rbx + 8], 0
lea rcx, [rsp + 0x60]
mov rdx, rsi
mov byte [rbx], 1
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x88], 0
and qword [rsp + 0xa0], 0
and qword [rsp + 0xa8], 0
mov dword [rsp + 0x40], 0x28
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 1
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xd0]
mov edx, 0x110000
mov dword [rsp + 0x80], 0x30
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0x90], rax
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov edi, eax
test eax, eax
jns 0x11b36
mov rcx, cr8
cmp cl, 1
ja 0x11b81
mov edx, 0x666c726e
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x11b81
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0x70]
mov r9d, 0x1018
mov r8, rbx
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edi, eax
mov rcx, cr8
cmp cl, 1
ja 0x11b73
mov edx, 0x666c726e
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x11c0c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x90], rax
or qword [rsp + 0x38], 0xffffffffffffffff
xor ebp, ebp
mov rsi, r8
mov rdi, rcx
mov rbx, rdx
lea r8d, [rbp + 0x28]
lea rcx, [rsp + 0x58]
xor edx, edx
mov dword [rsp + 0x50], ebp
call fcn.00017cd0
xor eax, eax
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov dword [rsp + 0x30], ebp
mov word [rsp + 0x40], bp
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x38]
mov edx, 0x20019
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jl 0x11df1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea r8d, [rbp + 2]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebp
mov edi, eax
jge 0x11d00
cmp eax, 0x80000005
je 0x11d00
cmp eax, 0xc0000023
jne 0x11de4
mov edx, dword [rsp + 0x30]
mov ecx, 1
mov r8d, 0x70767069
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, qword [rsp + 0x38]
mov rbx, rax
cmp rax, rbp
je 0x11de9
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebp
mov edi, eax
jge 0x11d88
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bpl
je 0x11def
mov rcx, cr8
cmp cl, 1
ja 0x11def
mov edx, 0x70767069
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x11def
cmp dword [rsp + 0x84], 4
mov rcx, rsi
jne 0x11dab
mov edx, dword [rsp + 0x30]
mov r9d, dword [rbx + 0xc]
lea r8, [0x00017f90]
call fcn.00011ba0
jmp 0x11dc0
lea r9, [rbx + 0xc]
lea r8, [0x00017fa0]
mov edx, 0x400
call fcn.00011ba0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, bpl
je 0x11de4
mov rax, cr8
cmp al, 1
ja 0x11de4
mov edx, 0x70767069
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.00017920
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x11e1c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x90], rax
or qword [r11 - 0x70], 0xffffffffffffffff
xor esi, esi
lea rcx, [r11 - 0x50]
lea r8d, [rsi + 0x28]
xor edx, edx
mov dword [rsp + 0x50], esi
call fcn.00017cd0
xor eax, eax
lea rdx, [0x00018050]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], esi
mov word [rsp + 0x40], si
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x0003c2c0]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x38]
mov edx, 0x20019
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x11fee
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea r8d, [rsi + 2]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, esi
mov edi, eax
jge 0x11f14
cmp eax, 0x80000005
je 0x11f14
cmp eax, 0xc0000023
jne 0x11fe1
mov edx, dword [rsp + 0x30]
mov ecx, 1
mov r8d, 0x70767069
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, qword [rsp + 0x38]
mov rbx, rax
cmp rax, rsi
je 0x11fe6
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, esi
mov edi, eax
jge 0x11f98
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, sil
je 0x11fec
mov rcx, cr8
cmp cl, 1
ja 0x11fec
mov edx, 0x70767069
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x11fec
cmp dword [rsp + 0x84], 4
jne 0x11fb8
mov r8d, dword [rbx + 8]
lea rdx, [rbx + 0xc]
lea rcx, [0x0001a358]
call fcn.00017980
jmp 0x11fbd
mov edi, 0xc0000001
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, sil
je 0x11fe1
mov rax, cr8
cmp al, 1
ja 0x11fe1
mov edx, 0x70767069
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.00017920
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1201c
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x60
mov rdx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x38], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x20]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x78]
mov edx, 0xf003f
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x48], 0x40
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
test eax, eax
js 0x1208f
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0x78]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
add rsp, 0x60
pop rbx
ret
Function at 0x122d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x2b0
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
or qword [rsp + 0x38], 0xffffffffffffffff
xor eax, eax
xor esi, esi
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x92]
mov r8d, 0x206
xor edx, edx
mov dword [rsp + 0x34], esi
mov word [rsp + 0x40], si
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov word [rsp + 0x90], si
call fcn.00017cd0
mov byte [rsp + 0x30], 1
cmp rbx, rsi
je 0x123ea
cmp rdi, rsi
je 0x123ea
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x38]
mov edx, 0x20019
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x123ea
lea rdx, [0x00017fb0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x34]
mov qword [rsp + 0x28], r11
lea r12d, [rsi + 2]
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x40]
mov r8d, r12d
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, esi
jge 0x12413
cmp eax, 0x80000005
je 0x12413
cmp eax, 0xc0000023
je 0x12413
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.00017920
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop r12
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x34]
mov rcx, rax
cmp rax, rsi
ja 0x12424
mov rbx, rsi
jmp 0x1243a
lea r8, [rsp + 0x30]
mov edx, 0x50766970
call fcn.000121d0
mov rbx, rax
mov eax, dword [rsp + 0x34]
lea rcx, [rsp + 0x34]
lea rdx, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x38]
mov r8d, r12d
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, esi
jge 0x12495
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp rbx, rsi
je 0x123ea
mov rax, cr8
cmp al, 1
ja 0x123ea
mov edx, 0x50766970
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x123ea
cmp dword [rbx + 4], r12d
jne 0x1252a
mov r12d, 0x104
lea r8, [rbx + 0xc]
lea rcx, [rsp + 0x90]
mov rdx, r12
call fcn.00011008
lea rdx, [0x00017fd0]
lea rcx, [rsp + 0x90]
call fcn.0001215c
mov rdx, r12
mov rcx, rdi
cmp eax, esi
je 0x12512
lea r8, [0x00017ea0]
call fcn.00011008
lea r8, [0x00018000]
mov rdx, r12
mov rcx, rdi
call fcn.00011080
lea r8, [rsp + 0x90]
mov rdx, r12
mov rcx, rdi
call fcn.00011080
mov r11d, dword [rbx + 8]
add r11d, 0x1e
jmp 0x12523
lea r8, [rsp + 0x90]
call fcn.00011008
mov r11d, dword [rbx + 8]
mov dword [0x0001a144], r11d
mov rax, cr8
cmp al, 1
ja 0x12540
mov edx, 0x50766970
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x123ef
Function at 0x14230
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdi, rdx
xor r13d, r13d
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
test rax, rax
je 0x143d0
cmp rax, 4
je 0x143d0
cmp dword [rdi + 8], r13d
jge 0x1426c
xor eax, eax
jmp 0x143d2
mov rsi, qword [rdi + 0x10]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x28], r13b
and qword [rsp + 0x20], r13
mov r9d, 0xf003f
xor r8d, r8d
mov edx, 0x200
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_ObOpenObjectByPointer]
test eax, eax
jns 0x142a6
xor eax, eax
jmp 0x143d2
mov edx, dword [rsi + 0x18]
mov ecx, 1
mov r8d, 0x46526c46
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x143ba
mov ecx, dword [rsi + 8]
lea edx, [r13 + rcx]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsi + 0x18]
mov dword [rsp + 0x20], ecx
mov r9, rbx
mov r8d, dword [rsi + 0xc]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov r12d, eax
mov dword [rsp + 0xa8], eax
test eax, eax
js 0x1439d
cmp dword [rsi + 0xc], 0
je 0x14333
cmp dword [rsi + 0xc], 3
jne 0x1439d
lea rcx, [rbx + 4]
mov qword [rsp + 0x58], rcx
movzx ecx, word [rbx]
mov word [rsp + 0x52], cx
mov word [rsp + 0x50], cx
jmp 0x1434a
lea rax, [rbx + 0x10]
mov qword [rsp + 0x58], rax
movzx eax, word [rbx + 0xc]
mov word [rsp + 0x52], ax
mov word [rsp + 0x50], ax
lea rdx, [rsp + 0x50]
mov rcx, qword [rdi]
call fcn.0001400c
test al, al
jne 0x14395
mov rdx, qword [rsi + 0x20]
mov eax, dword [rsp + 0xa0]
mov dword [rdx], eax
mov r8d, dword [rsp + 0xa0]
mov rdx, rbx
mov rcx, qword [rsi + 0x10]
call fcn.00017980
jmp 0x1439d
inc r13d
jmp 0x142cb
test rbx, rbx
je 0x143bd
mov rax, cr8
cmp al, 1
ja 0x143bd
mov edx, 0x46526c46
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x143bd
xor r12d, r12d
mov dword [rdi + 0x18], r12d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x143d2
xor eax, eax
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x14a9c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor r10d, r10d
mov rbx, rdx
mov r11, rcx
mov esi, r10d
cmp r8d, r10d
jbe 0x14b1c
mov edi, r8d
mov ebp, 0xff
lea eax, [r10 + 1]
cdq
and edx, ebp
add eax, edx
and eax, ebp
sub eax, edx
movsxd r10, eax
movzx r8d, byte [r10 + r11]
lea eax, [rsi + r8]
cdq
and edx, ebp
add eax, edx
and eax, ebp
sub eax, edx
movsxd rsi, eax
mov cl, byte [rsi + r11]
mov byte [r10 + r11], cl
mov byte [rsi + r11], r8b
movzx eax, byte [r10 + r11]
add eax, r8d
cdq
and edx, ebp
add eax, edx
and eax, ebp
sub eax, edx
movsxd rcx, eax
mov al, byte [rcx + r11]
xor byte [rbx], al
inc rbx
sub rdi, 1
jne 0x14ac8
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x3e064
Capabilities:
Create device object
Create thread

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.0003e008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.000116f8
Function at 0x140001da9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx + 0x40]
mov rdi, rcx
mov r13, rdx
mov r12d, r9d
mov r15, r8
mov edx, dword [rax + 0x44]
mov ecx, dword [rax + 0x24]
call qword [rdi + 0xd8]
mov rbp, qword [rsp + 0x88]
mov r8d, 4
mov rcx, rax
mov rbx, rax
lea rdx, [rbp + 0x1c]
call fcn.140002ea9
mov rcx, rbx
call fcn.140002e29
movzx ecx, byte [rbp + 0x30]
mov edx, eax
mov byte [rdx + rbx], cl
movzx ecx, byte [rbp + 0x31]
mov byte [rdx + rbx + 1], cl
movzx ecx, byte [rbp + 0x32]
mov byte [rdx + rbx + 2], cl
mov rcx, rbx
movzx eax, byte [rbp + 0x33]
mov byte [rdx + rbx + 3], al
mov byte [rbx + 8], 0x25
call fcn.140002e29
movsxd rsi, eax
mov rcx, rbx
inc rsi
add rsi, rbx
call fcn.140002e29
test eax, eax
je 0x140001e6e
mov ecx, eax
lea r8, [rcx + rbx]
lea r9, [rsi + rcx*2]
nop dword [rax]
movsx edx, byte [r8]
lea r8, [r8 - 1]
mov word [r9], dx
lea r9, [r9 - 2]
add eax, 0xffffffff
jne 0x140001e59
mov edx, eax
mov r8d, 0x104
mov rcx, rsi
movsx eax, byte [rdx + rbx]
mov word [rsi + rdx*2], ax
mov rdx, r15
call qword [rdi + 0x50]
mov rax, qword [rdi + 0x40]
mov edx, dword [rax + 0x44]
mov ecx, dword [rax + 0x24]
call qword [rdi + 0xd8]
mov rcx, qword [rdi + 0x40]
mov r14, rax
mov edx, dword [rcx + 0x44]
mov ecx, dword [rcx + 0x24]
call qword [rdi + 0xd8]
mov r9d, dword [rbp + 0x48]
lea r8, [rsp + 0x78]
mov rdx, rax
mov qword [rsp + 0x20], rbp
mov rcx, r13
mov rsi, rax
call fcn.140002549
mov rdx, rsi
mov rcx, r15
call fcn.140003259
xor edx, edx
mov rcx, r15
call qword [rdi + 0xc0]
xor r12d, dword [rbp + 0x48]
lea r8, [rsp + 0x78]
mov r9d, r12d
mov dword [rsp + 0x78], 0
mov rdx, r14
mov qword [rsp + 0x20], rbp
mov rcx, r13
call fcn.140002549
mov rdx, r14
mov rcx, r15
call fcn.140003259
mov rcx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x78]
mov dword [rcx], eax
mov rcx, rbx
call qword [rdi + 0x60]
test r14, r14
je 0x140001f2a
mov rcx, r14
call qword [rdi + 0x60]
test rsi, rsi
je 0x140001f35
mov rcx, rsi
call qword [rdi + 0x60]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002109
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [rcx + 0x40]
mov rdi, rcx
mov rbx, rdx
mov r14d, r9d
mov r15, r8
mov edx, dword [rax + 0x44]
mov ecx, dword [rax + 0x24]
call qword [rdi + 0xd8]
mov rcx, rax
mov edx, 8
mov rbp, rax
call fcn.1400030d9
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x78]
mov r9d, dword [rsp + 0x80]
mov r8, rbp
mov qword [rsp + 0x28], rcx
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x20], rax
call fcn.140001da9
mov eax, r14d
test r14d, r14d
jne 0x140002191
mov rax, qword [rdi + 0x40]
mov eax, dword [rax + 0x44]
mov edx, eax
mov rax, qword [rdi + 0x40]
mov ecx, dword [rax + 0x24]
call qword [rdi + 0xd8]
mov r8d, r14d
mov rdx, r15
mov rcx, rax
mov rsi, rax
call fcn.140002ea9
mov edx, dword [rsp + 0x78]
xor eax, eax
mov ecx, edx
mov byte [rsp + 0x7b], dl
shr ecx, 0x18
mov byte [rsp + 0x78], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rsp + 0x79], cl
mov ecx, edx
shr ecx, 8
mov byte [rsp + 0x7a], cl
test r14d, r14d
je 0x140002208
mov r8, rsi
mov r9, r14
nop dword [rax + rax]
movzx edx, byte [rsp + rax + 0x78]
mov ecx, eax
xor byte [r8], dl
lea r8, [r8 + 1]
lea edx, [rax + 1]
xor eax, eax
cmp ecx, 3
cmovne eax, edx
sub r9, 1
jne 0x1400021e9
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rbp
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 2]
call qword [rdi + 0x20]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002266
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], 0
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call qword [rdi + 0xb8]
mov rdx, qword [rdi + 0x70]
mov rcx, rbx
test eax, eax
jne 0x140002281
call rdx
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call rdx
test rsi, rsi
je 0x14000228e
mov rcx, rsi
call qword [rdi + 0x60]
test rbp, rbp
je 0x140002299
mov rcx, rbp
call qword [rdi + 0x60]
mov al, 1
jmp 0x140002268
Function at 0x140004b1c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push rdi
sub rsp, 0x4d0
mov rax, qword gs:[0x60]
xor r9d, r9d
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax + 0x30]
mov r11d, dword [rdi + 0xbac52]
mov r10d, dword [rdi + 0xbac4e]
movd xmm1, r11d
pshufd xmm1, xmm1, 0
test r10d, r10d
je 0x140004c73
cmp r10d, 0x10
jb 0x140004c3e
lea ecx, [r10 - 1]
lea rdx, [rsp + 0x60]
lea rdx, [rdx + rcx*4]
lea ecx, [rcx + 2]
lea rax, [rdi + 0xbac4e]
lea rax, [rax + rcx*4]
lea rcx, [rsp + 0x60]
lea r8, [rdi + 0xbac56]
cmp rcx, rax
ja 0x140004b9d
cmp rdx, r8
jae 0x140004c3e
mov qword [rsp + 0x4e0], rbx
mov ebx, r10d
and ebx, 0xfffffff0
mov r8d, 6
nop word [rax + rax]
lea eax, [r8 - 4]
movdqu xmm0, xmmword [rdi + rax*4 + 0xbac4e]
mov eax, r8d
paddd xmm0, xmm1
movdqu xmmword [rsp + r9*4 + 0x60], xmm0
add r9d, 0x10
movdqu xmm0, xmmword [rdi + rax*4 + 0xbac4e]
lea eax, [r8 - 2]
paddd xmm0, xmm1
movdqu xmmword [rsp + rax*4 + 0x60], xmm0
lea eax, [r8 + 4]
movdqu xmm0, xmmword [rdi + rax*4 + 0xbac4e]
lea eax, [r8 + 2]
paddd xmm0, xmm1
movdqu xmmword [rsp + rax*4 + 0x60], xmm0
lea eax, [r8 + 8]
movdqu xmm0, xmmword [rdi + rax*4 + 0xbac4e]
lea eax, [r8 + 6]
add r8d, 0x10
paddd xmm0, xmm1
movdqu xmmword [rsp + rax*4 + 0x60], xmm0
cmp r9d, ebx
jb 0x140004bbc
mov rbx, qword [rsp + 0x4e0]
cmp r9d, r10d
jae 0x140004c73
lea ecx, [r9 + 2]
sub r10d, r9d
lea r8, [rsp + 0x60]
lea rax, [rdi + 0xbac4e]
lea r8, [r8 + r9*4]
mov r9d, r10d
lea rax, [rax + rcx*4]
mov edx, dword [rax]
lea r8, [r8 + 4]
add edx, r11d
lea rax, [rax + 4]
mov dword [r8 - 4], edx
sub r9, 1
jne 0x140004c5c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
mov eax, dword [rsp + 0x170]
add rax, rdi
call rax
add rsp, 0x4d0
pop rdi
ret
Function at 0x140014ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x140014fc6
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r12d, edx
mov rsi, rcx
mov rax, qword [0x1400e0338]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x60], 0
je 0x14001500d
mov edi, dword [rsi + 0x5c]
test r12b, r12b
je 0x140015141
mov dword [rsi + 0x5c], 0xffffffff
mov byte [rsi + 0x60], 0
jmp 0x140015141
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.1400a5270
cmp eax, 0xffffffff
je 0x14001513c
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14001502b
mov byte [rsp + 0x57], 0xaa
cmp byte [rsi + 0x61], 0
je 0x140015072
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x57], al
test r12b, r12b
je 0x140015103
movzx edi, byte [rsp + 0x57]
mov dword [rsi + 0x5c], edi
jmp 0x140015141
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea rax, [rsp + 0x40]
mov qword [rax], r14
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r15d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x57]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x140015129
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r15w
cmp rdi, 8
je 0x14001513c
mov rcx, qword [rsi + 0x40]
call fcn.1400a5270
cmp eax, 0xffffffff
je 0x14001513c
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x140015087
mov edi, edi
test rdi, rdi
jle 0x140015122
mov rdx, qword [rsi + 0x40]
movzx ecx, byte [rsp + rdi + 0x57]
dec rdi
call fcn.1400a6d90
cmp eax, 0xffffffff
jne 0x140015105
jmp 0x14001513c
movzx edi, byte [rsp + 0x57]
jmp 0x140015141
cmp eax, 2
je 0x14001513c
cmp eax, 3
je 0x140015054
jmp 0x14001505c
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008f710
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret