joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006410
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4038
call fcn.14000a420
sub rsp, rax
mov rax, qword [0x140035018]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140007410
mov r8d, 0x2000
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400064a6
mov r8d, 0x2000
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.140007520
test rax, rax
je 0x1400064a6
cmp byte [rax], 0
je 0x1400064a6
mov rcx, rax
call fcn.1400146d0
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000a490
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000a490
add rsp, 0x4038
ret

Function at 0x140006a80
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140007410
xor edx, edx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rdi
mov ebx, eax
call fcn.14000d1a4
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006ac0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2110
call fcn.14000a420
sub rsp, rax
mov rax, qword [0x140035018]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rdx, rcx
xor edi, edi
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x50], edi
mov r8d, 0x1000
call fcn.140007410
mov ebx, 1
lea ecx, [rdi + 0x16]
mov edx, ebx
call fcn.1400129c8
mov edx, ebx
lea ecx, [rdi + 2]
call fcn.1400129c8
mov edx, ebx
lea ecx, [rdi + 0xf]
call fcn.1400129c8
mov edx, ebx
lea ecx, [rdi + 0x15]
call fcn.1400129c8
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x58], 0x18
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
mov qword [rsp + 0x98], rdi
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xcc], 0x101
mov word [rsp + 0xd0], bx
call fcn.14000fb8c
mov rcx, rax
call fcn.140014748
mov ecx, eax
call fcn.14001257c
mov ecx, ebx
mov qword [rsp + 0xe0], rax
call fcn.14000fb8c
mov rcx, rax
call fcn.140014748
mov ecx, eax
call fcn.14001257c
lea ecx, [rdi + 2]
mov qword [rsp + 0xe8], rax
call fcn.14000fb8c
mov rcx, rax
call fcn.140014748
mov ecx, eax
call fcn.14001257c
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x100]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140006c41
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x50]
jmp 0x140006c59
lea rdx, str.Error_creating_child_process__n
lea rcx, [0x140026ad0]
call fcn.140002680
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.14000a490
mov rbx, qword [rsp + 0x2128]
add rsp, 0x2110
pop rdi
ret
Function at 0x140007280
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2070
call fcn.14000a420
sub rsp, rax
mov rax, qword [0x140035018]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor ebx, ebx
mov qword [rsp + 0x38], 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
mov rdi, rcx
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x38]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140007351
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140007308
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140007351
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.14000d19c
mov rbx, rax
test rax, rax
je 0x140007351
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r8, rbx
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140007351
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov rcx, rbx
call fcn.14000d1a4
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x14000736a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
lea r9, str.S_1_3_4
test rbx, rbx
lea r8, str.D:_A__FA____s_
mov edx, 0x1000
lea rcx, [rsp + 0x60]
cmovne r9, rbx
call fcn.140007080
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
mov dword [rsp + 0x48], 0x18
lea r8, [rsp + 0x50]
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x60]
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x1400073dc
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400073dc
xor eax, eax
jmp 0x1400073e1
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.14000a490
mov rbx, qword [rsp + 0x2088]
add rsp, 0x2070
pop rdi
ret
Function at 0x140011d70
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140011d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000fc5c
or eax, 0xffffffff
jmp 0x140011d92
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400120c0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140035018]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x140011dff
call fcn.14000fccc
mov dword [rax], 0x16
call fcn.140015484
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000a490
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x140011dc6
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140011e6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140011e40
cmp eax, 3
jbe 0x140011e5d
cmp eax, 8
je 0x140011e4d
cmp eax, 0x12
je 0x140011e5d
call fcn.14000fccc
mov dword [rax], 0x16
jmp 0x140011dd6
call fcn.14000fccc
mov dword [rax], 0xc
jmp 0x140011dd6
call fcn.14000fccc
mov dword [rax], 2
jmp 0x140011dd6
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.140012008
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.140012008
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.140012008
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14001ad78
test eax, eax
jne 0x140011ecb
mov rax, rdi
jmp 0x140011dda
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400154a4
int3
jmp 0x140011d98
Function at 0x1400120c8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140035018]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rbx, rdx
test rcx, rcx
jne 0x140011f3d
call fcn.14000fccc
mov dword [rax], 0x16
call fcn.140015484
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000a490
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
cmp rcx, 0xffffffffffffffff
je 0x140011f09
test rbx, rbx
je 0x140011f09
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140011f98
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140011f71
cmp eax, 3
jbe 0x140011f8b
cmp eax, 8
je 0x140011f7e
cmp eax, 0x12
je 0x140011f8b
call fcn.14000fccc
mov dword [rax], 0x16
jmp 0x140011f19
call fcn.14000fccc
mov dword [rax], 0xc
jmp 0x140011f19
call fcn.14000fccc
mov dword [rax], 2
jmp 0x140011f19
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, edi
mov dword [rbx], eax
call fcn.140012008
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.140012008
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.140012008
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14001ad78
test eax, eax
je 0x140011f1c
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400154a4
int3
jmp 0x140011ee0

Function at 0x140012ba4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140012bc4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000fc5c
or eax, 0xffffffff
jmp 0x140012bc6
xor eax, eax
add rsp, 0x28
ret

Function at 0x140013f50
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013d7c
Function at 0x140003190
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword gs:[0x30]
mov r14, r8
mov rbp, qword [rcx + 0x88]
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x4478
add rcx, 0x818
mov r9, qword [rax + 0x60]
lea rax, [0x1400c1920]
sub rbp, qword [r9 + 0x10]
add rbp, rax
mov qword [rsp + 0x60], 0
call sym.VBoxNetNAT.exe_nocrt_memset
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
mov r9d, 0x4478
mov qword [rsp + 0x20], rax
lea r8, [rdi + 0x818]
mov rdx, rbp
call qword [0x1400bf250]
test eax, eax
js 0x1400032f3
mov edx, dword [rdi + 0x830]
cmp edx, esi
je 0x1400032e0
mov byte [rdi + 0x4c8b], 0
lea rbx, [rdi + 0x88c]
mov byte [rdi + 0x88b], 0
lea rbp, [rdi + 0x83c]
mov r9d, dword [rdi + 0x838]
lea rcx, str.supR3HardenedWinCheckChild:_enmRequest_d_rc_d_enmWhat_d__s:__s_n
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
call fcn.14000cf80
mov eax, dword [rdi + 0x830]
cmp eax, 2
jne 0x140003316
mov rcx, qword [rdi + 0x18]
xor edx, edx
call qword [0x1400bf2a0]
test eax, eax
js 0x140003340
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x78], 0xfffffffffd050f80
call fcn.140001cff
test eax, eax
je 0x1400032bd
mov edx, eax
lea rcx, str.supR3HardNtChildProcessRequest:_Child_is_taking_too_long_to_quit__rcWait_x___killing_it..._n
call fcn.14000cf80
mov rcx, qword [rdi]
mov edx, 0x40010004
call qword [0x1400bf320]
mov edx, dword [rdi + 0x838]
lea r9, [0x14007f900]
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x20], rbx
test edx, edx
jne 0x140003370
jmp 0x14000335e
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x28], eax
lea r9, str.NtReadVirtualMemory___p___failed_reading_child_process_status:__x_n
mov r8d, eax
mov qword [rsp + 0x20], rbp
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140007f40
int3
mov qword [rsp + 0x30], r14
lea r9, str.Unexpected_child_request__d._Was_expecting__d___s_._n
mov dword [rsp + 0x28], esi
lea rdx, str.supR3HardenedWinCheckChild
mov r8d, 0xfffffffe
mov dword [rsp + 0x20], eax
mov rcx, rdi
call fcn.140007f40
int3
lea r9, str.NtSetEvent_failed:__x_n
mov dword [rsp + 0x20], eax
mov r8d, eax
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140007f40
int3
mov edx, 5
lea rcx, str.supR3HardenedWinCheckChild
call fcn.14000cd10
int3
mov rcx, rbp
call fcn.14000cd10
int3
Function at 0x140015990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rcx + 0x10], 2
mov r11, rcx
mov r8, qword [rdx]
movabs rax, 0x112e0be826d694b3
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
lea r9, [rdx - 1]
sub r8d, eax
cmovns r9, rdx
test r8d, r8d
lea eax, [r8 + 0x3b9aca00]
cmovns eax, r8d
mov dword [rcx + 0xc], eax
movabs rax, 0x8888888888888889
imul r9
add rdx, r9
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3c
lea r8d, [rdx - 1]
sub r9d, eax
lea eax, [r9 + 0x3c]
movzx ecx, al
movzx eax, r9b
cmovns ecx, eax
test r9d, r9d
mov byte [r11 + 0xb], cl
mov eax, 0x88888889
cmovns r8d, edx
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
lea r9d, [rdx - 1]
sub r8d, eax
cmovns r9d, edx
test r8d, r8d
lea eax, [r8 + 0x3c]
movzx ecx, al
movzx eax, r8b
cmovns ecx, eax
mov eax, 0x2aaaaaab
imul r9d
mov byte [r11 + 0xa], cl
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea ecx, [rdx - 1]
shl eax, 3
sub r9d, eax
cmovns ecx, edx
test r9d, r9d
lea eax, [r9 + 0x18]
movzx edx, al
movzx eax, r9b
cmovns edx, eax
mov eax, 0x92492493
mov byte [r11 + 9], dl
imul ecx
mov eax, 0x92492493
add edx, ecx
sar edx, 2
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
mov r8d, ecx
imul edx, edx, 7
sub r8d, edx
add r8d, 0xa
imul r8d
add edx, r8d
lea r10, [0x140086db0]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub r8d, eax
mov eax, 0xb38cf9b1
mov byte [r11 + 5], r8b
imul ecx
add edx, ecx
sar edx, 8
mov r8d, edx
add edx, 0x12c
shr r8d, 0x1f
add r8d, edx
lea edx, [r8 + 1]
cmp dword [r10 + rdx*4], ecx
jg 0x140015b0c
nop dword [rax + rax]
inc r8d
lea edx, [rdx + 1]
cmp dword [r10 + rdx*4], ecx
jle 0x140015b00
cmp dword [r10 + r8*4], ecx
jle 0x140015b1b
dec r8d
cmp dword [r10 + r8*4], ecx
jg 0x140015b12
sub ecx, dword [r10 + r8*4]
lea r9d, [r8 + 0x686]
mov dword [r11], r9d
lea eax, [rcx + 1]
mov word [r11 + 6], ax
mov eax, r9d
and eax, 0x80000003
jge 0x140015b42
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140015b85
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul r8d, edx, 0x64
cmp r9d, r8d
jne 0x140015b81
mov eax, 0x51eb851f
imul r9d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x190
cmp r9d, eax
jne 0x140015b85
mov al, 1
jmp 0x140015b87
xor al, al
test al, al
lea rdx, [0x140086d68]
movzx eax, al
lea r10, [0x140086d88]
cmove r10, rdx
xor eax, 1
inc eax
shl eax, 6
or eax, 2
mov dword [r11 + 0x10], eax
mov eax, ecx
cdq
inc ecx
and edx, 0x1f
add eax, edx
sar eax, 5
movsxd r9, eax
movzx r8d, word [r10 + r9*2 + 2]
cmp r8d, ecx
jg 0x140015be1
nop dword [rax + rax]
movsxd rdx, r9d
inc r9d
movzx r8d, word [r10 + rdx*2 + 4]
cmp r8d, ecx
jle 0x140015bd0
lea eax, [r9 + 1]
mov byte [r11 + 4], al
movsxd rax, r9d
sub cl, byte [r10 + rax*2]
mov rax, r11
inc cl
mov dword [r11 + 0x14], 0
mov byte [r11 + 8], cl
ret
Function at 0x14001b090
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword [rcx + 0x28]
mov r8, rcx
xor edx, edx
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b0cd
mov edx, dword [rax + 0x3c]
cmp edx, 0x800
jbe 0x14001b0cd
mov al, byte [2]
inc al
mov byte [2], al
int3
mov r9d, edx
add r9, rax
mov qword [r8 + 0x30], r9
cmp dword [r9], 0x4550
je 0x14001b0f1
mov al, byte [3]
inc al
mov byte [3], al
int3
mov eax, 0xf0
cmp word [r9 + 0x14], ax
je 0x14001b10e
mov al, byte [4]
inc al
mov byte [4], al
int3
mov eax, 0x20b
cmp word [r9 + 0x18], ax
je 0x14001b12b
mov al, byte [5]
inc al
mov byte [5], al
int3
cmp dword [r9 + 0x84], 0x10
je 0x14001b146
mov al, byte [6]
inc al
mov byte [6], al
int3
mov dword [r8 + 0x38], edx
movzx eax, word [r9 + 6]
lea ecx, [rax*4 + 0x21]
add ecx, eax
lea eax, [rdx + rcx*8]
mov edx, eax
mov dword [r8 + 0x3c], eax
mov eax, dword [r9 + 0x50]
mov dword [r8 + 0x40], eax
mov rax, qword [r9 + 0x88]
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x28
jb 0x14001b18e
cmp eax, edx
jb 0x14001b18e
mov edx, dword [r9 + 0x50]
cmp eax, edx
jae 0x14001b18e
add ecx, eax
cmp ecx, edx
jbe 0x14001b19f
mov cl, byte [7]
inc cl
mov byte [7], cl
int3
mov r10d, eax
mov rcx, rax
add r10, qword [r8 + 0x28]
shr rcx, 0x20
mov dword [r8 + 0x44], eax
mov dword [r8 + 0x48], ecx
mov eax, dword [r10 + 0x14]
dec eax
cmp eax, 0xffffe
ja 0x14001b1d2
mov eax, dword [r10 + 0x18]
cmp eax, 0x100000
jae 0x14001b1d2
cmp eax, 1
jae 0x14001b1e7
mov al, byte [8]
inc al
mov byte [8], al
int3
mov edi, dword [r8 + 0x3c]
mov dword [r8 + 0x5c], eax
mov ecx, dword [r10 + 0x18]
cmp ecx, dword [r10 + 0x14]
cmovb ecx, dword [r10 + 0x14]
mov dword [r8 + 0x58], ecx
mov r11d, dword [r10 + 0x1c]
cmp r11d, edi
jb 0x14001b21b
mov ebx, dword [r9 + 0x50]
cmp r11d, ebx
jae 0x14001b21b
lea rdx, [r11 + rcx*4]
cmp rdx, rbx
jbe 0x14001b234
mov al, byte [9]
inc al
mov byte [9], al
int3
mov rbx, qword [r8 + 0x28]
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x50], rax
mov r11d, dword [r10 + 0x20]
cmp r11d, edi
jb 0x14001b262
cmp r11d, dword [r9 + 0x50]
jae 0x14001b262
mov ecx, dword [r10 + 0x18]
mov eax, dword [r9 + 0x50]
lea rdx, [r11 + rcx*4]
cmp rdx, rax
jbe 0x14001b27f
mov al, byte [0xa]
inc al
mov byte [0xa], al
int3
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x60], rax
mov r11d, dword [r10 + 0x24]
cmp r11d, edi
jb 0x14001b2a8
mov r9d, dword [r9 + 0x50]
cmp r11d, r9d
jae 0x14001b2a8
mov ecx, dword [r10 + 0x18]
lea rdx, [r11 + rcx*4]
cmp rdx, r9
jbe 0x14001b2c1
mov al, byte [0xb]
inc al
mov byte [0xb], al
int3
mov rdi, qword [rsp + 0x10]
mov eax, r11d
add rax, rbx
mov rbx, qword [rsp + 8]
mov qword [r8 + 0x68], rax
ret
Function at 0x1400202a0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rsi, r9
mov edi, r8d
mov ebp, edx
mov rbx, rcx
cmp r8d, 2
jne 0x1400202c1
call fcn.1400247f0
mov edi, eax
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x80]
xor r9d, r9d
mov rcx, rbx
lea r8d, [r9 + 4]
call qword [case.0x14002093f.0]
test eax, eax
js 0x1400204a0
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x40], r13
mov r13d, 0x5a4d
mov qword [rsp + 0x38], r14
mov r14d, 0x584c
mov qword [rsp + 0x30], r15
cmp ax, r13w
je 0x140020351
cmp eax, 0x4550
je 0x140020351
cmp eax, 0x464c457f
je 0x140020351
cmp ax, r14w
je 0x140020351
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x140020351
cmp eax, 0xfefaedfe
je 0x140020351
cmp eax, 0xcefaedfe
je 0x140020351
cmp eax, 0xcafebabe
je 0x140020351
cmp eax, 0xbebafeca
jne 0x1400203dd
mov dword [rsp + 0x70], 0
mov r12d, 0x454c
lea r15d, [r12 + 2]
cmp ax, r13w
jne 0x1400203e7
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x70]
mov r9d, 0x3c
mov rcx, rbx
lea r8d, [r9 - 0x38]
call qword [case.0x14002093f.0]
test eax, eax
js 0x14002048c
mov eax, dword [rsp + 0x70]
cmp eax, 0x40
jbe 0x1400203dd
mov r9d, eax
lea rdx, [rsp + 0x80]
mov rax, qword [rbx + 8]
mov r8d, 4
mov rcx, rbx
call qword [case.0x14002093f.0]
test eax, eax
js 0x14002048c
mov eax, dword [rsp + 0x80]
cmp eax, 0x4550
je 0x1400203ee
cmp ax, r14w
je 0x1400203e7
cmp ax, r12w
je 0x1400203e7
cmp ax, r15w
je 0x1400203e7
mov eax, 0xfffffda8
jmp 0x14002048c
cmp eax, 0x4550
jne 0x140020416
mov rax, qword [rsp + 0x90]
mov r8d, edi
mov r9d, dword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.140041120
mov ecx, eax
jmp 0x14002048a
cmp eax, 0x464c457f
jne 0x140020424
mov ecx, 0xfffffda7
jmp 0x14002048a
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x140020485
cmp eax, 0xfefaedfe
je 0x140020485
cmp eax, 0xcefaedfe
je 0x140020485
cmp eax, 0xcafebabe
je 0x140020485
cmp eax, 0xbebafeca
je 0x140020485
cmp ax, r14w
jne 0x140020458
mov ecx, 0xfffffda5
jmp 0x14002048a
cmp ax, r12w
jne 0x140020465
mov ecx, 0xfffffda4
jmp 0x14002048a
cmp ax, r15w
jne 0x140020472
mov ecx, 0xfffffda3
jmp 0x14002048a
cmp ax, r13w
mov ecx, 0xfffffda8
mov edx, 0xfffffda2
cmove ecx, edx
jmp 0x14002048a
mov ecx, 0xfffffda8
mov eax, ecx
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140024570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x1400245b9
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x1400245cf
mov r10b, 1
jmp 0x1400245d8
cmp cl, 0x2d
jne 0x1400245e1
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x1400245c2
lea rbx, [0x140000000]
test edx, edx
jne 0x140024636
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x14002466e
cmp r8d, 1
jbe 0x140024621
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x140024621
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0xa7970], 0x10
jae 0x140024621
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x14002466e
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0xa7970], 8
jae 0x14002466e
mov edi, 8
jmp 0x14002466e
mov edi, edx
cmp edx, 0x10
jne 0x14002466e
cmp byte [rax], 0x30
jne 0x14002466e
cmp r8d, 1
jbe 0x14002466e
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x140024656
cmp cl, 0x58
jne 0x14002466e
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0xa7970], 0x10
jae 0x14002466e
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0xa7a70]
mov rbx, r9
test r8d, r8d
je 0x1400246d7
lea r13, [0x140000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x1400246cd
movzx esi, byte [rcx + r13 + 0xa7970]
cmp esi, edi
jae 0x1400246cd
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x1400246be
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x1400246c4
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x140024691
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x1400246fa
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x140024703
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x140024726
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x140024773
cmp byte [rax], r9b
je 0x140024773
test r8d, r8d
je 0x140024773
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x14002474d
cmp cl, 9
jne 0x140024760
inc rax
add r8d, 0xffffffff
jne 0x140024740
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x140024756
test cl, cl
je 0x140024756
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret