joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ae60
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002ad18]
test rcx, rcx
je 0x14000ae9b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae8e
mov rcx, qword [0x14002ad18]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002ad18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140039d70], 0
je 0x14000af8e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140025950]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140033540]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000af6f
test al, 0x10
je 0x14000af6f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000af15
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000be78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bec2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bec2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bec2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bec2
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bec2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bec4
xor al, al
add rsp, 0x28
ret

Function at 0x14000d7f4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000d687
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000d687
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000d687
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000d687
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000d687
cmp dword [rcx + 0x84], 0xe
jbe 0x14000d687
cmp dword [rcx + 0xf8], 0
je 0x14000d687
mov ecx, ebx
call fcn.14000d728
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000d518
cmp dword [rbp + 0x20], 0
je 0x14000d6d4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000d6dc
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d620
Function at 0x14001bf80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001bfa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001bfa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400010aa
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x140002304
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140002391
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140002391
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002391
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140002378
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140002372
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14000237a
add rdx, 0x28
jmp 0x140002357
xor edx, edx
test rdx, rdx
jne 0x140002383
xor al, al
jmp 0x140002397
cmp dword [rdx + 0x24], 0
jge 0x14000238d
xor al, al
jmp 0x140002397
mov al, 1
jmp 0x140002397
xor al, al
jmp 0x140002397
add rsp, 0x18
ret

Function at 0x140001127
Capabilities:
Terminate process

Disassembly:
jmp 0x140001f88
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.1400011bd
test al, al
je 0x140001e53
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.14000119f
mov bl, al
mov ecx, dword [0x1400091c0]
cmp ecx, 1
je 0x140001e5e
test ecx, ecx
jne 0x140001d89
mov dword [0x1400091c0], 1
lea rdx, [0x140007660]
lea rcx, [0x140007330]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x140001d6a
mov eax, 0xff
jmp 0x140001e43
lea rdx, [0x140007220]
lea rcx, [section..rdata]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x1400091c0], 2
jmp 0x140001d91
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.14000118b
call fcn.14000114a
mov rbx, rax
cmp qword [rax], 0
je 0x140001dc4
mov rcx, rax
call fcn.1400010aa
test al, al
je 0x140001dc4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x14000c020]
call fcn.140001168
mov rbx, rax
cmp qword [rax], 0
je 0x140001de6
mov rcx, rax
call fcn.1400010aa
test al, al
je 0x140001de6
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
mov rdi, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov rbx, qword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov r8, rdi
mov rdx, rbx
mov ecx, dword [rax]
call fcn.140001122
mov ebx, eax
call fcn.14000112c
test al, al
je 0x140001e68
test sil, sil
jne 0x140001e1d
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.1400010a0
mov eax, ebx
jmp 0x140001e43
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.140001195
nop
mov ecx, 7
call fcn.140001195
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
int3
sub rsp, 0x28
call fcn.14000113b
add rsp, 0x28
jmp 0x140001cfc
Function at 0x14000112c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400028b4
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400028fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400028fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400028fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400028fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400028fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002900
xor al, al
add rsp, 0x28
ret
Function at 0x1400028b4
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400028b4
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400028fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400028fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400028fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400028fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400028fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002900
xor al, al
add rsp, 0x28
ret
Function at 0x14000fbcc
Capabilities:
Compare security identifiers

Disassembly:
sub rsp, 0x28
mov r10d, dword [rcx + 0x24]
test edx, r10d
jne 0x14000fbdd
xor eax, eax
jmp 0x14000fc19
lea eax, [r10 - 4]
test eax, 0xfffffffb
je 0x14000fc14
test r8d, r8d
jne 0x14000fc14
cmp r10d, 2
jne 0x14000fbfa
mov rcx, qword [rcx + 0x248]
mov rdx, qword [rcx + 0x198]
mov rcx, r9
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x14000fbd9
mov eax, 1
add rsp, 0x28
ret

Function at 0x140023854
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rcx, qword [0x14009b028]
lea r14, [0x14009b028]
cmp rcx, r14
je 0x14002389d
test byte [rcx + 0x1c], 4
je 0x14002389d
cmp byte [rcx + 0x19], 5
jb 0x14002389d
mov rcx, qword [rcx + 0x10]
lea r8, str._j_
mov edx, 0x2b
call fcn.140001024
mov r9d, 0x2001f
lea rdx, str.SoftwareMicrosoftFaxReceipts
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.14006aa3c
xor esi, esi
mov rdi, rax
test rax, rax
jne 0x140023915
mov rax, qword [0x14009b028]
cmp rax, r14
je 0x140023a1c
test byte [rax + 0x1c], 4
je 0x140023a1c
cmp byte [rax + 0x19], 2
jb 0x140023a1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b028]
lea edx, [rdi + 0x2c]
mov r9d, eax
lea r8, str._j_
mov rcx, qword [rcx + 0x10]
call fcn.140001050
jmp 0x140023a1c
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140077968
mov rbx, rax
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x1400239e9
test eax, eax
je 0x14002399f
test rbx, rbx
lea r8, [0x140087e38]
mov rcx, rdi
cmovne r8, rbx
call fcn.140077590
test eax, eax
jne 0x1400239e9
mov rax, qword [0x14009b028]
cmp rax, r14
je 0x14002399f
test byte [rax + 0x1c], 4
je 0x14002399f
cmp byte [rax + 0x19], 2
jb 0x14002399f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [0x14009b028]
lea r8, str._j_
mov r9d, eax
mov edx, 0x2d
mov rcx, qword [rcx + 0x10]
call fcn.140001050
lea rdx, str.Password
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x1400239e9
mov rcx, qword [0x14009b028]
cmp rcx, r14
je 0x1400239e9
test byte [rcx + 0x1c], 4
je 0x1400239e9
cmp byte [rcx + 0x19], 2
jb 0x1400239e9
mov rcx, qword [rcx + 0x10]
lea r8, str._j_
mov edx, 0x2e
mov r9d, eax
call fcn.140001050
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test rbx, rbx
je 0x140023a1c
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], si
jne 0x140023a01
add rcx, rcx
xor eax, eax
mov rdi, rbx
rep stosb byte [rdi], al
mov rcx, rbx
call fcn.140066f24
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14007e390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rbp - 0x40], 6
mov r13, 7
mov rax, 0x54
mov r10, qword [rbp - 0x40]
cqo
cdq
idiv r10
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], 9
xor r15d, r15d
mov r10, qword [rbp - 0x58]
mov r14, r10
sub r14, 9
movabs r10, 0x4923
mov qword [rbp - 0xb8], r10
mov edi, 0x7f145ca5
mov r14d, 0x3f4
mov r10, qword [rbp - 0xb8]
movabs r9, 0xe029
loopne 0x14007e406
add byte [rax], al
add byte [rax], al
add byte [rbp - 0x77], cl
xlatb
imul r15, r9
mov r10d, r14d
movabs r9, 0x5f86
mov r14, r10
add r14, r9
movabs r10, 0x100000000
add byte [rax], al
add byte [rcx + rcx*4 + 0x55], cl
movabs al, byte [0xc0558b4ca07d034c]
mov r12, r10
sub r12, 6
mov esi, 0x1e4b
movabs r10, 0x1ead
add r15, r10
mov r10d, r14d
movabs r9, 0x49086
mov r14, r10
add r14, r9
sub edi, 1
sub r15, rsi
mov r10, qword [rbp - 0x40]
sub r10, 3
mov r9d, esi
mov r11, r10
add r11, r9
jmp 0x14007e4e6
mov r10d, r11d
mov r10b, byte [r15 + r10]
mov byte [rbp - 0x31], r10b
movzx r10d, byte [rbp - 0x31]
mov dword [rbp - 0xf4], r10d
mov eax, r12d
mov qword [rbp - 0xf0], rax
mov rax, 0x2a
cqo
idiv r13
mov r10, rax
mov rax, qword [rbp - 0xf0]
cqo
idiv r10
mov r10d, edi
mov r9, rax
add r9, r10
movzx r10d, r9b
movsxd r9, dword [rbp - 0xf4]
xor r9d, r10d
mov byte [rbp - 0x31], r9b
mov r10d, r11d
mov r9b, byte [rbp - 0x31]
mov byte [r15 + r10], r9b
lea r11, [r11 + 1]
mov r10d, esi
add r10d, r14d
cmp r11d, r10d
jb 0x14007e480
mov qword [rbp - 0x88], 0x400a7948
lea r12, [r12 + 1]
mov qword [rbp - 0x78], 0x4012e000
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x78], r10
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x88], r10
mov r10, qword [rbp - 0x50]
sub r10, 8
mov r9d, r12d
cmp r10, r9
jge 0x14007e46d
mov qword [rbp - 0x90], 0x40269000
mov r10, qword [rbp - 0x50]
sub r10, 0xe
mov dword [rbp - 0x64], r10d
mov r10d, dword [rbp - 0x64]
mov r9, qword [rbp - 0x88]
mov r10b, byte [r9 + r10]
mov byte [rbp - 0x31], r10b
mov r10d, dword [rbp - 0x64]
mov r9, qword [rbp - 0x78]
mov r8b, byte [rbp - 0x31]
mov byte [r9 + r10], r8b
mov r10d, r10d
lea r10, [r10 + 1]
mov dword [rbp - 0x64], r10d
movabs r9, 0x3dbf0
cmp r10, r9
jl 0x14007e547
mov qword [rbp - 0x98], 0x400e6d48
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x90], r10
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x98], r10
mov r10, qword [rbp - 0x58]
add r10, qword [rbp - 0x40]
sub r10, 0xf
mov dword [rbp - 0x68], r10d
mov r10d, dword [rbp - 0x68]
lea r10, [r10 + 1]
mov dword [rbp - 0x68], r10d
mov r9, qword [rbp - 0x90]
mov r8, r13
add r8, qword [rbp - 0x40]
sub r8, 0xc
mov rdx, r10
sub rdx, r8
mov qword [rbp - 0xf0], rdx
mov r8, qword [rbp - 0x98]
mov rax, 7
cqo
idiv r13
sub r10, rax
mov r10b, byte [r10 + r8]
mov r8, qword [rbp - 0xf0]
mov byte [r8 + r9], r10b
mov r10d, dword [rbp - 0x68]
movabs r9, 0xe0a0
cmp r10, r9
jl 0x14007e5b5
mov qword [rbp - 0x48], 0x400f6348
movabs r10, 0x400f7134
mov qword [rbp - 0xa0], r10
movabs r10, 0x8000000
mov qword [rbp - 0xc0], r10
mov r10, qword [rbp - 0xa0]
add r10, qword [rbp - 0x60]
mov qword [rbp - 0xa0], r10
mov r10, qword [rbp - 0x48]
Function at 0x14007e404
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rbp - 0x40], 6
mov r13, 7
mov rax, 0x54
mov r10, qword [rbp - 0x40]
cqo
cdq
idiv r10
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], 9
xor r15d, r15d
mov r10, qword [rbp - 0x58]
mov r14, r10
sub r14, 9
movabs r10, 0x4923
mov qword [rbp - 0xb8], r10
mov edi, 0x7f145ca5
mov r14d, 0x3f4
mov r10, qword [rbp - 0xb8]
movabs r9, 0xe029
loopne 0x14007e406
add byte [rax], al
add byte [rax], al
add byte [rbp - 0x77], cl
xlatb
imul r15, r9
mov r10d, r14d
movabs r9, 0x5f86
mov r14, r10
add r14, r9
movabs r10, 0x100000000
add byte [rax], al
add byte [rcx + rcx*4 + 0x55], cl
movabs al, byte [0xc0558b4ca07d034c]
mov r12, r10
sub r12, 6
mov esi, 0x1e4b
movabs r10, 0x1ead
add r15, r10
mov r10d, r14d
movabs r9, 0x49086
mov r14, r10
add r14, r9
sub edi, 1
sub r15, rsi
mov r10, qword [rbp - 0x40]
sub r10, 3
mov r9d, esi
mov r11, r10
add r11, r9
jmp 0x14007e4e6
mov r10d, r11d
mov r10b, byte [r15 + r10]
mov byte [rbp - 0x31], r10b
movzx r10d, byte [rbp - 0x31]
mov dword [rbp - 0xf4], r10d
mov eax, r12d
mov qword [rbp - 0xf0], rax
mov rax, 0x2a
cqo
idiv r13
mov r10, rax
mov rax, qword [rbp - 0xf0]
cqo
idiv r10
mov r10d, edi
mov r9, rax
add r9, r10
movzx r10d, r9b
movsxd r9, dword [rbp - 0xf4]
xor r9d, r10d
mov byte [rbp - 0x31], r9b
mov r10d, r11d
mov r9b, byte [rbp - 0x31]
mov byte [r15 + r10], r9b
lea r11, [r11 + 1]
mov r10d, esi
add r10d, r14d
cmp r11d, r10d
jb 0x14007e480
mov qword [rbp - 0x88], 0x400a7948
lea r12, [r12 + 1]
mov qword [rbp - 0x78], 0x4012e000
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x78], r10
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x88], r10
mov r10, qword [rbp - 0x50]
sub r10, 8
mov r9d, r12d
cmp r10, r9
jge 0x14007e46d
mov qword [rbp - 0x90], 0x40269000
mov r10, qword [rbp - 0x50]
sub r10, 0xe
mov dword [rbp - 0x64], r10d
mov r10d, dword [rbp - 0x64]
mov r9, qword [rbp - 0x88]
mov r10b, byte [r9 + r10]
mov byte [rbp - 0x31], r10b
mov r10d, dword [rbp - 0x64]
mov r9, qword [rbp - 0x78]
mov r8b, byte [rbp - 0x31]
mov byte [r9 + r10], r8b
mov r10d, r10d
lea r10, [r10 + 1]
mov dword [rbp - 0x64], r10d
movabs r9, 0x3dbf0
cmp r10, r9
jl 0x14007e547
mov qword [rbp - 0x98], 0x400e6d48
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x90], r10
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x98], r10
mov r10, qword [rbp - 0x58]
add r10, qword [rbp - 0x40]
sub r10, 0xf
mov dword [rbp - 0x68], r10d
mov r10d, dword [rbp - 0x68]
lea r10, [r10 + 1]
mov dword [rbp - 0x68], r10d
mov r9, qword [rbp - 0x90]
mov r8, r13
add r8, qword [rbp - 0x40]
sub r8, 0xc
mov rdx, r10
sub rdx, r8
mov qword [rbp - 0xf0], rdx
mov r8, qword [rbp - 0x98]
mov rax, 7
cqo
idiv r13
sub r10, rax
mov r10b, byte [r10 + r8]
mov r8, qword [rbp - 0xf0]
mov byte [r8 + r9], r10b
mov r10d, dword [rbp - 0x68]
movabs r9, 0xe0a0
cmp r10, r9
jl 0x14007e5b5
mov qword [rbp - 0x48], 0x400f6348
movabs r10, 0x400f7134
mov qword [rbp - 0xa0], r10
movabs r10, 0x8000000
mov qword [rbp - 0xc0], r10
mov r10, qword [rbp - 0xa0]
add r10, qword [rbp - 0x60]
mov qword [rbp - 0xa0], r10
mov r10, qword [rbp - 0x48]
Function at 0x14007e4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rbp - 0x40], 6
mov r13, 7
mov rax, 0x54
mov r10, qword [rbp - 0x40]
cqo
cdq
idiv r10
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], 9
xor r15d, r15d
mov r10, qword [rbp - 0x58]
mov r14, r10
sub r14, 9
movabs r10, 0x4923
mov qword [rbp - 0xb8], r10
mov edi, 0x7f145ca5
mov r14d, 0x3f4
mov r10, qword [rbp - 0xb8]
movabs r9, 0xe029
loopne 0x14007e406
add byte [rax], al
add byte [rax], al
add byte [rbp - 0x77], cl
xlatb
imul r15, r9
mov r10d, r14d
movabs r9, 0x5f86
mov r14, r10
add r14, r9
movabs r10, 0x100000000
add byte [rax], al
add byte [rcx + rcx*4 + 0x55], cl
movabs al, byte [0xc0558b4ca07d034c]
mov r12, r10
sub r12, 6
mov esi, 0x1e4b
movabs r10, 0x1ead
add r15, r10
mov r10d, r14d
movabs r9, 0x49086
mov r14, r10
add r14, r9
sub edi, 1
sub r15, rsi
mov r10, qword [rbp - 0x40]
sub r10, 3
mov r9d, esi
mov r11, r10
add r11, r9
jmp 0x14007e4e6
mov r10d, r11d
mov r10b, byte [r15 + r10]
mov byte [rbp - 0x31], r10b
movzx r10d, byte [rbp - 0x31]
mov dword [rbp - 0xf4], r10d
mov eax, r12d
mov qword [rbp - 0xf0], rax
mov rax, 0x2a
cqo
idiv r13
mov r10, rax
mov rax, qword [rbp - 0xf0]
cqo
idiv r10
mov r10d, edi
mov r9, rax
add r9, r10
movzx r10d, r9b
movsxd r9, dword [rbp - 0xf4]
xor r9d, r10d
mov byte [rbp - 0x31], r9b
mov r10d, r11d
mov r9b, byte [rbp - 0x31]
mov byte [r15 + r10], r9b
lea r11, [r11 + 1]
mov r10d, esi
add r10d, r14d
cmp r11d, r10d
jb 0x14007e480
mov qword [rbp - 0x88], 0x400a7948
lea r12, [r12 + 1]
mov qword [rbp - 0x78], 0x4012e000
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x78], r10
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x88], r10
mov r10, qword [rbp - 0x50]
sub r10, 8
mov r9d, r12d
cmp r10, r9
jge 0x14007e46d
mov qword [rbp - 0x90], 0x40269000
mov r10, qword [rbp - 0x50]
sub r10, 0xe
mov dword [rbp - 0x64], r10d
mov r10d, dword [rbp - 0x64]
mov r9, qword [rbp - 0x88]
mov r10b, byte [r9 + r10]
mov byte [rbp - 0x31], r10b
mov r10d, dword [rbp - 0x64]
mov r9, qword [rbp - 0x78]
mov r8b, byte [rbp - 0x31]
mov byte [r9 + r10], r8b
mov r10d, r10d
lea r10, [r10 + 1]
mov dword [rbp - 0x64], r10d
movabs r9, 0x3dbf0
cmp r10, r9
jl 0x14007e547
mov qword [rbp - 0x98], 0x400e6d48
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x90], r10
mov r10, qword [rbp - 0x60]
add qword [rbp - 0x98], r10
mov r10, qword [rbp - 0x58]
add r10, qword [rbp - 0x40]
sub r10, 0xf
mov dword [rbp - 0x68], r10d
mov r10d, dword [rbp - 0x68]
lea r10, [r10 + 1]
mov dword [rbp - 0x68], r10d
mov r9, qword [rbp - 0x90]
mov r8, r13
add r8, qword [rbp - 0x40]
sub r8, 0xc
mov rdx, r10
sub rdx, r8
mov qword [rbp - 0xf0], rdx
mov r8, qword [rbp - 0x98]
mov rax, 7
cqo
idiv r13
sub r10, rax
mov r10b, byte [r10 + r8]
mov r8, qword [rbp - 0xf0]
mov byte [r8 + r9], r10b
mov r10d, dword [rbp - 0x68]
movabs r9, 0xe0a0
cmp r10, r9
jl 0x14007e5b5
mov qword [rbp - 0x48], 0x400f6348
movabs r10, 0x400f7134
mov qword [rbp - 0xa0], r10
movabs r10, 0x8000000
mov qword [rbp - 0xc0], r10
mov r10, qword [rbp - 0xa0]
add r10, qword [rbp - 0x60]
mov qword [rbp - 0xa0], r10
mov r10, qword [rbp - 0x48]
Function at 0x14007eb5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14007eba8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14007eba0
cmp dword [rcx + 0x3c], edx
jl 0x14007eba0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14007eba0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14007eba8
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180019bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov edi, edx
and edi, 7
je 0x180019c44
cmp edx, edi
jge 0x180019c35
mov r8d, dword [rcx + 0x14]
mov eax, 1
mov ecx, edx
mov r10d, edx
shl eax, cl
mov r9d, edx
cmp r8d, eax
jae 0x180019c2b
mov r11, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r11
jb 0x180019bf3
xor cl, cl
jmp 0x180019bfc
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
lea edx, [r10 + 8]
mov ecx, r10d
mov dword [rbx + 0x10], edx
shl eax, cl
or r8d, eax
mov dword [rbx + 0x14], r8d
cmp edx, 0x18
jg 0x180019c35
mov ecx, edx
mov eax, 1
shl eax, cl
mov r10d, edx
mov r9d, edx
cmp r8d, eax
jb 0x180019be7
mov rax, qword [rbx + 8]
mov edx, r9d
mov qword [rbx], rax
mov eax, dword [rbx + 0x14]
mov ecx, edi
shr eax, cl
sub edx, edi
mov dword [rbx + 0x14], eax
mov dword [rbx + 0x10], edx
xor r8d, r8d
mov eax, edx
test edx, edx
jle 0x180019c7e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x180019c60
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x180019cb2
mov edx, dword [0x1801578f8]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x180019ce1
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x180019ccb
xor dl, dl
jmp 0x180019cd4
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x180019cc2
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x180019c82
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x180019d51
mov edx, dword [0x1801578f8]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x180019d6f
mov rcx, rbx
call fcn.180018ff0
test eax, eax
je 0x180019ca5
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret