joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100032794
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
cmp dl, sil
jne 0x1000327d1
mov rbx, qword [rcx + 0x48]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r11, qword [rdi + 0x50]
cmp qword [rbx + 0x70], r11
jae 0x1000327d1
mov rbx, qword [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [rbx + 0x78], sil
je 0x100032821
mov rcx, qword [rdi + 0x18]
cmp rcx, 0xffffffffffffffff
cmove rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, esi
jne 0x100032821
mov rcx, qword [0x1000a9e88]
lea rax, [0x1000a9e88]
cmp rcx, rax
je 0x100032815
test byte [rcx + 0x1c], 2
je 0x100032815
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006ec0]
mov edx, 0x10
call fcn.1000179ec
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x10003301c
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x198
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1000a9120]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rsi, r9
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
mov dword [rsp + 0x30], r8d
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000330ec
xor r8d, r8d
lea rdx, [0x100007290]
lea rcx, [rsp + 0xe0]
call fcn.1000547b8
nop
call fcn.100055030
mov edx, eax
lea rcx, [rsp + 0xe0]
call fcn.10005473c
lea rdx, [0x10000a6f8]
lea rcx, [rsp + 0xe0]
call fcn.100054680
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x40]
call fcn.100054614
lea r11, [0x10000a428]
mov qword [rsp + 0x40], r11
lea rdx, [0x1000a6ce0]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
nop
mov ecx, dword [rsp + 0x30]
add qword [rbp + 0x18], rcx
test rsi, rsi
je 0x1000330fb
mov dword [rsi], ecx
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.100057810
add rsp, 0x198
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100052404
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x170
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1000a9120]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r11, rcx
movzx r10d, word [rdx + 4]
rol r10w, 8
mov r9, qword [rcx + 8]
xor r8d, r8d
cmp r9, r8
jne 0x100052446
mov rdx, r8
jmp 0x10005244d
mov rdx, qword [rcx + 0x10]
sub rdx, r9
movzx eax, r10w
shl rax, 4
add rax, 0xc
cmp rdx, rax
jae 0x1000524c9
lea rdx, [0x100007290]
lea rcx, [rsp + 0xc0]
call fcn.1000547b8
nop
mov edx, 0x80004005
lea rcx, [rsp + 0xc0]
call fcn.10005473c
lea rdx, [0x10000ced0]
lea rcx, [rsp + 0xc0]
call fcn.100054680
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x28]
call fcn.100054614
lea r11, [0x10000a428]
mov qword [rsp + 0x28], r11
lea rdx, [0x1000a6ce0]
lea rcx, [rsp + 0x28]
call sub.msvcrt.dll__CxxThrowException
nop
mov ecx, r8d
movzx edx, r10w
cmp edx, r8d
jbe 0x1000525ed
lea rax, [r9 + 0xc]
cmp dword [rax], 0x322f534f
je 0x1000524f4
inc ecx
add rax, 0x10
cmp ecx, edx
jb 0x1000524dd
jmp 0x1000525ed
mov edx, ecx
add rdx, rdx
mov eax, dword [r9 + rdx*8 + 0x14]
mov ecx, eax
shr ecx, 0x10
rol ax, 8
movzx r10d, ax
shl r10d, 0x10
rol cx, 8
movzx eax, cx
or r10d, eax
mov eax, dword [r9 + rdx*8 + 0x18]
mov ecx, eax
shr ecx, 0x10
rol ax, 8
movzx ebx, ax
shl ebx, 0x10
rol cx, 8
movzx eax, cx
or ebx, eax
cmp r9, r8
jne 0x100052540
mov rdx, r8
jmp 0x100052547
mov rdx, qword [r11 + 0x10]
sub rdx, r9
lea ecx, [r10 + rbx]
cmp rdx, rcx
jae 0x1000525bb
lea rdx, [0x100007290]
lea rcx, [rsp + 0xc0]
call fcn.1000547b8
nop
mov edx, 0x80004005
lea rcx, [rsp + 0xc0]
call fcn.10005473c
lea rdx, [0x10000cf10]
lea rcx, [rsp + 0xc0]
call fcn.100054680
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x28]
call fcn.100054614
lea r11, [0x10000a428]
mov qword [rsp + 0x28], r11
lea rdx, [0x1000a6ce0]
lea rcx, [rsp + 0x28]
call sub.msvcrt.dll__CxxThrowException
nop
mov eax, r10d
add rax, r9
je 0x1000525ed
movzx eax, word [rax + 8]
rol ax, 8
test al, 0xfe
je 0x1000525e8
test al, 8
je 0x1000525db
mov r8d, 8
jmp 0x1000525e8
and al, 4
neg al
sbb eax, eax
and eax, 2
lea r8d, [rax + 2]
mov eax, r8d
jmp 0x100052658
lea rdx, [0x100007290]
lea rcx, [rsp + 0xc0]
call fcn.1000547b8
nop
mov edx, 0x80004005
lea rcx, [rsp + 0xc0]
call fcn.10005473c
lea rdx, [0x10000cf60]
lea rcx, [rsp + 0xc0]
call fcn.100054680
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x28]
call fcn.100054614
lea r11, [0x10000a428]
mov qword [rsp + 0x28], r11
lea rdx, [0x1000a6ce0]
lea rcx, [rsp + 0x28]
call sub.msvcrt.dll__CxxThrowException
nop
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.100057810
add rsp, 0x170
pop rbx
ret
Function at 0x1000556a4
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov r13, r8
mov rbp, rdx
mov rsi, rcx
test rdx, rdx
je 0x1000557f6
test r8, r8
je 0x1000557f6
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov eax, ecx
mov r12, rcx
cdq
and edx, 3
add eax, edx
and eax, 3
cmp eax, edx
je 0x100055707
mov eax, 0x80004005
jmp 0x1000557fb
mov eax, ecx
sar eax, 2
lea edi, [rax + rax*2]
movsxd rax, ecx
cmp word [rsi + rax*2 - 2], 0x3d
jne 0x10005571c
dec edi
cmp word [rsi + rax*2 - 4], 0x3d
jne 0x100055726
dec edi
movsxd rcx, edi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdx, rax
test rax, rax
jne 0x100055741
mov ebx, 0x8007000e
jmp 0x1000557d9
mov qword [rbp], rax
mov dword [r13], edi
test r12d, r12d
jle 0x1000557f2
movzx ecx, word [rsi]
call fcn.100055650
and eax, 0x3f
shl eax, 2
cmp eax, 0xffffffff
je 0x1000557d4
mov byte [rdx], al
movzx ecx, word [rsi + 2]
call fcn.100055650
mov edi, eax
cmp eax, 0xffffffff
je 0x1000557d4
mov cl, al
shr cl, 4
add byte [rdx], cl
cmp word [rsi + 4], 0x3d
je 0x1000557a3
shl dil, 4
mov byte [rdx + 1], dil
movzx ecx, word [rsi + 4]
call fcn.100055650
mov edi, eax
cmp eax, 0xffffffff
je 0x1000557d4
shr al, 2
add byte [rdx + 1], al
cmp word [rsi + 6], 0x3d
je 0x1000557c3
shl dil, 6
mov byte [rdx + 2], dil
movzx ecx, word [rsi + 6]
call fcn.100055650
cmp eax, 0xffffffff
je 0x1000557d4
add byte [rdx + 2], al
sub r12d, 4
add rsi, 8
add rdx, 3
jmp 0x100055749
mov ebx, 0x80004005
mov rcx, qword [rbp]
test rcx, rcx
je 0x1000557e8
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbp], 0
and dword [r13], 0
mov eax, ebx
jmp 0x1000557fb
mov eax, 0x80070057
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x10005581c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x38
and qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov rbx, rcx
mov byte [rcx], 0
mov byte [rcx + 1], 0
lea rdx, [0x100006530]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10005597a
and dword [rsp + 0x58], eax
and dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
lea rdx, [0x100006580]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rbp, [0x1000a9e88]
test eax, eax
jne 0x1000558e9
cmp dword [rsp + 0x58], 4
jne 0x1000558e9
cmp dword [rsp + 0x50], 1
jne 0x1000558e9
mov byte [rbx], 1
call fcn.100075798
mov rcx, qword [0x1000a9e88]
cmp rcx, rbp
je 0x1000558e9
bt dword [rcx + 0x1c], 8
jae 0x1000558e9
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006520]
mov edx, 0xa
call fcn.1000179ec
mov rcx, qword [rsp + 0x68]
and dword [rsp + 0x50], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
lea rdx, [0x1000065a8]
xor r8d, r8d
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10005596f
cmp dword [rsp + 0x58], 4
jne 0x10005596f
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x10005596f
mov byte [rbx + 1], 1
call fcn.100055cdc
mov byte [rbx + 1], al
test al, al
je 0x10005596f
mov rcx, qword [0x1000a9e88]
cmp rcx, rbp
je 0x10005596f
bt dword [rcx + 0x1c], 8
jae 0x10005596f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006520]
mov edx, 0xb
call fcn.1000179ec
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x38
pop rbp
pop rbx
ret
Function at 0x100057370
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1000a9120]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x100000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x100057403
cmp dword [rsp + 0x24], 5
jb 0x10005741d
jmp 0x100057419
cmp dword [rsp + 0x30], esi
jne 0x10005741d
cmp dword [rsp + 0x24], 4
ja 0x100057419
jne 0x10005741d
cmp dword [rsp + 0x28], 0
jbe 0x10005741d
mov byte [rbx + 0x18], sil
lea rax, [0x1000017f0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.100015760
movzx ecx, byte [0x1000aae48]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x1000aae48], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.100057810
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x100057cfc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100057d49
cmp rcx, 0xffffffffffffffff
je 0x100057d49
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100057d41
cmp dword [rcx + 0x3c], edx
jl 0x100057d41
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100057d41
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100057d49
mov rax, rdx
add rsp, 0x18
ret

Function at 0x100057f94
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x100057fff
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x10005801f
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x100001890]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x100059e94
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x38
lock bts dword [0x1000aa800], 0x1e
jb 0x100059f41
and qword [rax + 0x20], 0
and dword [rax + 0x18], 0
and dword [rax + 8], 0
mov dword [rax + 0x10], 4
lea rax, [rax + 0x20]
lea rdx, [0x100001fa0]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100059f41
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x100001f78]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100059f36
cmp dword [rsp + 0x40], 4
jne 0x100059f36
cmp dword [rsp + 0x48], 4
jne 0x100059f36
mov eax, dword [rsp + 0x50]
bts eax, 0x1e
mov dword [0x1000aa800], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1000aa800]
add rsp, 0x38
ret
Function at 0x100059f54
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x850
mov rax, qword [0x1000a9120]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rsi, qword [rsp + 0x8b8]
mov ebx, r9d
mov r13d, r8d
mov r14, rdx
mov r12, rcx
call fcn.100059e94
mov ebp, dword [rsp + 0x8b0]
test ebx, eax
je 0x10005a078
xor eax, eax
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x7fe
mov word [rsp + 0x40], ax
call sub.msvcrt.dll_memset
mov eax, ebx
sub eax, 8
je 0x10005a015
sub eax, 0x38
je 0x10005a00c
sub eax, 0x40
je 0x10005a003
sub eax, 0x80
je 0x100059ffa
sub eax, 0x100
je 0x100059ff1
cmp eax, 0x200
je 0x100059fe8
lea rdi, [0x100002108]
jmp 0x10005a01c
lea rdi, [0x1000020f8]
jmp 0x10005a01c
lea rdi, [0x1000020e8]
jmp 0x10005a01c
lea rdi, [0x1000020d8]
jmp 0x10005a01c
lea rdi, [0x1000020c0]
jmp 0x10005a01c
lea rdi, [0x1000020a8]
jmp 0x10005a01c
lea rdi, [0x100002090]
call fcn.100059e94
mov edx, 0x400
lea rcx, [rsp + 0x40]
bt eax, 0x10
jae 0x10005a055
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], ebp
lea r8, [0x100002050]
mov r9, r12
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r13d
call fcn.1000153d8
jmp 0x10005a06d
lea r8, [0x100002018]
mov r9, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
call fcn.1000153d8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
sub ebx, 8
je 0x10005a198
sub ebx, 0x38
je 0x10005a178
sub ebx, 0x40
je 0x10005a158
sub ebx, 0x80
je 0x10005a130
sub ebx, 0x100
je 0x10005a105
cmp ebx, 0x200
je 0x10005a0da
mov rcx, qword [0x1000a9e88]
lea rax, [0x1000a9e88]
cmp rcx, rax
je 0x10005a1dc
test byte [rcx + 0x3c], 0x20
je 0x10005a1dc
mov edx, 0x10
jmp 0x10005a1b6
mov rcx, qword [0x1000a9e88]
lea rax, [0x1000a9e88]
cmp rcx, rax
je 0x10005a1dc
test byte [rcx + 0x3c], 8
je 0x10005a1dc
mov edx, 0xf
jmp 0x10005a1b6
mov rcx, qword [0x1000a9e88]
lea rax, [0x1000a9e88]
cmp rcx, rax
je 0x10005a1dc
test byte [rcx + 0x3c], 2
je 0x10005a1dc
mov edx, 0xd
jmp 0x10005a1b6
mov rcx, qword [0x1000a9e88]
lea rax, [0x1000a9e88]
cmp rcx, rax
je 0x10005a1dc
test byte [rcx + 0x3c], 1
je 0x10005a1dc
mov edx, 0xa
jmp 0x10005a1b6
mov rcx, qword [0x1000a9e88]
lea rax, [0x1000a9e88]
cmp rcx, rax
je 0x10005a1dc
test byte [rcx + 0x3c], 0x40
je 0x10005a1dc
mov edx, 0xe
jmp 0x10005a1b6
mov rcx, qword [0x1000a9e88]
lea rax, [0x1000a9e88]
cmp rcx, rax
je 0x10005a1dc
test byte [rcx + 0x3c], 0x10
je 0x10005a1dc
mov edx, 0xc
jmp 0x10005a1b6
mov rcx, qword [0x1000a9e88]
lea rax, [0x1000a9e88]
cmp rcx, rax
je 0x10005a1dc
test byte [rcx + 0x3c], 4
je 0x10005a1dc
mov edx, 0xb
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], ebp
lea r8, [0x100001f68]
mov r9, r12
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r13d
call fcn.100059d34
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.100057810
add rsp, 0x850
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100075798
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
lea rdx, [0x1000059b0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000758cb
and dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x50]
lea rdx, [0x100005a00]
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x1000aa89c]
test eax, eax
cmove ecx, dword [rsp + 0x40]
mov dword [0x1000aa89c], ecx
test ecx, ecx
je 0x1000758c0
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100005a30]
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x1000a92a8]
lea r9, [rsp + 0x50]
test eax, eax
lea rax, [rsp + 0x48]
lea rdx, [0x100005a68]
cmove ecx, dword [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov dword [0x1000a92a8], ecx
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [0x1000aa8a0]
test eax, eax
cmove ecx, dword [rsp + 0x40]
mov dword [0x1000aa8a0], ecx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1000aa89c], 0
je 0x1000758e6
lea rdx, [0x1000756f8]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
add rsp, 0x38
ret
Function at 0x100077f54
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rbx, rcx
movzx ecx, word [rcx + 6]
mov ebp, 0x7ff
shr cx, 4
mov esi, edx
and cx, bp
cmp cx, bp
jne 0x100077fb9
test byte [rbx + 6], 0xf
jne 0x100077faa
xor edi, edi
cmp word [rbx + 4], di
jne 0x100077faa
cmp word [rbx + 2], di
jne 0x100077faa
cmp word [rbx], di
jne 0x100077faa
lea r10d, [rdi + 1]
jmp 0x100077fb0
mov r10d, 2
mov ax, r10w
jmp 0x1000781d7
xor edi, edi
cmp cx, di
jne 0x100077fd4
mov rcx, rbx
call fcn.10007859c
cmp di, ax
mov cx, ax
jl 0x1000781d4
cmp esi, edi
jle 0x10007800a
movsx eax, cx
sub ebp, eax
cmp ebp, esi
jg 0x10007800a
movsd xmm0, qword [0x1000a93e8]
mov ebp, 0x8000
test word [rbx + 6], bp
je 0x100077ffc
xorpd xmm0, xmmword [0x100003f50]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x1000781d7
movsx edx, cx
mov eax, edx
neg eax
cmp eax, esi
jge 0x100078031
add si, cx
mov eax, 0x800f
and word [rbx + 6], ax
shl si, 4
or word [rbx + 6], si
or eax, 0xffffffff
jmp 0x1000781d7
movzx ecx, word [rbx + 6]
lea r11d, [rsi + rdx - 1]
mov r14d, 0x10
movzx r12d, cx
and cx, 0xf
lea eax, [r11 + 0x35]
or cx, r14w
mov ebp, 0x8000
and r12w, bp
mov word [rbx + 6], cx
cmp eax, 0x34
ja 0x1000781c4
cmp r11w, 0xfff0
movzx esi, di
lea r10d, [r14 - 0xf]
jg 0x1000780d7
movzx edx, word [rbx + 2]
movzx r8d, word [rbx]
mov eax, 0xfff0
sub ax, r11w
mov r13w, cx
movzx ecx, word [rbx + 4]
shr ax, 4
add ax, r10w
movzx r9d, ax
movzx eax, r9w
shl ax, 4
add r11w, ax
cmp si, di
mov eax, edi
setne al
mov si, ax
or si, r8w
sub r9, r10
mov r8w, dx
mov dx, cx
mov cx, r13w
mov r13d, edi
jne 0x1000780a5
mov word [rbx + 6], di
mov word [rbx + 4], cx
mov word [rbx + 2], dx
mov word [rbx], r8w
neg r11w
je 0x100078166
movzx r8d, word [rbx]
mov eax, edi
movsx r9d, r11w
sub r14d, r9d
movzx edx, r8w
mov ecx, r14d
shl dx, cl
cmp si, di
movzx ecx, r11w
setne al
shr r8w, cl
mov si, dx
movzx edx, word [rbx + 2]
or si, ax
mov ecx, r14d
movzx eax, dx
shl ax, cl
movzx ecx, r11w
or r8w, ax
shr dx, cl
mov ecx, r14d
mov word [rbx], r8w
movzx r8d, word [rbx + 4]
movzx eax, r8w
shl ax, cl
movzx ecx, r11w
or dx, ax
shr r8w, cl
mov ecx, r14d
mov word [rbx + 2], dx
movzx edx, word [rbx + 6]
movzx eax, dx
shl ax, cl
mov ecx, r9d
or r8w, ax
shr dx, cl
mov word [rbx + 6], dx
mov word [rbx + 4], r8w
or word [rbx + 6], r12w
movzx eax, word [rbx + 6]
cmp bp, si
jb 0x10007817b
jne 0x10007819c
test byte [rbx], r10b
je 0x10007819c
add word [rbx], r10w
jne 0x10007819c
add word [rbx + 2], r10w
jne 0x10007819c
add word [rbx + 4], r10w
jne 0x10007819c
add ax, r10w
mov word [rbx + 6], ax
jmp 0x100078029
cmp ax, r12w
jne 0x100078029
cmp word [rbx + 4], di
jne 0x100078029
cmp word [rbx + 2], di
jne 0x100078029
cmp word [rbx], di
je 0x1000781d4
jmp 0x100078029
mov word [rbx + 6], r12w
mov word [rbx + 4], di
mov word [rbx + 2], di
mov word [rbx], di
mov ax, di
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x18098c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18098c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18098c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18098c06f
add dl, dl
jne 0x18098c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18098c0f6
xor eax, eax
add dl, dl
jne 0x18098c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18098c1ad
add dl, dl
jne 0x18098c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18098c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18098c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18098c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18098c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18098c07e
mov eax, 1
add dl, dl
jne 0x18098c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18098c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18098c0fb
sub eax, ebx
mov ebx, 1
jne 0x18098c14c
mov ecx, 1
add dl, dl
jne 0x18098c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18098c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18098c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18098c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18098c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18098c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18098c15d
cmp eax, 0x7d00
jae 0x18098c19b
cmp eax, 0x500
jb 0x18098c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18098c07e
cmp eax, 0x7f
ja 0x18098c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18098c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18098c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18098c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20