joyce8/EMBER2024-capa huggingface dataset:
Function at 0x594ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x594dbd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1d697c7735a16e45
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd6161d3341d757d2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x40a0b0802070508
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf0b0d050e080a0e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30c0b0b07040e03
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x594d60
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x18
jge 0x594d8d
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x594db0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x10
jb 0x594d42
jmp 0x594da4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
call fcn.0044bb80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004610a0
mov eax, edi
mov ecx, 0x10
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.00594ce0

Function at 0x595580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59567b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5b4e7253635d6853
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7530725b4e725363
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x774164466a4d5551
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc070e0f06090f03
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4010d090d0d070c
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc0e020f04010d09
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90906000b011109
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x595619
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xc]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1c
jge 0x59564b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x59566e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xc]
cmp rsi, 0x13
jb 0x5955ff
jmp 0x595662
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004610a0
mov eax, edi
mov ecx, 0x13
call fcn.004610a0
nop
nop dword [rax + rax]
call fcn.0045ee20
jmp fcn.00595580
Function at 0x595fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5960bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2450d74610b8e43
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x4ac9d06698a0245
mov qword [rsp + 0x24], rdx
movabs rdx, 0xece7eb8406fc6e65
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x501120207100c08
mov qword [rsp + 0x34], rdx
movabs rdx, 0x80a0b0d11120a01
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xc15080d080a0b0d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd1113140c140502
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x596059
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x59]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1c
jge 0x59608b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x5960ae
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x59]
cmp rsi, 0x16
jb 0x59603f
jmp 0x5960a2
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
call fcn.0044bb80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004610a0
mov eax, edi
mov ecx, 0x16
call fcn.004610a0
nop
nop dword [rax + rax]
call fcn.0045ee20
jmp fcn.00595fc0

Function at 0x5967c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5968aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x569cde8d9b74c447
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x959ca6569cde8d9b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x579e7b6e87bdb7be
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4010b0c0408050d
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa0d1105080e0401
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc090b060a041003
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x59684d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x14]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x14]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x59687a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x59689d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x596830
jmp 0x596891
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004610a0
mov eax, edi
mov ecx, 0x13
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.005967c0
Function at 0x598ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x598d6c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x62ff79f4fcf6f367
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf8f2096e7962ff79
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb0b03050c040404
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20a060601030c0c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x598d0f
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x598d3c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x598d5f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xd
jb 0x598cf2
jmp 0x598d53
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.0044bb80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.004610a0
mov eax, edi
mov ecx, 0xd
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.00598ca0

Function at 0x5994e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x599592
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x5d5c725976645a5c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x207020002060104
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x599531
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x11]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x11]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x59955e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x599585
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x599514
jmp 0x599575
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044bb80
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.004610a0
mov eax, edi
mov ecx, 8
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.005994e0
Function at 0x59ac00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59ad08
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x82e4eff199697720
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xe186beecfd6d69fe
mov qword [rsp + 0x23], rdx
movabs rdx, 0x9de186beecfd6d69
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6449c0b6656d7567
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf030f060317060d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x170b160817180510
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x70c0907170b1608
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1509180404080e18
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x59acab
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x60]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x60]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1c
jge 0x59acd8
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x59acfb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x59ac8e
jmp 0x59acef
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044bb80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004610a0
mov eax, edi
mov ecx, 0x19
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.0059ac00
Function at 0x5b7ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b7b86
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6c64dab5e4f47377
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x56
movabs rdx, 0x804020302000405
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x408
xor eax, eax
nop
jmp 0x5b7b20
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x78]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x5b7b52
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x5b7b77
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x78]
cmp rsi, 9
jb 0x5b7b02
jmp 0x5b7b6b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004610a0
mov eax, edi
mov ecx, 9
nop
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.005b7ac0

Function at 0x5b86c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x5b87fb
push rbp
mov rbp, rsp
sub rsp, 0xb8
movabs rdx, 0x649b3f52f458ba5b
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6ccb74aa20674c1c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6d8820bb816d5c9d
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf92c834260626751
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6865202981bc69be
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb2de763968908b6f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3e615cd574648665
mov qword [rsp + 0x48], rdx
movabs rdx, 0x64f0756469784ae2
mov qword [rsp + 0x50], rdx
lea rdi, [rsp + 0x58]
lea rsi, [0x00638cb8]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004616cc
mov rbp, qword [rbp]
xor eax, eax
jmp 0x5b8791
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x61]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x60
jge 0x5b87c8
movzx edx, byte [rsp + rax + 0x58]
movzx esi, byte [rsp + rax + 0x59]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x40
jae 0x5b87ee
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x61]
nop dword [rax + rax]
cmp rsi, 0x40
jb 0x5b8777
jmp 0x5b87e2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x40
call fcn.0044bb80
add rsp, 0xb8
pop rbp
ret
mov eax, esi
mov ecx, 0x40
call fcn.004610a0
mov eax, edi
mov ecx, 0x40
call fcn.004610a0
nop
nop dword [rax + rax]
call fcn.0045ee20
jmp fcn.005b86c0
Function at 0x5ba000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ba0ea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe474a950435d2ad4
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc769e0e474a95043
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2e072eaecc6d72e1
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe0e0b0803070003
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd030d0e0e0b08
mov qword [rsp + 0x30], rdx
movabs rdx, 0x705030f0c050a11
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5ba08d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x5ba0ba
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x5ba0dd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x5ba070
jmp 0x5ba0d1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004610a0
mov eax, edi
mov ecx, 0x13
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.005ba000

Function at 0x140e79878
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140e79882
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140e798ab
pop rbp
sub rbp, 0x33
sub rbp, 0xe79878
sub rsp, 0x20
jmp 0x140e798ca
mov rax, 0xe79878
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x52a82dc5
xor byte [rax], dl
inc rax
dec rcx
jne 0x140e798e9
jmp 0x140e79900
lea ecx, [rsp + rbp + 0x4e]
stc
invalid
Function at 0x14000101c
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400010d6
cmp byte [rbx], 0
je 0x1400010d6
mov edx, 0x5c
mov rcx, rbx
call fcn.140008af0
mov rbx, rax
test rax, rax
je 0x1400010d6
mov rcx, rsi
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1400010a2
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140001098
test rdi, rdi
je 0x140001098
lea rdx, str.CreateDirectory___s_
lea ecx, [rax + 5]
mov r8, rsi
call rdi
jmp 0x1400010a2
mov rdx, rsi
mov ecx, 1
call rdi
test bpl, 0x10
jne 0x1400010c9
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x1400010c9
lea rdx, str.CreateDirectory___s_
mov r8, rsi
mov ecx, 5
call rdi
mov byte [rbx], 0x5c
add rbx, 1
jne 0x140001042
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140001dcc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1400342a0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rcx
lea r8, [0x140038640]
lea rdx, str.PYTHONHOME_s
lea rcx, [rsp + 0x190]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x190]
call fcn.140009db8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
add byte [rax - 0x7b], cl
ror byte [rdi], 0x85
mov ch, 0
add byte [rax], al
mov r9d, dword [0x1400385a8]
mov r8d, dword [0x14003836c]
lea rdx, str.SOFTWAREPythonPythonCore_d._dInstallPath
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x140001e9b
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x140001e9b
xor eax, eax
jmp 0x140001ee6
xor eax, eax
or rdx, 0xffffffffffffffff
lea rdi, [rsp + 0x80]
mov rcx, rdx
repne scasb al, byte [rdi]
movzx eax, word [0x1400276a8]
mov rcx, rdx
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140001eca
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400091a0
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x2b0
pop rdi
ret
Function at 0x5cd470
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x5cd47d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x5cd48d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x5cd475
lea eax, [rcx + 1]
jmp 0x5cd49b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x5cd4ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x5cd494
sub eax, 3
jb 0x5cd4ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x5cd51d
sar eax, 1
movsxd rbp, eax
jb 0x5cd504
jmp 0x5cd4dc
add ebx, ebx
jne 0x5cd4da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x5cd504
inc ecx
add ebx, ebx
jne 0x5cd4ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x5cd504
call r11
adc ecx, ecx
add ebx, ebx
jne 0x5cd4fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x5cd4ec
add ecx, 2
jmp 0x5cd509
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.005cd432
jmp 0x5cd47d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xa1800
mov dl, 0x1c
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x5cd569
cmp rsi, rcx
jae 0x5cd571
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x5cd550
cmp al, 0x8f
ja 0x5cd550
cmp byte [rsi - 2], 0xf
je 0x5cd556
sub al, 0xe8
cmp al, 1
ja 0x5cd53a
cmp rsi, rcx
jae 0x5cd571
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x5cd540
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x5cd571
lodsb al, byte [rsi]
jmp 0x5cd550
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1ca000]
mov eax, dword [rdi]
or eax, eax
je 0x5cd5ce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1cd000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x5cd57e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x5cd5c8
mov qword [rbx], rax
add rbx, 8
jmp 0x5cd59e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x5cd608
cmp al, 0xef
ja 0x5cd5fa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x5cd5da
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x5cd5e9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x5cd65c
sub rsp, 0xffffffffffffff80
jmp 0x45fe60
Function at 0x140001690
Capabilities:
Get file version info

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
lea r9, [rsp + 0x28]
mov r8d, 0x19
mov edx, 0xa
mov rcx, qword [rsp + 0x28]
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x1a3e
mov dword [rsp + 0x40], 0x6bf
mov dword [rsp + 0x40], 0x34ba
mov eax, 0xb4
add rsp, 0x38
ret

Function at 0x1400016e0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
lea r9, [rsp + 0x28]
mov r8d, 0x84
mov edx, 0xd0
mov rcx, qword [rsp + 0x28]
call sub.VERSION.dll_GetFileVersionInfoW
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x40], 0x7a03
call fcn.140001840
mov dword [rsp + 0x40], 0x2773
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x40]
call fcn.140001750
mov eax, 0x2a
add rsp, 0x38
ret
Function at 0x140002930
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x18]
mov ecx, 0x10
imul rcx, rcx, 0
mov rax, qword [rax + 0x20]
mov rax, qword [rax + rcx]
mov rax, qword [rax]
add rax, 0x20
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
add rsp, 0x28
ret

Function at 0x140002990
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x18]
mov ecx, 0x10
imul rcx, rcx, 0
mov rax, qword [rax + 0x20]
mov rax, qword [rax + rcx]
add rax, 0x20
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
add rsp, 0x28
ret

Function at 0x140002a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x140002b21
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x140002b78
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1400029e0
cmp eax, dword [rsp + 0x78]
jne 0x140002b76
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
jmp 0x140002b7a
jmp 0x140002b17
xor eax, eax
add rsp, 0x68
ret
Function at 0x140003d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
sub rsp, 0x18
mov byte [rsp + 1], 0
jmp 0x140003da4
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x140003e25
mov byte [rsp], 0
jmp 0x140003dbd
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x140003e20
movzx eax, byte [rsp + 1]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 0x20]
shl edx, 2
movzx r8d, byte [rsp + 1]
shl r8d, 2
lea edx, [r8 + rdx*4]
movzx r8d, byte [rsp]
add edx, r8d
movsxd rdx, edx
mov r8, qword [rsp + 0x30]
movzx edx, byte [r8 + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 1]
mov r8, qword [rsp + 0x28]
lea rdx, [r8 + rdx*4]
mov byte [rdx + rcx], al
jmp 0x140003db4
jmp 0x140003d99
add rsp, 0x18
ret

Function at 0x140003e30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp + 1], 0
jmp 0x140003e4b
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x140003ea9
mov byte [rsp], 0
jmp 0x140003e64
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x140003ea7
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, str.cw
movzx edx, byte [rsp]
mov r8, qword [rsp + 0x20]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x140003e5b
jmp 0x140003e40
add rsp, 0x18
ret

Function at 0x140005250
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp + 1], 0
jmp 0x14000526b
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x1400052c9
mov byte [rsp], 0
jmp 0x140005284
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x1400052c7
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, [0x140037a10]
movzx edx, byte [rsp]
mov r8, qword [rsp + 0x20]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x14000527b
jmp 0x140005260
add rsp, 0x18
ret

Function at 0x140005750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp], 0
jmp 0x14000576d
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 0x10
jge 0x1400057a0
movzx eax, byte [rsp]
movzx ecx, byte [rsp]
mov rdx, qword [rsp + 0x28]
movzx ecx, byte [rdx + rcx]
mov rdx, qword [rsp + 0x20]
movzx eax, byte [rdx + rax]
xor eax, ecx
movzx ecx, byte [rsp]
mov rdx, qword [rsp + 0x20]
mov byte [rdx + rcx], al
jmp 0x140005764
add rsp, 0x18
ret