joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d2e1c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmp r13w, r15w
mov qword [rax + 8], rbx
test r14w, ax
mov qword [rax + 0x10], rbp
clc
cmp spl, 0x38
mov qword [rax + 0x18], rsi
cmp bp, 0x2742
test al, r13b
cmc
mov qword [rax + 0x20], rdi
cmp ax, 0x7f4
clc
push r14
stc
clc
sub rsp, 0x40
jmp 0x1404d2e57
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
shrd rbx, rax, 0x37
rcr bl, cl
mov rbx, rax
cmp r12w, 0x778b
test rax, rax
je 0x1404d2ff2
mov rsi, rax
clc
jmp 0x1404d2e82
cmp word [rax], r14w
je 0x1404d2ecb
or rax, 0xffffffffffffffff
inc rax
cmp dx, 0x664b
cmp word [rsi + rax*2], r14w
jmp 0x1404d2ea2
jne 0x1404d2e90
lea rsi, [rsi + rax*2]
cmc
test r12w, 0x399a
add rsi, 2
test si, r14w
clc
cmp word [rsi], r14w
jmp 0x1404d2ec5
jne 0x1404d2e8c
mov qword [rsp + 0x38], r14
dec r8b
rcr r9b, cl
sub r9d, esp
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
cmp bp, 0x6f3
cmovae r8w, r8w
mov r8, rbx
ror r9w, 0x28
sbb r9b, 0xe7
btr r9w, 0xa2
mov r9d, esi
test r14, rdx
cmc
mov dword [rsp + 0x28], r14d
test cx, 0x2089
xor edx, edx
cmp cl, r10b
mov qword [rsp + 0x20], r14
test bpl, 0x85
cmp r12d, 0x41171473
sub ecx, ecx
jmp 0x1404d2f31
call fcn.1404c3178
movsxd rbp, eax
cmp rsi, r12
cmp r11b, 0x4d
stc
test eax, eax
jmp 0x1404d2f48
je 0x1404d2ff2
mov rcx, rbp
jmp 0x1404d2f56
call fcn.1404c30b6
mov rdi, rax
clc
test rax, rax
je 0x1404d2fd7
mov qword [rsp + 0x38], r14
bsf r9w, bx
jmp 0x1404d2f77
mov r9d, esi
sar r8w, cl
cmova r8w, r13w
mov qword [rsp + 0x30], r14
movsxd r8, ebx
movsx r8w, cl
shl r8b, 0x36
mov r8, rbx
test r14w, r11w
mov dword [rsp + 0x28], ebp
clc
stc
sub edx, edx
sub ecx, ecx
jmp 0x1404d2faa
mov qword [rsp + 0x20], rax
jmp 0x1404d2fb4
call fcn.1404c3178
test eax, eax
jmp 0x1404d2fc0
je 0x1404d2fd7
mov rsi, rdi
cmovb di, ax
bswap edi
mov rdi, r14
jmp 0x1404d2fe0
mov rsi, r14
bswap cx
xchg cx, cx
mov rcx, rdi
jmp 0x1404d2fe8
call fcn.1404c3032
jmp 0x1404d2ffe
mov rsi, r14
test sil, 0xa
jmp 0x1404d2ffe
test rbx, rbx
jmp 0x1404d3006
je 0x1404d3015
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
rcl dil, cl
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
movzx r14, r14w
pop r14
jmp 0x1404d303e
ret
Function at 0x1404d303f
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
test r11b, al
stc
clc
mov qword [rsp + 0x18], rsi
jmp 0x1404d305e
push rdi
sub rsp, 0x20
jmp 0x1404d3068
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
cmp r8w, 0x6bb5
dec bx
bsr bx, r10w
mov rbx, rax
stc
test rax, rax
jmp 0x1404d308a
je 0x1404d315c
mov rbp, rax
cmc
stc
cmp word [rax], si
jmp 0x1404d309d
je 0x1404d30e3
or rax, 0xffffffffffffffff
jmp 0x1404d30ac
inc rax
test r15b, dl
cmp word [rbp + rax*2], si
jmp 0x1404d30bc
jne 0x1404d30ac
lea rbp, [rbp + rax*2]
test bp, 0xfcd
add rbp, 2
test r11w, sp
cmp word [rbp], si
jmp 0x1404d30dd
jne 0x1404d30a3
sub rbp, rbx
bsf cx, di
add rbp, 2
or ecx, 0x49da24ac
sar rbp, 1
sub cx, bx
add rbp, rbp
movzx ecx, dx
movzx rcx, dx
mov rcx, rbp
jmp 0x1404d310c
call fcn.1404c30b6
mov rdi, rax
clc
test rax, rax
je 0x1404d3147
mov r8, rbp
mov ecx, 0x445928df
movsxd rcx, r12d
mov rdx, rbx
movzx rcx, di
movsx ecx, cx
mov rcx, rax
call fcn.14049d2da
mov rsi, rdi
test r14w, 0x77b0
test r9b, bpl
xor ecx, ecx
jmp 0x1404d314e
call fcn.1404c3032
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
stc
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
mov di, r12w
setge dil
xchg dil, dil
pop rdi
jmp 0x1404d3184
ret
Function at 0x1404d5ece
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov ax, di
cwde
jmp 0x1404d5efb
mov qword [rsp + 0x18], rbp
mov al, r15b
push rsi
not ah
cwde
push rdi
movsxd rax, edx
movzx rax, r8w
push r14
cbw
bswap ax
movsx ax, r9b
mov eax, 0x1450
jmp 0x1404d5f25
call fcn.14044246e
sub rsp, rax
stc
jmp 0x1404d5f33
mov rax, qword [0x1400b7288]
shld r14w, r12w, 0xe6
xor rax, rsp
test r8w, 0x5767
mov qword [rsp + 0x1440], rax
movsxd r10, edx
xchg r14w, bp
mov rdi, rcx
sal cl, cl
mov rax, r10
mov ebp, r9d
movzx ecx, ax
sar rax, 6
lea rcx, [0x1400ba940]
or si, 0x1f9d
and r10d, 0x3f
shl sil, cl
add r14d, 0x6e1548a8
lea rbp, [rbp + r8]
ror r14, 0x98
mov rsi, r8
ror r14d, cl
mov rax, qword [rcx + rax*8]
btc r14d, 0xd3
lea rdx, [r10 + r10*8]
ror r14b, cl
sar r14w, 0xb4
mov r14, qword [rax + rdx*8 + 0x28]
cmc
sub eax, eax
mov qword [rdi], rax
cmp r8b, spl
cmp r8w, 0x1787
mov dword [rdi + 8], eax
cmp edx, r14d
cmc
cmp r8, rbp
jmp 0x1404d5fcb
jae 0x1404d60c7
lea rbx, [rsp + 0x40]
cmp rcx, rdi
stc
cmp r13d, 0x285b2595
cmp rsi, rbp
jmp 0x1404d5fe9
jae 0x1404d6045
mov al, byte [rsi]
jmp 0x1404d5ff6
inc rsi
cmp al, 0xa
jne 0x1404d6014
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404d600c
inc rbx
jmp 0x1404d6014
mov byte [rbx], al
cwde
not ax
inc rbx
dec eax
and ah, dl
xadd ax, ax
lea rax, [rsp + 0x143f]
test r9w, 0x7817
test bx, r13w
cmp rbx, rax
jmp 0x1404d603f
jb 0x1404d5fe1
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
and cx, 0x173a
movsxd rcx, ebp
test cl, r15b
sub ebx, eax
lea r9, [rsp + 0x30]
jmp 0x1404d6068
mov r8d, ebx
lea rdx, [rsp + 0x40]
movsx ecx, di
movzx cx, bpl
mov rcx, r14
jmp 0x1404d6080
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d608d
je 0x1404d60ba
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404d60a1
jb 0x1404d60c7
cmp rsi, rbp
jmp 0x1404d60af
jb 0x1404d5fd1
jmp 0x1404d60c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
movzx ax, r9b
mov rax, rdi
btr cx, cx
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404d60de
call fcn.1404996f5
lea r11, [rsp + 0x1450]
movsx rbp, ax
not bpl
jmp 0x1404d60f7
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movzx r14w, r12b
mov rsp, r11
movsxd rsi, r11d
mov dil, 0x73
pop r14
pop rdi
movsx esi, r8w
seta sil
pop rsi
jmp 0x1404d611e
ret
Function at 0x1404d611f
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cdqe
movzx ax, r12b
cmovae rax, rsi
mov qword [rsp + 0x18], rbp
movsx eax, bx
movzx ax, r11b
push rsi
cbw
lahf
push rdi
mov ax, 0x73c1
movzx rax, r11w
push r14
not ax
movzx rax, dx
bswap rax
mov eax, 0x1450
call fcn.14044246e
sub rsp, rax
shld rdi, rsp, 0xa1
sar r10w, cl
mov rax, qword [0x1400b7288]
rol r10b, cl
xor rax, rsp
neg di
bts bp, r8w
xchg r10w, bp
mov qword [rsp + 0x1440], rax
adc dil, spl
bt r14w, 0xba
movsxd r10, edx
mov rdi, rcx
mov rax, r10
sar cl, cl
bt rcx, 0x71
movzx dx, r15b
mov ebp, r9d
add r14b, 0x3b
sar rax, 6
sar sil, 0x6b
rcl dx, cl
lea rcx, [0x1400ba940]
shr edx, cl
movsx r14d, r8w
and r10d, 0x3f
add rbp, r8
movsx edx, r9w
mov rsi, r8
bsr r14w, di
rcr dh, 0xef
mov rax, qword [rcx + rax*8]
sal dl, cl
test dil, 0x81
bt r14, rax
lea rdx, [r10 + r10*8]
rcl r14w, cl
mov r14, qword [rax + rdx*8 + 0x28]
clc
cmp spl, 0x7c
xor eax, eax
test r12b, 0xfe
clc
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404d6214
jae 0x1404d6339
lea rbx, [rsp + 0x40]
cmp dh, 0x20
cmp rsi, rbp
jae 0x1404d6288
movzx eax, word [rsi]
cmc
add rsi, 2
cmp ax, 0xa
jmp 0x1404d623c
jne 0x1404d6267
add dword [rdi + 8], 2
btc cx, ax
inc cl
or ch, 9
mov ecx, 0xd
cmc
test ch, ah
mov word [rbx], cx
cmc
add rbx, 2
stc
test r13d, 0x78270e81
mov word [rbx], ax
add rbx, 2
xor rax, rsi
lea rax, [rsp + 0x143e]
clc
cmp rbx, rax
jmp 0x1404d6282
jb 0x1404d6222
and qword [rsp + 0x20], 0
or edx, r9d
movsx rdx, r15w
cwde
lea rax, [rsp + 0x40]
btr r9w, 0xfd
shr edx, cl
sub rbx, rax
bswap r8
lea r9, [rsp + 0x30]
not edx
movsx ecx, bx
sal dh, 0x32
sar rbx, 1
lea rdx, [rsp + 0x40]
xor r8b, 0xa8
btc r8w, 0x44
mov cx, 0x3f48
add ebx, ebx
bswap r8w
movsx r8d, si
setne ch
mov rcx, r14
cmovnp r8w, ax
movsx r8, sp
movsx r8w, al
mov r8d, ebx
jmp 0x1404d62f2
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d62ff
je 0x1404d6331
mov eax, dword [rsp + 0x30]
cmc
test r9d, esp
stc
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404d6318
jb 0x1404d6339
cmp rsi, rbp
jmp 0x1404d6326
jb 0x1404d621a
jmp 0x1404d6339
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
movsx ecx, r15w
sal ch, cl
rcr cx, 0x80
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
call fcn.1404996f5
lea r11, [rsp + 0x1450]
movzx r14d, dx
mov rbx, qword [r11 + 0x20]
mov r14, rax
movzx ebp, cx
mov rbp, qword [r11 + 0x30]
movsx si, cl
movzx edi, r9w
mov rsp, r11
bswap r14w
mov r14, 0x79475424
movzx r14w, r8b
pop r14
bswap rsi
pop rdi
movsx esi, r11w
pop rsi
ret
Function at 0x1404d6397
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
not ah
mov ax, r14w
push rsi
jmp 0x1404d63c8
push rdi
cwde
movzx rax, cx
push r12
movsx ax, al
cmovp ax, ax
push r14
movzx rax, r10w
push r15
mov eax, 0x1470
jmp 0x1404d63ea
call fcn.14044246e
sub rsp, rax
movzx rax, r15w
clc
xor bx, bx
mov rax, qword [0x1400b7288]
xor rax, rsp
btr r15w, 0xdb
movsx rdi, r11w
mov qword [rsp + 0x1460], rax
not r14
mov dil, 0x40
movsxd r10, edx
sar dx, 0xae
shr al, cl
mov rbx, rcx
cdq
mov rax, r10
xadd r12b, cl
jmp 0x1404d6439
mov r14d, r9d
sar rax, 6
lea rcx, [0x1400ba940]
bt rdi, r15
shr dh, cl
shl edx, 0x3e
and r10d, 0x3f
add r14, r8
adc dl, r9b
movsxd r15, esi
mov r15, r8
or dil, r9b
or dh, 0xa0
mov rdi, r8
sub r12b, 0xca
sal rdx, 0x75
rcr r12w, 0xe2
mov rax, qword [rcx + rax*8]
xor dh, 0x2d
lea rdx, [r10 + r10*8]
add r12d, r11d
add r12b, 0xcd
mov r12, qword [rax + rdx*8 + 0x28]
xor eax, eax
test eax, 0x54ac1fbd
mov qword [rbx], rax
clc
jmp 0x1404d649d
cmp r8, r14
jmp 0x1404d64a5
mov dword [rbx + 8], eax
jmp 0x1404d64ad
jae 0x1404d6654
lea rax, [rsp + 0x50]
cmp rdi, r14
jmp 0x1404d64c0
jae 0x1404d6532
movzx ecx, word [rdi]
jmp 0x1404d64d1
add rdi, 2
cmp cx, 0xa
jne 0x1404d64fd
mov edx, 0xd
clc
jmp 0x1404d64ee
mov word [rax], dx
jmp 0x1404d64f6
add rax, 2
cmp spl, r8b
mov word [rax], cx
movzx rcx, r11w
xadd ch, cl
movzx cx, r9b
add rax, 2
cmovb rcx, rsp
bts cx, r13w
lea rcx, [rsp + 0x6f8]
test r11, rsp
cmp rax, rcx
jmp 0x1404d652c
jb 0x1404d64b8
and qword [rsp + 0x38], 0
or r9b, dl
neg ch
lea rcx, [rsp + 0x50]
sbb r8b, spl
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
sub rax, rcx
test r13b, r13b
shld cx, r15w, 0xd
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
sar rax, 1
rol r9b, cl
movsx r9d, r9w
mov qword [rsp + 0x20], rcx
xor r9b, bpl
mov r9, rcx
btc cx, 0x39
mov r9d, eax
clc
mov ecx, 0xfde9
xor edx, edx
jmp 0x1404d6596
call fcn.1404c3178
mov ebp, eax
cmp r10b, 0x19
test r9w, 0x225f
test eax, eax
jmp 0x1404d65ae
je 0x1404d6647
xor esi, esi
test eax, eax
je 0x1404d6634
and qword [rsp + 0x20], 0
test r10, r9
shl cl, 0xa1
shrd rcx, r15, 0xfe
lea rdx, [rsp + 0x700]
mov ecx, esi
bsf r9w, cx
lea r9, [rsp + 0x40]
shld r8d, r14d, 0x33
mov r8d, ebp
cmp cx, 0x62f8
test r14d, 0x26b10f5c
clc
lea rdx, [rdx + rcx]
mov rcx, r12
cmp r11w, r11w
sub r8d, esi
jmp 0x1404d660b
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d6618
je 0x1404d6647
add esi, dword [rsp + 0x40]
jmp 0x1404d6627
cmp esi, ebp
jmp 0x1404d662e
jb 0x1404d65be
mov eax, edi
sub eax, r15d
mov dword [rbx + 4], eax
cmp r11b, cl
cmp rdi, r14
jmp 0x1404d64ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cbw
mov rax, rbp
mov rax, rbx
shr cx, 0x8d
sub cl, 0xa4
sal cx, 0x8b
mov rcx, qword [rsp + 0x1460]
cmp r11b, 0x71
jmp 0x1404d6676
xor rcx, rsp
jmp 0x1404d667e
call fcn.1404996f5
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
movzx rbp, sp
mov r15w, r8w
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
movzx si, r12b
pop r14
xchg sil, dil
movzx esi, r8w
pop r12
mov esi, r10d
setb sil
pop rdi
pop rsi
jmp 0x1404d66be
ret
Function at 0x1404d9ce9
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
jmp 0x1404d9cf4
mov ebx, ecx
mov cl, dl
cqo
lea r9, [0x1400c8ea0]
jmp 0x1404d9d0c
mov ecx, 2
lea r8, [0x1400c8e98]
lea rdx, [0x1400cf758]
jmp 0x1404d9d24
call fcn.1404d9ed4
mov ecx, ebx
stc
cmc
clc
test rax, rax
jmp 0x1404d9d36
je 0x1404d9d50
add rsp, 0x20
bswap bx
pop rbx
jmp 0x1404d9d49
push qword [0x1400b8d90]
ret
add rsp, 0x20
pop rbx
jmp 0x1404d9d5a
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404d9d61
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
rcr r9b, cl
push rdi
sub rsp, 0x20
movzx rbx, r14w
mov rbx, rdx
movzx rdi, si
movzx r9w, dil
not r9b
lea r9, [0x1400c8ea8]
mov edi, ecx
movzx r8d, r14w
movsx edx, r8w
movsx rdx, dx
lea rdx, [0x1400cf748]
movsx rcx, bp
movsxd rcx, eax
mov ecx, 3
movsx r8d, dx
sete r8b
lea r8, [0x1400c8ea0]
jmp 0x1404d9dbd
call fcn.1404d9ed4
mov rdx, rbx
sar cx, 0xbe
bt cx, 0x90
rol rcx, cl
mov ecx, edi
test r11b, r8b
test rax, rax
jmp 0x1404d9dde
je 0x1404d9def
call qword [case.0x14044236c.0]
jmp 0x1404d9df5
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
rcr di, cl
add rsp, 0x20
pop rdi
jmp 0x1404d9e07
ret
Function at 0x1404da756
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test r11w, r12w
mov qword [rsp + 0x10], rbp
jmp 0x1404da76a
mov qword [rsp + 0x18], rsi
push rdi
bsf si, si
sub di, 0x24a1
sub rsp, 0x30
shr sil, 0x37
movsxd rdi, r8d
bts si, si
rcl si, 0xe4
mov r8d, ecx
bt esi, r15d
mov rsi, rdx
cmp rbx, 0x88f6403
stc
test ecx, 0xfffff3ff
jmp 0x1404da7a9
jne 0x1404da7c0
cmp ecx, 0xc00
jmp 0x1404da7ba
jne 0x1404da8f7
test rsi, rsi
jmp 0x1404da7c8
jne 0x1404da7db
test edi, edi
jmp 0x1404da7d5
jg 0x1404da8f7
test edi, edi
js 0x1404da8f7
xor r9d, r9d
cqo
lea rbp, reloc.d2d1.dll_Ordinal_1
mov r10d, 0xe3
lea eax, [r10 + r9]
cdq
xor ch, cl
cmp bh, 0x2a
bt ecx, 0xbd
sub eax, edx
cmp r9b, r8b
sub cl, r9b
movzx cx, spl
mov edx, r8d
movsx cx, bpl
dec cx
shrd rcx, rax, 0x24
sar eax, 1
movsxd rcx, eax
shl rcx, 4
sub edx, dword [rcx + rbp]
jmp 0x1404da831
je 0x1404da881
test edx, edx
movsx cx, dh
mov cx, r11w
lea ecx, [rax - 1]
jmp 0x1404da849
cmovns ecx, r10d
inc eax
movzx r10, r14w
sbb r10d, 0x673e3cd8
test edx, edx
movsx r10d, di
mov r10d, ecx
jmp 0x1404da868
cmovns r9d, eax
stc
test al, 0x7c
cmp r9d, ecx
jmp 0x1404da877
jle 0x1404da7f5
or eax, 0xffffffff
cmc
test eax, eax
js 0x1404da8f7
cdqe
adc cl, 0x49
cmp dh, 0x4a
dec ecx
mov edx, 0x55
add rax, rax
not ch
movzx cx, bl
mov rbp, qword [rbp + rax*8 + 8]
mov rcx, rbp
jmp 0x1404da8ae
call fcn.140211ba8
mov rbx, rax
test edi, edi
jmp 0x1404da8bd
jle 0x1404da8ea
cmp ebx, edi
jge 0x1404da8f7
mov rdx, rdi
cmovns ecx, r13d
mov r8, rbp
mov rcx, rsi
jmp 0x1404da8dd
call fcn.1404c3d40
test eax, eax
jne 0x1404da935
lea eax, [rbx + 1]
jmp 0x1404da8f2
jmp 0x1404da906
xor eax, eax
mov ebx, 0x3881e4b
ror sil, cl
btc si, 0x46
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
and rsi, rbp
xadd sil, sil
mov rsi, qword [rsp + 0x50]
mov dil, 0x68
add rsp, 0x30
movzx rdi, si
not di
movsx edi, r14w
pop rdi
jmp 0x1404da934
ret
and qword [rsp + 0x20], 0
jmp 0x1404da940
xor r9d, r9d
jmp 0x1404da949
xor r8d, r8d
stc
jmp 0x1404da952
xor edx, edx
cmp ch, 0x52
sub ecx, ecx
jmp 0x1404da95e
call fcn.1404afd83
int3
Function at 0x1404dde80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
ror r10b, cl
sub r10, 0x678c2a74
sub rsp, 0x30
shld r10w, cx, 0x58
test r8b, 0xc4
xor eax, eax
mov r10d, ecx
clc
test bl, 0
cmp bpl, 0xef
test rdx, rdx
jmp 0x1404ddeaf
jne 0x1404ddee8
call fcn.1404aeff3
mov ebx, 0x16
mov dword [rax], ebx
jmp 0x1404ddec6
call fcn.1404afcfc
mov eax, ebx
sal bl, 0xd8
xchg ebx, ebx
add rsp, 0x30
movzx rbx, r15w
movsx rbx, cx
movzx ebx, dx
pop rbx
jmp 0x1404ddee7
ret
test r8, r8
jmp 0x1404ddef0
je 0x1404ddeb5
movzx ecx, byte [rsp + 0x60]
stc
mov word [rdx], ax
bsr eax, r15d
bts rax, rsi
lea rax, [rcx + 1]
test r14w, r8w
jmp 0x1404ddf15
cmp r8, rax
jmp 0x1404ddf1d
ja 0x1404ddf37
call fcn.1404aeff3
mov ebx, 0x22
jmp 0x1404ddf32
jmp 0x1404ddebf
lea eax, [r9 - 2]
mov ebx, 0x22
stc
test r12b, 0xa1
cmp eax, ebx
ja 0x1404ddeb5
mov byte [rsp + 0x60], cl
bswap rcx
cmp bx, 0x799b
mov ecx, r10d
and bh, 0x54
add bl, 0x79
shrd bx, r11w, 0x56
add rsp, 0x30
mov bx, sp
movsx bx, spl
pop rbx
jmp 0x1404ddf7a
jmp 0x1404ddf7f
mov qword [rsp + 8], rbx
sbb r10b, 0x18
movsx r11w, r8b
mov qword [rsp + 0x10], rbp
bsr bp, r15w
setnp bpl
rol r11b, 0x50
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
movzx rdi, ax
sub rsp, 0x20
sar dil, 0xd5
sub r15d, r15d
shrd rdi, rax, 0xd3
shld rbx, rdx, 0x80
mov ebp, r9d
sub r10b, r15b
adc r11d, 0x5e5d30de
sar rdi, 0xc0
mov rdi, r8
xor ebx, 0x24bc6b21
btc bx, r13w
movzx rbx, sp
mov r11, rdx
rol bh, cl
bsf r10w, r14w
shl ebx, cl
mov r10, rdx
cmovne ebx, r15d
setnp bh
mov ebx, r15d
stc
jmp 0x1404de007
cmp byte [rsp + 0x60], r15b
jmp 0x1404de011
je 0x1404de042
lea eax, [r15 + 0x2d]
bswap r9d
neg ecx
shr r8b, 0xb0
movsxd r10, ebx
test bl, r15b
mov word [rdx], ax
xadd r9w, r8w
lea ebx, [rax - 0x2c]
or r14b, r9b
lea r10, [rdx + 2]
rcl al, cl
sal r14w, cl
mov r8, r10
bsf si, r10w
xor edx, edx
shr al, cl
lea rsi, [r10 + 2]
rol r9d, 0x2f
lahf
mov eax, ecx
movsx r9, r8w
mov r9, r10
div ebp
shl cx, cl
ror r14, 0x42
mov ecx, eax
cmovle r14w, di
sar al, 0x93
shld r14d, r15d, 0x17
cmp edx, 9
bswap ax
movsx eax, r9w
xchg r14w, ax
mov eax, 0x57
xchg r14w, r14w
lea r14d, [rax - 0x27]
jmp 0x1404de097
cmovbe ax, r14w
jmp 0x1404de0a1
inc rbx
add ax, dx
clc
cmp cl, 0x87
test r15b, 0xf2
mov word [r10], ax
jmp 0x1404de0bc
test ecx, ecx
je 0x1404de0da
mov r10, rsi
jmp 0x1404de0cc
cmp rbx, rdi
jmp 0x1404de0d4
jb 0x1404de04a
cmp rbx, rdi
jmp 0x1404de0e2
jb 0x1404de113
mov word [r11], r15w
call fcn.1404aeff3
mov ebx, 0x22
jmp 0x1404de0fb
mov dword [rax], ebx
jmp 0x1404de102
call fcn.1404afcfc
mov eax, ebx
jmp 0x1404de10e
jmp 0x1404de173
mov word [rsi], r15w
shl ax, cl
movzx rcx, r15w
movzx eax, r9w
movzx eax, word [r8]
movzx ecx, word [r9]
mov word [r9], ax
jmp 0x1404de136
sub r9, 2
cmp bpl, r12b
stc
test r13, 0x354b124e
mov word [r8], cx
jmp 0x1404de153
add r8, 2
cmp r8, r9
jmp 0x1404de15f
jb 0x1404de122
xor eax, eax
sub bx, 0x68f3
cmp r8d, r11d
bts bx, dx
mov rbx, qword [rsp + 0x40]
setne r15b
shr r14, 0xef
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
and dil, 0xf5
shld r14w, r11w, 0xe3
add rsp, 0x20
jmp 0x1404de19d
pop r15
movsx r14w, r8b
movzx r14w, r14b
cmovno r14w, r14w
pop r14
pop rdi
jmp 0x1404de1b6
ret
Function at 0x14000b9fc
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b77c
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba52
mov ecx, 1
call fcn.14000b77c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xor ebx, dword [rbp - 0x281d85f6]
movabs eax, dword [0x2a72e5c30e0eebf1]
hlt
Function at 0x180002d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x90]
add eax, 0x2ba
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x2286
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x3435
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x16b3
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
add eax, 0x2f2
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
xor eax, 0x3605
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
sub eax, 0xb4
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
add eax, 0x10b4
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x88]
xor eax, 0xaec
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0xf02
cmp dword [rsp + 0x28], eax
je 0x180002e44
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x9c]
sub eax, 0x962ff
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x24]
sub eax, 0x5eb
mov dword [rsp + 0x24], eax
jmp 0x180002ee2
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x20], eax
jmp 0x180002e5f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x20], eax
jge 0x180002ee2
mov eax, dword [rsp + 0x38]
sub eax, 0x1f55
sub eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0x3c]
mov ecx, dword [rcx + 0x38]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x78]
and eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x48]
sub eax, 0x21d2
mov dword [rsp + 0x3c], eax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x180002e55
mov eax, dword [rsp + 0x2c]
add rsp, 0x68
ret
Function at 0x180004670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x98]
sub eax, 0xce9
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xa0]
sub eax, 0x19b1
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x70]
add eax, 0x438
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
sub eax, 0x785
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x9ed
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
xor eax, 0x346a
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
add eax, 0x438
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x98]
xor eax, 0x3dce
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x2c], eax
je 0x1800047fc
mov eax, dword [rsp + 0x24]
sub eax, 0x13e5
cmp dword [rsp + 0x2c], eax
jle 0x18000474b
mov rax, qword [rsp + 0x78]
lea rcx, [0x1800b00b0]
mov qword [rax + 0x70], rcx
mov eax, dword [rsp + 0x20]
add eax, 0x9a3
mov dword [rsp + 0x20], eax
jmp 0x1800047fc
mov eax, dword [rsp + 0x30]
or eax, 0x19a5
mov rcx, qword [rsp + 0x78]
sub eax, dword [rcx + 0x2c]
cmp dword [rsp + 0x20], eax
jb 0x1800047fc
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
jmp 0x18000477a
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0xa4]
add eax, dword [rsp + 0x34]
and eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jbe 0x1800047fc
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0xa4]
mov ecx, dword [rcx + 0x98]
xor ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x98]
mov ecx, dword [rsp + 0x38]
or ecx, eax
mov eax, ecx
sub eax, 0x28d2
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x180004770
mov eax, dword [rsp + 0x3c]
add eax, 0x1b16
add rsp, 0x68
ret