joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002a10
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400054b0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002a30
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002a38
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002a30
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002a80
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002a77
test rcx, rcx
je 0x140002a30
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140002a68
xor eax, eax
ret

Function at 0x140002a90
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400054b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140002aaf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002ab8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002ad0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400054b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002af0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002af8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002af0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002af0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002b44
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002b50
add rdx, 0x28
cmp rdx, r9
jne 0x140002b30
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002b60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400054b0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002b82
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002b90
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002b82
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002b82
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002b82
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002be5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002bf8
add rdx, 0x28
cmp r10, rdx
jne 0x140002bd0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002c07
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002c17
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002bee
test ecx, ecx
jg 0x140002c00
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1800a6740
Capabilities:
Parse pe header

Disassembly:
sub edx, edx
xor ecx, ecx
jmp 0x1800a6f13
lea r8d, [rdx + 1]
jmp 0x1800b0347
jmp 0x180166243
mov dword [rsp + 0x18], r8d
cmc
mov dword [rsp + 0x10], edx
cmc
cmp rax, r15
push rbp
mov rbp, rsp
test r10w, 0x6194
sub rsp, 0x50
cmc
test bh, 0x86
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jmp 0x18016627a
jne 0x18016630e
xor ecx, ecx
jmp 0x180166287
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x180166295
je 0x18016630e
mov ecx, 0x5a4d
jmp 0x1801662a6
cmp word [rax], cx
jmp 0x1801662ae
jne 0x18016630e
movsxd rcx, dword [rax + 0x3c]
cmc
lea rcx, [rcx + rax]
cmp dword [rcx], 0x4550
jmp 0x1801662c8
jne 0x18016630e
mov eax, 0x20b
cmp edx, 0x4f426b78
cmp word [rcx + 0x18], ax
jne 0x18016630e
cmp dword [rcx + 0x84], 0xe
jmp 0x1801662ef
jbe 0x18016630e
cmp dword [rcx + 0xf8], 0
je 0x18016630e
mov ecx, ebx
jmp 0x180166309
call fcn.18016646d
mov byte [rbp + 0x28], 0
movzx r8, ax
lea rax, [rbp + 0x18]
movsxd r8, esp
mov qword [rbp - 0x18], rax
bswap r8d
movsx edx, si
lea rax, [rbp + 0x20]
cwd
mov qword [rbp - 0x10], rax
cdqe
setae r8b
lahf
lea rax, [rbp + 0x28]
movzx cx, cl
mov ecx, 0x24ef5b50
mov qword [rbp - 8], rax
movzx dx, dl
cbw
movzx rdx, r15w
mov eax, 2
mov dword [rbp - 0x2c], eax
movzx r8w, dil
mov dl, 0x9c
movzx edx, sp
mov dword [rbp - 0x28], eax
movsx r9d, r9w
lea r9, [rbp - 0x2c]
not r8b
setne dh
movzx r8d, sp
lea r8, [rbp - 0x18]
movzx ecx, r12w
jmp 0x180166387
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180166051
nop
test r15b, dl
cmp r14b, 0xd8
cmp dword [rbp + 0x20], 0
je 0x1801663b9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
mov bp, bp
pop rbp
jmp 0x1801663b8
ret
mov ecx, ebx
jmp 0x1801663c0
call fcn.1801663cb
int3

Function at 0x1800a86a8
Capabilities:
Enumerate pe sections

Disassembly:
ret
movsxd r8, dword [rcx + 0x3c]
sub r9d, r9d
lea r8, [r8 + rcx]
mov r10, rdx
mov ax, bx
movzx eax, word [r8 + 0x14]
rcl r11b, 0x32
stc
bt r11w, ax
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
cmp esi, 0x6e95662c
test r11d, r11d
je 0x1800abb4a
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x1800a8703
mov ecx, dword [rax + 8]
add ecx, edx
cmp bpl, dl
test al, sil
cmp r10, rcx
jb 0x1800a4cc4
inc r9d
add rax, 0x28
cmp r15w, 0x3765
test r8b, 0xee
cmp r9d, r11d
jmp 0x1800abb44
jb 0x1800a86e3
xor eax, eax
jmp 0x1800a4cc4

Function at 0x1800ad5d7
Capabilities:
Parse pe header

Disassembly:
jne 0x1800ac36c
mov eax, 1
ret
jne 0x1800ac36c
mov ecx, 0x20b
jmp 0x1800abdb6
cmp word [rax + 0x18], cx
jmp 0x1800a4c0a
xor eax, eax
jmp 0x1800b0a22
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x1800b11c0
ret
jne 0x1800ac36c
movsxd rax, dword [rcx + 0x3c]
clc
add rax, rcx
cmp r11b, 0xef
cmp dword [rax], 0x4550
jmp 0x1800a7bec

Function at 0x1800af0c0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
movsxd rdx, ecx
cdq
lea edx, [r8 + 2]
jmp 0x1800b073f
jmp 0x180166243
Function at 0x1800f9acd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rax, rsi
push rsi
inc al
push rdi
push r14
xor bx, bx
push r15
sub ax, 0x5ec3
xor r15b, 0x5d
sub rsp, 0x20
sub ah, 0xf5
shl ebx, cl
mov r15, rdx
cwde
mov rbx, rcx
not ax
shl al, 0x71
clc
mov eax, dword [rcx + 0xc]
cmp spl, sil
mov ecx, dword [rcx + 8]
cmp dl, dil
cmp ecx, eax
jmp 0x1800f9b13
jne 0x1800f9c35
test eax, eax
movzx r14d, ax
cmovp r14d, r9d
lea r14d, [rax + rax]
jg 0x1800f9b39
mov r14d, 4
sets dl
or dil, spl
movsxd rdi, r14d
or al, 0x39
mov qword [rsp + 0x50], rdi
sbb edx, 0x1cb22bb8
sar ax, cl
mov eax, 0x18
movzx cx, dl
cdq
rcl ecx, cl
mul rdi
bswap cx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
movsx ecx, r10w
bswap cx
mov rcx, rax
jmp 0x1800f9b78
call fcn.1800b0ae6
mov rbp, rax
bt si, 0x87
mov qword [rsp + 0x58], rax
mov rsi, rax
cmc
test r14d, r14d
je 0x1800f9bb7
mov rcx, rsi
call fcn.1800b091f
add rsi, 0x18
clc
test r15b, 0xc4
sub rdi, 1
jmp 0x1800f9bb1
jne 0x1800f9b97
xor edx, edx
cmp cl, r12b
clc
cmp dword [rbx + 8], edx
jmp 0x1800f9bc5
jle 0x1800f9c1b
mov ecx, edx
not ah
jmp 0x1800f9bd4
mov rax, qword [rbx]
jmp 0x1800f9bdc
movups xmm0, xmmword [rcx + rax]
jmp 0x1800f9be5
movups xmmword [rcx + rbp], xmm0
jmp 0x1800f9bee
movsd xmm1, qword [rcx + rax + 0x10]
jmp 0x1800f9bf9
movsd qword [rcx + rbp + 0x10], xmm1
jmp 0x1800f9c04
inc edx
cmp bpl, r11b
lea rcx, [rcx + 0x18]
cmp edx, dword [rbx + 8]
jmp 0x1800f9c15
jl 0x1800f9bd4
mov rcx, qword [rbx]
call fcn.1800ac373
mov qword [rbx], rbp
mov dword [rbx + 0xc], r14d
cwde
mov ecx, dword [rbx + 8]
movzx edi, r15w
movsxd rsi, edi
movsxd rax, ecx
lea rcx, [rax + rax*2]
movzx di, cl
mov rax, qword [rbx]
xchg sil, sil
bswap ebp
movups xmm0, xmmword [r15]
dec esi
movups xmmword [rax + rcx*8], xmm0
movzx rbp, bp
movsd xmm1, qword [r15 + 0x10]
movsd qword [rax + rcx*8 + 0x10], xmm1
inc dword [rbx + 8]
not r15
xchg r15w, r14w
shr edi, cl
mov rbx, qword [rsp + 0x60]
xchg bp, r14w
xor r14b, al
movzx rbp, si
add rsp, 0x20
setno r15b
pop r15
mov bp, sp
pop r14
cmovl ebp, r10d
movsxd rdi, r10d
pop rdi
pop rsi
xchg bp, bp
setne bpl
movsxd rbp, ebx
pop rbp
jmp 0x1800f9ca6
ret
Function at 0x18015aa67
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
bts eax, r14d
sar al, 0xd
cmova r8w, r10w
mov r8, rcx
clc
sal al, 0xf5
and ax, di
mov eax, 0x5a4d
cmp ax, 0x7afc
cmp r8w, sp
cmp word [0x180000000], ax
jmp 0x18015aa9a
jne 0x18015abb4
movsxd rcx, dword [0x18000003c]
stc
or dh, dl
lea rdx, [0x180000000]
add rcx, rdx
test r12b, r14b
jmp 0x18015aabc
cmp dword [rcx], 0x4550
jmp 0x18015aac7
jne 0x18015abb4
mov eax, 0x20b
cmc
clc
cmp word [rcx + 0x18], ax
jmp 0x18015aadd
jne 0x18015abb4
sub r8, rdx
movzx eax, word [rcx + 0x14]
or r9w, cx
shr r9b, cl
movzx dx, dl
lea rdx, [rcx + 0x18]
add rdx, rax
sal al, cl
cwde
sub r9b, dil
movzx eax, word [rcx + 6]
cmp r8b, 0x53
movzx ecx, r12w
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
test r12b, al
test r8b, 0x86
mov qword [rsp], rdx
cmp rdx, r9
je 0x18015ab6a
mov ecx, dword [rdx + 0xc]
cmp r14b, 0x43
cmp r8, rcx
jmp 0x18015ab39
jb 0x18015ab5c
mov eax, dword [rdx + 8]
cmc
test di, r8w
stc
add eax, ecx
cmc
cmp rcx, r14
cmp r8, rax
jmp 0x18015ab56
jb 0x18015ab73
add rdx, 0x28
jmp 0x18015ab65
jmp 0x18015ab1d
xor edx, edx
test r9b, 0x16
cmp rbp, rsp
test rdx, rdx
jmp 0x18015ab7b
jne 0x18015ab8d
sub al, al
jmp 0x18015ab88
jmp 0x18015abc3
cmp dword [rdx + 0x24], 0
jmp 0x18015ab96
jge 0x18015aba8
xor al, al
jmp 0x18015aba3
jmp 0x18015abc3
mov al, 1
jmp 0x18015abaf
jmp 0x18015abc3
sub al, al
jmp 0x18015abbb
jmp 0x18015abc3
add rsp, 0x18
ret

Function at 0x18015b3b1
Capabilities:
Terminate process

Disassembly:
push rbx
and ebx, r10d
sub rsp, 0x20
movsx rbx, r8w
bts bx, r8w
bsf rbx, r10
mov rbx, rcx
cmp r12b, sil
test r10w, 0x7b7b
clc
sub ecx, ecx
jmp 0x18015b3db
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
jmp 0x18015b3e9
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
adc ebx, ebp
jmp 0x18015b404
add rsp, 0x20
mov bl, 0xff
setl bh
pop rbx
jmp 0x18015b413
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x18015be2e
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
adc ax, bx
bt ax, si
push rbp
cwde
sub bp, r13w
xadd al, bpl
mov rbp, rsp
sar al, 0x9e
movsx ax, ch
sub rsp, 0x20
rol eax, cl
mov rax, qword [0x18009a010]
shld bx, r11w, 0x65
movzx rbx, ax
movabs rbx, 0x2b992ddfa232
cmp rax, rbx
jmp 0x18015be77
jne 0x18015bf3e
and qword [rbp + 0x18], 0
movsx ecx, di
movsx rcx, r11w
lea rcx, [rbp + 0x18]
jmp 0x18015be92
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x18015bea1
mov qword [rbp + 0x10], rax
jmp 0x18015beaa
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
ror cl, cl
lea rcx, [rbp + 0x20]
test bpl, r12b
xor qword [rbp + 0x10], rax
jmp 0x18015bed0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
lea rcx, [rbp + 0x10]
shl rax, 0x20
stc
xor rax, qword [rbp + 0x20]
xor rax, qword [rbp + 0x10]
btr rbp, r10
shl bpl, cl
xor rax, rcx
movzx ecx, r9w
movabs rcx, 0xffffffffffff
bts bp, sp
shld bp, r9w, 0x63
and rax, rcx
shld ecx, ebp, 0x51
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
not bp
mov bpl, 0xb0
cmove rax, rcx
movsx rbx, r10w
mov qword [0x18009a010], rax
bts bp, cx
btc bp, 0xde
mov rbx, qword [rsp + 0x48]
shl bp, 0xa6
adc bpl, cl
not rax
adc bpl, 0x6f
mov qword [0x18009a008], rax
btc rbp, rax
movzx bp, r12b
add rsp, 0x20
movzx bp, r11b
bswap bp
movsx rbp, bx
pop rbp
jmp 0x18015bf77
ret
Function at 0x18015c29d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
xadd r10w, r10w
ror r11, cl
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
sbb r11b, r8b
mov qword [rax + 0x20], rdi
test r15b, 0x5c
push r14
inc r10b
test ax, sp
mov bl, byte [rcx]
shld r10, r10, 0x9b
lea r10, [rcx + 1]
mov byte [rdx], bl
mov esi, r9d
cmc
lea r14, [0x180000000]
adc r11b, 0xd
dec dil
cmove ebp, r13d
mov rbp, r8
movsx r11d, r15w
cmp si, 0x31f8
mov r11, rdx
bswap di
shl dil, cl
mov rdi, rcx
cmp rax, r11
test bl, 4
jmp 0x18015c30d
je 0x18015c350
movzx ecx, byte [r10]
and ecx, 0xf
bt eax, 0x3d
test esi, r11d
movsx rax, byte [rcx + r14 + 0x82500]
cmp r9, rbx
mov cl, byte [rcx + r14 + 0x82510]
sub r10, rax
movsxd rax, r13d
adc ah, 0x5e
mov eax, dword [r10 - 4]
shr eax, cl
stc
test r11w, r8w
cmc
mov dword [rdx + 4], eax
cmp di, ax
test bl, 8
jmp 0x18015c358
je 0x18015c368
mov eax, dword [r10]
add r10, 4
mov dword [rdx + 8], eax
test bl, 0x10
jmp 0x18015c370
je 0x18015c383
mov eax, dword [r10]
add r10, 4
test bx, si
mov dword [rdx + 0xc], eax
movsxd rax, dword [r10]
bsf r8w, bx
rcr r8d, cl
cmove r8w, dx
lea r8, [r10 + 4]
xor r9d, r9d
test r14b, 0xa5
stc
cmp r8, r12
cmp byte [rsp + 0x30], r9b
jmp 0x18015c3ac
jne 0x18015c45a
test bl, 2
jmp 0x18015c3ba
je 0x18015c45a
lea rdx, [rax + rbp]
xor cl, r13b
mov ah, 0x24
movzx ecx, byte [rdx]
and ecx, 0xf
sar r10b, cl
lahf
movsx rax, byte [rcx + r14 + 0x82500]
mov cl, byte [rcx + r14 + 0x82510]
sub rdx, rax
setl r10b
and r10b, 0x9e
ror r10b, 0xe4
mov r10d, dword [rdx - 4]
cmc
shr r10d, cl
clc
jmp 0x18015c406
mov dword [r11 + 0x10], r9d
test r10d, r10d
jmp 0x18015c412
je 0x18015c462
mov eax, dword [rdx]
mov ecx, dword [rdx + 4]
cmp ebp, 0x85679d8
cmc
lea rdx, [rdx + 8]
cmp eax, esi
jmp 0x18015c42f
je 0x18015c44c
inc r9d
clc
cmp r9d, r10d
jmp 0x18015c441
jb 0x18015c418
jmp 0x18015c462
mov dword [r11 + 0x10], ecx
jmp 0x18015c455
jmp 0x18015c462
mov dword [rdx + 0x10], eax
test ax, 0x29c7
cmc
test bl, 1
je 0x18015c4b9
movzx ecx, byte [r8]
cdqe
shl dl, cl
adc bpl, dil
and ecx, 0xf
ror bl, 0x17
movzx bx, r8b
movsx rdx, byte [rcx + r14 + 0x82500]
mov cl, byte [rcx + r14 + 0x82510]
sub si, sp
bswap si
sbb r14b, bl
sub r8, rdx
shl bl, cl
mov edx, dword [r8 - 4]
shr edx, cl
sub r14b, 0xb6
rcr rbx, 0x9f
cbw
mov dword [r11 + 0x14], edx
cdqe
btc ebp, eax
mov rbx, qword [rsp + 0x10]
movzx ax, bh
sub r8, rdi
movzx r14w, bpl
cwde
movzx esi, di
mov rbp, qword [rsp + 0x18]
movsx di, al
jmp 0x18015c4e0
mov rax, r8
not r14w
mov rsi, qword [rsp + 0x20]
movsx di, spl
movsx r14d, si
setp dil
mov rdi, qword [rsp + 0x28]
setle r14b
cmovno r14w, sp
movsxd r14, r15d
pop r14
ret
Function at 0x18015c6b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
cmp ah, 0x97
mov qword [rsp + 0x18], rbp
cmp r11, 0x5d220d2
push rsi
rol si, 0xc0
btc esi, 0xf4
push rdi
cmp cl, bpl
test ax, sp
adc rdi, 0xdfb2d4f
push r12
rcr di, 0xa3
movsx r12w, r14b
push r14
push r15
sbb sil, r12b
rcr r15b, 0x5c
bts rdi, rbp
sub rsp, 0x20
mov edi, dword [r8 + 0xc]
mov r15b, spl
movzx r15d, ax
movsxd r15, r8d
mov r12, rcx
seto sil
bswap r15w
mov rcx, r8
mov rsi, r9
mov r14w, 0x3737
mov r14, r8
sete r15b
movzx r15w, r15b
not r15
mov r15, rdx
jmp 0x18015c73c
call fcn.1800aef00
mov r10, qword [r12]
rcl bpl, cl
mov ebp, eax
mov qword [rsi], r10
test edi, edi
jmp 0x18015c754
je 0x18015c878
movsxd rax, dword [r14 + 0x10]
cqo
cwd
dec edi
sar dx, cl
lea rdx, [rdi + rdi*4]
movzx rbx, ax
lea rbx, [rax + rdx*4]
add rbx, qword [r15 + 8]
cmp r8w, 0x66a4
test al, r12b
cmp ebp, dword [rbx + 4]
jmp 0x18015c788
jle 0x18015c74d
cmp ebp, dword [rbx + 8]
jmp 0x18015c796
jg 0x18015c74d
mov rcx, qword [r15]
bts edx, ecx
bsf dx, r9w
lea rdx, [rsp + 0x50]
cmp edx, eax
test esp, 0x42a060c6
xor r8d, r8d
jmp 0x18015c7bc
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
cmovo r10w, si
jmp 0x18015c7d4
xor ecx, ecx
add r8, qword [rsp + 0x50]
xchg r10d, r10d
bts r9w, r11w
jmp 0x18015c7e8
mov r9d, dword [rbx + 0xc]
mov r10d, dword [rax]
test r9d, r9d
jmp 0x18015c7f7
je 0x18015c835
lea rdx, [r8 + 0xc]
rcr ah, cl
jmp 0x18015c80a
movsxd rax, dword [rdx]
cmp rax, r10
jmp 0x18015c815
je 0x18015c843
inc ecx
cmc
cmp ax, 0x29c0
add rdx, 0x14
cmc
cmp ecx, r9d
jmp 0x18015c82f
jb 0x18015c80a
cmp ecx, r9d
jmp 0x18015c83d
jae 0x18015c74d
mov rax, qword [r12]
btc rbx, 0x42
lea rcx, [rcx + rcx*4]
sar bpl, 0x2b
movsxd rcx, dword [r8 + rcx*4 + 0x10]
mov rcx, qword [rcx + rax]
cmp r14w, cx
shr dil, 0xa4
movzx ebp, r10w
mov qword [rsi], rcx
movsx ax, r9b
add rdi, 0x3e8376ca
mov rbx, qword [rsp + 0x58]
sar bpl, 0x39
mov rax, rsi
mov rbp, qword [rsp + 0x60]
xor r14b, 0xc
bt r12, 0xcb
xadd dil, r12b
add rsp, 0x20
jmp 0x18015c89f
pop r15
pop r14
movsx di, r12b
pop r12
movsx si, r8b
jmp 0x18015c8b7
pop rdi
movzx rsi, r9w
pop rsi
ret

Function at 0x180164400
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
neg dl
cmc
bt r9w, 0x2a
sub rsp, 0x20
shld r9, r12, 0xcd
mov rbx, rcx
test sil, r12b
lea r9, [0x180083510]
and dh, 0x75
cdq
xor ecx, ecx
movsxd rdx, r14d
lea r8, [0x180083508]
bswap dx
lea rdx, [0x180083510]
jmp 0x180164440
call fcn.18016418a
test rax, rax
jmp 0x18016444d
je 0x180164467
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180164460
push qword [0x180082280]
ret
add rsp, 0x20
seto bl
jmp 0x180164476
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x180164502
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sar dh, 0x52
rol r9, cl
sub rsp, 0x20
movzx ebx, di
movzx bx, spl
mov ebx, ecx
movsx r9d, r14w
mov dx, ax
jmp 0x180164524
lea r9, [0x180083538]
setno dh
movzx ecx, ax
mov ecx, 2
lea r8, [0x180083530]
movsx dx, ch
mov edx, r14d
cdq
lea rdx, [0x180083538]
jmp 0x180164551
call fcn.18016418a
mov ecx, ebx
test cx, 0x7da6
cmp sil, 0x1d
stc
test rax, rax
jmp 0x18016456a
je 0x180164584
add rsp, 0x20
movsxd rbx, ecx
pop rbx
jmp 0x18016457d
push qword [0x180082280]
ret
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x180164590
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
shr dil, 0xb2
sub rsp, 0x20
mov rbx, rdx
movsx rdx, r9w
cdq
mov edi, r13d
lea r9, [0x180083550]
movsx edx, dx
cwd
jmp 0x1801645ba
mov edi, ecx
lea rdx, [0x180083550]
jmp 0x1801645cb
mov ecx, 3
lea r8, [0x180083548]
jmp 0x1801645dc
call fcn.18016418a
mov rdx, rbx
mov ecx, edi
test spl, r11b
test rax, rax
jmp 0x1801645f1
je 0x180164602
call qword [0x180082280]
jmp 0x180164608
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movzx rdi, r8w
add rsp, 0x20
xchg di, di
pop rdi
jmp 0x18016461e
ret

Function at 0x180165b6f
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov cx, 0x25e
movzx cx, r15b
movsx rcx, r9w
mov ecx, 0x17
jmp 0x180165b8a
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x180165b97
je 0x180165bae
mov ecx, 5
jmp 0x180165ba7
int 0x29
jmp 0x180165bae
mov r8d, 1
jmp 0x180165bc0
mov edx, 0xc0000417
movzx cx, r15b
movsxd rcx, r11d
setg ch
lea ecx, [r8 + 1]
jmp 0x180165bd9
call fcn.1801655ae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rax
movsx dx, r9b
mov edx, 0xc0000417
test ebx, esp
stc
add rsp, 0x28
jmp 0x180165c00
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x18016c67b
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
jmp 0x18016c694
mov qword [rax + 8], rbx
cmp edx, 0x72f54132
test r11d, r14d
mov qword [rax + 0x10], rbp
stc
cmp r13, r13
mov qword [rax + 0x18], rsi
jmp 0x18016c6b8
mov qword [rax + 0x20], rdi
test r8b, dil
test r12, 0x6d9770a9
cmc
push r14
cmp bpl, r10b
stc
test cx, bx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jmp 0x18016c6e7
jne 0x18016c6f9
xor eax, eax
jmp 0x18016c6f4
jmp 0x18016c881
mov rbp, rbx
cmp word [rax], si
jmp 0x18016c704
je 0x18016c735
or rax, 0xffffffffffffffff
inc rax
stc
cmp word [rbp + rax*2], si
jne 0x18016c70e
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jmp 0x18016c72f
jne 0x18016c70a
mov qword [rsp + 0x38], rsi
adc r8w, 0x10c3
clc
setno r9b
sub rbp, rbx
btc r8, r11
xchg r8b, r8b
adc r8d, esp
mov qword [rsp + 0x30], rsi
btc r9, 0xf4
or r8b, 0x45
sal r9, cl
add rbp, 2
and r9b, r12b
sar rbp, 1
bt r9w, 0x84
mov r8, rbx
xchg r9b, r9b
mov r9d, ebp
test dil, 0xa8
stc
mov dword [rsp + 0x28], esi
xor edx, edx
cmc
jmp 0x18016c790
mov qword [rsp + 0x20], rsi
cmp di, 0x47f5
test rbx, r12
sub ecx, ecx
call fcn.18016c48b
movsxd r14, eax
test eax, eax
jmp 0x18016c7ae
jne 0x18016c7c7
mov rcx, rbx
jmp 0x18016c7bc
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18016c6ed
mov rcx, r14
jmp 0x18016c7cf
call fcn.180169056
mov rdi, rax
test rax, rax
jmp 0x18016c7df
jne 0x18016c7f6
xor ecx, ecx
jmp 0x18016c7ec
call fcn.180169386
jmp 0x18016c7b4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
adc r8, 0x7df32e5c
sal r8w, cl
mov qword [rsp + 0x30], rsi
sbb r8, rbp
mov r8, rbx
stc
mov dword [rsp + 0x28], r14d
clc
stc
cmp r11b, 0xc4
xor edx, edx
test ebx, 0x4a5a3de4
cmc
sub ecx, ecx
mov qword [rsp + 0x20], rdi
jmp 0x18016c835
call fcn.18016c48b
test eax, eax
jne 0x18016c84f
mov rcx, rdi
call fcn.180169386
jmp 0x18016c86a
sub ecx, ecx
jmp 0x18016c856
call fcn.180169386
mov rsi, rdi
cmovle cx, r14w
movsx rcx, dx
xchg cx, cx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
rol si, cl
or ebp, r10d
bt si, r11w
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
bsf rsi, r9
mov rsi, qword [rsp + 0x60]
bt rdi, 0x50
mov rdi, qword [rsp + 0x68]
sub r14b, 0x30
not r14d
bts r14, r14
add rsp, 0x40
movsx r14, r9w
xchg r14, r14
pop r14
jmp 0x18016c8bb
ret
Function at 0x1801719f7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
sal ecx, cl
mov qword [rsp + 0x10], rbp
neg ch
mov qword [rsp + 0x18], rsi
stc
push rdi
sar dh, cl
movzx rcx, r12w
sub rsp, 0x20
movzx ecx, bp
movsx ecx, r9w
movsx dx, r9b
mov edx, 0x48
movzx cx, sil
movzx rcx, cx
lea ecx, [rdx - 8]
jmp 0x180171a38
call fcn.1801692b3
xor esi, esi
ror bl, cl
sub bx, sp
cmp r12, rbp
mov rbx, rax
stc
test r9w, sp
test rax, rax
je 0x180171b01
lea rbp, [rax + 0x1200]
jmp 0x180171a65
cmp rax, rbp
jmp 0x180171a6d
je 0x180171aef
lea rdi, [rax + 0x30]
xadd dl, dh
bswap cx
rol dl, 0x60
lea rcx, [rdi - 0x30]
sub r8d, r8d
cwd
mov edx, 0xfa0
jmp 0x180171a93
call fcn.18016cea8
or qword [rdi - 8], 0xffffffffffffffff
lea rcx, [rdi + 0xe]
sal al, cl
and byte [rdi + 0xd], 0xf8
cdqe
mov eax, esi
mov qword [rdi], rsi
mov dword [rdi + 8], 0xa0a0000
jmp 0x180171aba
mov byte [rdi + 0xc], 0xa
jmp 0x180171ac3
mov byte [rcx], sil
inc eax
jmp 0x180171acd
inc rcx
cmp eax, 5
jb 0x180171ac3
add rdi, 0x48
shrd eax, r14d, 0xd3
lea rax, [rdi - 0x30]
cmp rax, rbp
jne 0x180171a80
mov rsi, rbx
cmp rcx, r13
jmp 0x180171b01
xor ecx, ecx
jmp 0x180171b08
call fcn.180169386
mov rbx, qword [rsp + 0x30]
shl dil, cl
cbw
shr bpl, cl
mov rax, rsi
sub sil, r10b
xor rbp, r11
movzx si, r8b
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
cmovl di, r8w
mov di, 0x1322
pop rdi
jmp 0x180171b45
ret