joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046d30
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword [0x1402055d0]
mov rbx, qword [rax + 0x3ef8]
mov r9d, ecx
shr r9d, 8
mov r8d, ecx
shr r8d, 0x10
mov edx, ecx
shr edx, 0x18
mov r10, qword [rbx + 0xf8]
movsxd rax, dword [rbx + 0xf0]
mov r10d, dword [r10 + rax*4 - 4]
not r10d
mov r11d, r10d
shr r11d, 8
xor r10d, ecx
movzx r10d, r10b
lea rdi, [0x14010f370]
xor r11d, dword [rdi + r10*4]
mov r10d, r11d
shr r10d, 8
xor r11d, r9d
movzx r9d, r11b
xor r10d, dword [rdi + r9*4]
mov esi, r10d
shr esi, 8
xor r10d, r8d
movzx r8d, r10b
xor esi, dword [rdi + r8*4]
movzx r8d, sil
shr esi, 8
xor r8d, edx
xor esi, dword [rdi + r8*4]
mov rdx, qword [rbx]
not esi
cmp dword [rdx + 0x3f40], esi
jne 0x140046dde
movsxd r8, ecx
mov ecx, esi
mov edx, 4
xor r9d, r9d
call fcn.140034db0
mov eax, dword [rbx + 0xf0]
cmp eax, dword [rbx + 0xf4]
jne 0x140046e96
lea ebp, [rax + 1]
test eax, eax
je 0x140046dfe
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x140046e03
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
cmp eax, ebp
jge 0x140046e96
movsxd rcx, ebp
shl rcx, 2
mov rax, qword [0x1402055d0]
test rax, rax
je 0x140046e29
inc dword [rax + 0xf4]
mov rdx, qword [0x1402055e0]
call qword [0x1401e7378]
mov rdi, rax
mov rdx, qword [rbx + 0xf8]
test rdx, rdx
je 0x140046e83
movsxd r8, dword [rbx + 0xf0]
shl r8, 2
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0xf8]
test rcx, rcx
je 0x140046e76
mov rax, qword [0x1402055d0]
test rax, rax
je 0x140046e76
dec dword [rax + 0xf4]
mov rdx, qword [0x1402055e0]
call qword [0x1401e7380]
mov qword [rbx + 0xf8], rdi
mov dword [rbx + 0xf4], ebp
mov eax, dword [rbx + 0xf0]
mov rcx, qword [rbx + 0xf8]
cdqe
mov dword [rcx + rax*4], esi
inc dword [rbx + 0xf0]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140046ff0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov r8, rcx
mov rax, qword [0x1402055d0]
mov rax, qword [rax + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov esi, dword [rcx + rdx*4 - 4]
movzx r10d, byte [r8]
test r10b, r10b
je 0x140047081
not esi
lea rcx, [r8 + 2]
lea rdx, [0x14010f370]
mov r9d, esi
jmp 0x14004705e
movzx r10d, r10b
movzx edi, r9b
shr r9d, 8
xor edi, r10d
xor r9d, dword [rdx + rdi*4]
inc rcx
mov r10d, r11d
test r11b, r11b
je 0x14004707b
movzx r11d, byte [rcx - 1]
cmp r10b, 0x23
jne 0x140047040
cmp r11b, 0x23
jne 0x140047040
cmp byte [rcx], 0x23
cmove r9d, esi
mov r11b, 0x23
jmp 0x140047040
not r9d
mov esi, r9d
mov rax, qword [rax]
cmp dword [rax + 0x3f40], esi
jne 0x14004709b
mov ecx, esi
mov edx, 0xb
xor r9d, r9d
call fcn.140034db0
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140048960
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rax, qword [0x140203ac0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [0x1402055d0]
cmp byte [rbx + 0x4a9d], 0
jne 0x140048993
mov edi, ecx
cmp byte [rbx + 0x4a9e], 0
je 0x1400489f1
vbroadcastss xmm0, dword [rbx + 0x389c]
vmulps xmm0, xmm0, xmmword [0x14010f290]
vmovsd xmm1, qword [rbx + 0xe08]
vaddps xmm0, xmm1, xmm0
vmovlps qword [rbx + 0x47e0], xmm0
mov qword [rbx + 0x47e8], 0
mov dword [rbx + 0x47d4], 1
vmovss xmm0, dword [rbx + 0x3904]
or byte [rbx + 0x47d0], 0x41
vmulss xmm0, xmm0, dword [0x14010f2e0]
vmovss dword [rbx + 0x4830], xmm0
mov edi, 1
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.14002cd20
test dil, 1
je 0x140048b3e
movzx r9d, byte [rsp + 0x20]
test r9b, r9b
je 0x140048a7d
mov ecx, 0xffffffff
lea rdx, [rsp + 0x22]
lea r8, [0x14010f370]
mov eax, 0xffffffff
jmp 0x140048a5d
movzx r9d, r9b
movzx r11d, al
shr eax, 8
xor r11d, r9d
xor eax, dword [r8 + r11*4]
inc rdx
mov r9d, r10d
test r10b, r10b
je 0x140048a79
movzx r10d, byte [rdx - 1]
cmp r9b, 0x23
jne 0x140048a40
cmp r10b, 0x23
jne 0x140048a40
cmp byte [rdx], 0x23
cmove eax, ecx
mov r10b, 0x23
jmp 0x140048a40
not eax
jmp 0x140048a7f
xor eax, eax
mov rdx, qword [0x1402055d0]
mov rcx, qword [rdx + 0x3ee0]
movsxd r8, dword [rdx + 0x3ed8]
test r8, r8
je 0x140048ad7
mov rdx, rcx
mov r10, r8
mov r9, r8
jmp 0x140048ab8
mov r10, r9
test r9, r9
je 0x140048add
shr r9, 1
mov r11, r9
shl r11, 4
cmp dword [rdx + r11], eax
jae 0x140048ab0
not r9
add r9, r10
add rdx, r11
add rdx, 0x10
jmp 0x140048ab0
xor r8d, r8d
mov rdx, rcx
shl r8, 4
add rcx, r8
cmp rdx, rcx
je 0x140048b3e
cmp dword [rdx], eax
jne 0x140048b3e
mov rax, qword [rdx + 8]
test rax, rax
je 0x140048b3e
cmp byte [rax + 0xb6], 0
je 0x140048b3e
mov byte [rax + 0xbb], 1
mov byte [rax + 0xbd], 1
mov byte [rax + 0xd8], 1
movzx eax, word [rbx + 0x5bc2]
inc eax
mov word [rbx + 0x5bc2], ax
movsx r9d, ax
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.14002cd20
or esi, 0x20c0347
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.14003cdc0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140105bb0
mov al, 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140048b80
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
mov r14, qword [0x1402055d0]
mov rax, qword [r14 + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov ebx, dword [rcx + rdx*4 - 4]
movzx r9d, byte [rdi]
test r9b, r9b
je 0x140048c11
not ebx
lea rcx, [rdi + 2]
lea rdx, [0x14010f370]
mov r8d, ebx
jmp 0x140048bee
movzx r9d, r9b
movzx r11d, r8b
shr r8d, 8
xor r11d, r9d
xor r8d, dword [rdx + r11*4]
inc rcx
mov r9d, r10d
test r10b, r10b
je 0x140048c0b
movzx r10d, byte [rcx - 1]
cmp r9b, 0x23
jne 0x140048bd0
cmp r10b, 0x23
jne 0x140048bd0
cmp byte [rcx], 0x23
cmove r8d, ebx
mov r10b, 0x23
jmp 0x140048bd0
not r8d
mov ebx, r8d
mov rax, qword [rax]
cmp dword [rax + 0x3f40], ebx
jne 0x140048c2e
mov ecx, ebx
mov edx, 0xb
mov r8, rdi
xor r9d, r9d
call fcn.140034db0
test byte [r14 + 0x5ce4], 4
je 0x140048c4a
lea rcx, str._popup__OpenPopup___s_____0x_08X__n
mov rdx, rdi
mov r8d, ebx
call fcn.14002e710
mov ecx, ebx
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140048c60
Function at 0x140049470
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov r9d, ecx
mov rax, qword [0x140203ac0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x1402055d0]
movsxd rcx, dword [rax + 0x48b0]
cmp dword [rax + 0x48a0], ecx
jle 0x140049342
mov esi, edx
mov rdx, qword [rax + 0x48a8]
imul rcx, rcx, 0x38
cmp dword [rdx + rcx], r9d
jne 0x140049342
test esi, 0x10000000
jne 0x140049364
lea r8, str.Popup__08x
jmp 0x140049372
mov dword [rax + 0x47d0], 0
xor esi, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140105bb0
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret
mov r9d, dword [rax + 0x48c0]
lea r8, str.Menu__02d
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.14002cd20
or esi, 0x4000000
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.14003cdc0
mov esi, eax
test al, al
jne 0x14004934e
mov rdi, qword [0x1402055d0]
mov rax, qword [rdi + 0x3ef8]
cmp qword [rdi + 0x48d8], rax
je 0x1400493ce
test byte [rax + 0x17], 1
je 0x1400493c0
mov byte [rdi + 0x3e5e], 1
call fcn.140042c30
mov byte [rdi + 0x3e5e], 0
jmp 0x14004934e
cmp byte [rdi + 0x4951], 0
je 0x1400493b3
cmp dword [rdi + 0x4910], 0
jne 0x1400493b3
mov ecx, dword [rdi + 0x4954]
and ecx, 0xfffffff0
or ecx, 2
mov dword [rdi + 0x4954], ecx
jmp 0x1400493b3
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r8, rcx
mov rax, qword [0x1402055d0]
mov ecx, dword [rax + 0x48a0]
cmp ecx, dword [rax + 0x48b0]
jle 0x14004950b
mov esi, edx
mov rax, qword [rax + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov edi, dword [rcx + rdx*4 - 4]
movzx r10d, byte [r8]
test r10b, r10b
je 0x140049525
not edi
lea rcx, [r8 + 2]
lea rdx, [0x14010f370]
mov r9d, edi
jmp 0x1400494ee
movzx r10d, r10b
movzx ebx, r9b
shr r9d, 8
xor ebx, r10d
xor r9d, dword [rdx + rbx*4]
inc rcx
mov r10d, r11d
test r11b, r11b
je 0x14004951f
movzx r11d, byte [rcx - 1]
cmp r10b, 0x23
jne 0x1400494d0
cmp r11b, 0x23
jne 0x1400494d0
cmp byte [rcx], 0x23
cmove r9d, edi
mov r11b, 0x23
jmp 0x1400494d0
mov dword [rax + 0x47d0], 0
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
not r9d
mov edi, r9d
or esi, 0x141
mov rax, qword [rax]
cmp dword [rax + 0x3f40], edi
jne 0x140049545
mov ecx, edi
mov edx, 0xb
xor r9d, r9d
call fcn.140034db0
mov ecx, edi
mov edx, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1400492f0
Function at 0x140049560
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [0x1402055d0]
mov eax, edx
and eax, 0x1f
cmp byte [rbx + rax + 0x3766], 0
je 0x140049629
mov esi, edx
mov rdi, rcx
mov r14, qword [rbx + 0x3ef8]
cmp eax, 0xa
ja 0x1400495ab
add eax, 0x81
lea rax, [rax + rax*2]
cmp byte [rbx + rax*4 + 0x3fa8], 0
jne 0x140049629
mov ecx, 0x20
call fcn.140035780
test al, al
je 0x140049629
test rdi, rdi
je 0x140049656
mov rax, qword [r14 + 0xf8]
movsxd rcx, dword [r14 + 0xf0]
mov ebx, dword [rax + rcx*4 - 4]
movzx r8d, byte [rdi]
test r8b, r8b
je 0x140049637
not ebx
lea rax, [rdi + 2]
lea rcx, [0x14010f370]
mov edx, ebx
jmp 0x14004960d
movzx r8d, r8b
movzx r10d, dl
shr edx, 8
xor r10d, r8d
xor edx, dword [rcx + r10*4]
inc rax
mov r8d, r9d
test r9b, r9b
je 0x140049633
movzx r9d, byte [rax - 1]
cmp r8b, 0x23
jne 0x1400495f0
cmp r9b, 0x23
jne 0x1400495f0
cmp byte [rax], 0x23
cmove edx, ebx
mov r9b, 0x23
jmp 0x1400495f0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
not edx
mov ebx, edx
mov rax, qword [r14]
cmp dword [rax + 0x3f40], ebx
jne 0x14004965c
mov ecx, ebx
mov edx, 0xb
mov r8, rdi
xor r9d, r9d
call fcn.140034db0
jmp 0x14004965c
mov ebx, dword [rbx + 0x4794]
mov ecx, ebx
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140048c60
Function at 0x14004b130
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
lea r14, [rcx + 0x5cb0]
cmp qword [rcx + 0x5ca8], 0
je 0x14004b239
mov rsi, rcx
cmp dword [rcx + 0x5cb4], 0
jns 0x14004b1dd
mov rax, qword [0x1402055d0]
test rax, rax
je 0x14004b174
inc dword [rax + 0xf4]
mov rdx, qword [0x1402055e0]
xor ecx, ecx
call qword [0x1401e7378]
mov r15, rax
mov rdx, qword [rsi + 0x5cb8]
test rdx, rdx
je 0x14004b1cc
movsxd r8, dword [rsi + 0x5cb0]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsi + 0x5cb8]
test rcx, rcx
je 0x14004b1bf
mov rax, qword [0x1402055d0]
test rax, rax
je 0x14004b1bf
dec dword [rax + 0xf4]
mov rdx, qword [0x1402055e0]
call qword [0x1401e7380]
mov qword [rsi + 0x5cb8], r15
mov dword [rsi + 0x5cb4], 0
mov dword [rsi + 0x5cb0], 0
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.14002de60
mov r9, qword [rsi + 0x5ca8]
mov eax, dword [rsi + 0x5cb0]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
movsxd r8, eax
mov rax, qword [rsi + 0x5cb8]
test rax, rax
lea rcx, [0x1402055d8]
cmovne rcx, rax
mov edx, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14002de60
Function at 0x14004b810
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r14, qword [0x1402055d0]
lea rdx, [0x140110ac9]
call sub.VCRUNTIME140.dll_strstr
mov rsi, rax
test rax, rax
cmove rsi, rdi
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
movsxd r15, dword [r14 + 0x5c30]
and eax, 0xfffffffc
lea r12d, [rax + r15]
add r12d, 0x18
mov ebp, eax
add ebp, 0x18
mov eax, dword [r14 + 0x5c34]
cmp eax, r12d
jge 0x14004b908
test eax, eax
je 0x14004b888
mov r13d, eax
shr r13d, 0x1f
add r13d, eax
sar r13d, 1
add r13d, eax
jmp 0x14004b88e
mov r13d, 8
cmp r13d, r12d
cmovle r13d, r12d
cmp eax, r13d
jge 0x14004b908
movsxd rcx, r13d
inc dword [r14 + 0xf4]
mov rdx, qword [0x1402055e0]
call qword [0x1401e7378]
mov rbx, rax
mov rdx, qword [r14 + 0x5c38]
test rdx, rdx
je 0x14004b8fa
movsxd r8, dword [r14 + 0x5c30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r14 + 0x5c38]
test rcx, rcx
je 0x14004b8ed
mov rax, qword [0x1402055d0]
test rax, rax
je 0x14004b8ed
dec dword [rax + 0xf4]
mov rdx, qword [0x1402055e0]
call qword [0x1401e7380]
mov qword [r14 + 0x5c38], rbx
mov dword [r14 + 0x5c34], r13d
mov dword [r14 + 0x5c30], r12d
mov rax, qword [r14 + 0x5c38]
mov dword [rax + r15], ebp
mov rax, qword [r14 + 0x5c38]
lea rbx, [rax + r15]
add rbx, 4
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rax + r15 + 4], xmm0
test rdi, rdi
je 0x14004b9a2
lea rax, [rdi - 1]
lea rcx, [rsi + 2]
mov edx, 0xffffffff
lea r8, [0x14010f370]
mov r10d, 0xffffffff
jmp 0x14004b982
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r11d
xor r9d, dword [r8 + r10*4]
inc rcx
mov r10d, r9d
add rax, 0xffffffffffffffff
jae 0x14004ba17
movzx r11d, byte [rcx - 2]
cmp r11d, 0x23
jne 0x14004b960
cmp rax, 2
jb 0x14004b960
cmp byte [rcx - 1], 0x23
jne 0x14004b960
cmp byte [rcx], 0x23
cmove r10d, edx
jmp 0x14004b960
movzx r8d, byte [rsi]
test r8b, r8b
je 0x14004ba11
lea rax, [rsi + 2]
mov ecx, 0xffffffff
lea rdx, [0x14010f370]
mov r10d, 0xffffffff
jmp 0x14004b9f4
movzx r8d, r8b
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r8d
xor r9d, dword [rdx + r10*4]
inc rax
mov r8d, r11d
mov r10d, r9d
test r11b, r11b
je 0x14004ba17
movzx r11d, byte [rax - 1]
cmp r8b, 0x23
jne 0x14004b9d0
cmp r11b, 0x23
jne 0x14004b9d0
cmp byte [rax], 0x23
cmove r10d, ecx
mov r11b, 0x23
jmp 0x14004b9d0
mov r9d, 0xffffffff
not r9d
mov dword [rbx], r9d
lea rcx, [rbx + 0x10]
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140060330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
vmovaps xmmword [rsp + 0x30], xmm7
vmovaps xmmword [rsp + 0x20], xmm6
mov rsi, rdx
movzx eax, word [rsp + 0x88]
movsxd rdx, dword [rcx + 0x18]
cmp rax, rdx
jae 0x140060367
mov rdx, qword [rcx + 0x20]
movzx eax, word [rdx + rax*2]
cmp rax, 0xffff
jne 0x140060375
mov rbx, qword [rcx + 0x38]
test rbx, rbx
jne 0x14006038a
jmp 0x1400604dc
lea rbx, [rax + rax*4]
shl rbx, 3
add rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x1400604dc
mov eax, dword [rbx]
test al, 2
je 0x1400604dc
mov edx, dword [rsp + 0x80]
mov edi, edx
or edi, 0xffffff
test al, 1
cmove edi, edx
vxorps xmm0, xmm0, xmm0
vucomiss xmm2, xmm0
jae 0x1400603bc
vmovss xmm7, dword [0x14010ae10]
jmp 0x1400603c1
vdivss xmm7, xmm2, dword [rcx + 0x14]
vmovsd xmm0, qword [r9]
vroundps xmm6, xmm0, 0xb
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.14004f1e0
mov eax, dword [rbx + 0x24]
mov edx, dword [rbx + 0x20]
mov r8d, dword [rbx + 0x1c]
mov ecx, dword [rbx + 0x18]
vmovsldup xmm1, xmm7
vmovsd xmm0, qword [rbx + 8]
vmovsd xmm2, qword [rbx + 0x10]
vmulps xmm0, xmm0, xmm1
vaddps xmm0, xmm0, xmm6
mov r9d, dword [rsi + 0x34]
mov r10, qword [rsi + 0x50]
lea r11d, [r9 + 1]
lea ebx, [r9 + 2]
mov word [r10], r9w
mov r10, qword [rsi + 0x50]
mov word [r10 + 2], r11w
mov r10, qword [rsi + 0x50]
mov word [r10 + 4], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 6], r9w
add r9d, 3
vmulps xmm1, xmm2, xmm1
vaddps xmm1, xmm1, xmm6
mov r10, qword [rsi + 0x50]
mov word [r10 + 8], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 0xa], r9w
mov r9, qword [rsi + 0x48]
vmovlps qword [r9], xmm0
mov r9, qword [rsi + 0x48]
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], r8d
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x10], edi
mov r9, qword [rsi + 0x48]
vmovss dword [r9 + 0x14], xmm1
vextractps dword [r9 + 0x18], xmm0, 1
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x1c], edx
mov dword [r9 + 0x20], r8d
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x24], edi
mov r8, qword [rsi + 0x48]
vmovlps qword [r8 + 0x28], xmm1
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x30], edx
mov dword [r8 + 0x34], eax
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x38], edi
mov rdx, qword [rsi + 0x48]
vblendps xmm0, xmm0, xmm1, 2
vmovlps qword [rdx + 0x3c], xmm0
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x44], ecx
mov dword [rdx + 0x48], eax
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x48], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x50], 0xc
vmovaps xmm6, xmmword [rsp + 0x20]
vmovaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400808c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14d, edx
mov edi, edx
sar edi, 0x1f
and edi, edx
dec edi
mov ebp, 0x8000
jmp 0x140080911
call fcn.140080f80
or r15b, bl
and r15b, r12b
xor bl, 1
movzx ecx, r15b
movzx edx, bl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x140080981
mov rax, r14
test eax, eax
jle 0x140080984
lea r14, [rax - 1]
xor ecx, ecx
test r14d, r14d
je 0x14008090d
mov edx, dword [rsi + 0xe88]
and edx, ebp
jne 0x14008090d
add eax, 0xfffffffe
mov r12, qword [rsi + 0x20]
movzx ecx, word [r12 + rax*2]
mov r15b, 1
cmp ecx, 9
je 0x140080951
cmp ecx, 0x20
je 0x140080951
cmp ecx, 0x3000
je 0x140080951
xor r15d, r15d
call fcn.140080f80
mov ebx, eax
mov eax, r14d
movzx ecx, word [r12 + rax*2]
xor r12d, r12d
cmp ecx, 9
je 0x1400808f0
cmp ecx, 0x20
je 0x1400808f0
cmp ecx, 0x3000
je 0x1400808f0
mov r12b, 1
jmp 0x1400808f0
mov edi, r14d
xor eax, eax
test edi, edi
cmovg eax, edi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1400809a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax + 0x79], 0
mov esi, dword [rcx + 0xc]
je 0x140080a65
inc edi
cmp edi, esi
jge 0x140080b18
mov r14d, dword [rbx + 0xe88]
jmp 0x140080a08
or r15b, al
call fcn.140080f80
movzx ecx, r15b
movzx edx, bpl
test al, al
cmove edx, ecx
cmp dl, 1
jne 0x140080b18
inc edi
cmp esi, edi
je 0x140080b11
test r14w, r14w
js 0x1400809fe
mov r12d, edi
dec r12d
js 0x1400809fe
mov r13, qword [rbx + 0x20]
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r15d, r15d
cmp ecx, 9
je 0x140080a3a
cmp ecx, 0x20
je 0x140080a3a
cmp ecx, 0x3000
je 0x140080a3a
mov r15b, 1
call fcn.140080f80
mov ebp, eax
mov eax, r12d
movzx ecx, word [r13 + rax*2]
mov al, 1
cmp ecx, 9
je 0x1400809e0
cmp ecx, 0x20
je 0x1400809e0
cmp ecx, 0x3000
je 0x1400809e0
xor eax, eax
jmp 0x1400809e0
lea r14d, [rdi + 1]
cmp esi, r14d
cmovg r14d, esi
mov r15d, 0x8000
jmp 0x140080aa3
call fcn.140080f80
or r12b, bpl
and r12b, r13b
xor bpl, 1
movzx ecx, r12b
movzx edx, bpl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x140080b18
mov eax, edi
lea edi, [rax + 1]
cmp edi, esi
jge 0x140080b15
xor ecx, ecx
test eax, eax
js 0x140080a9f
mov edx, dword [rbx + 0xe88]
and edx, r15d
jne 0x140080a9f
mov r13, qword [rbx + 0x20]
mov eax, eax
movzx ecx, word [r13 + rax*2]
mov r12b, 1
cmp ecx, 9
je 0x140080ae1
cmp ecx, 0x20
je 0x140080ae1
cmp ecx, 0x3000
je 0x140080ae1
xor r12d, r12d
call fcn.140080f80
mov ebp, eax
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r13d, r13d
cmp ecx, 9
je 0x140080a80
cmp ecx, 0x20
je 0x140080a80
cmp ecx, 0x3000
je 0x140080a80
mov r13b, 1
jmp 0x140080a80
mov edi, esi
jmp 0x140080b18
mov edi, r14d
cmp edi, esi
cmovl esi, edi
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140084fe0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rdx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
add rsp, 0x38
ret
Function at 0x14009ee90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r10, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov qword [rcx], r8
mov qword [r10], rax
mov rsi, qword [rcx]
cmp rsi, r9
je 0x14009f05e
mov r11, qword [rsp + 0x60]
cmp rax, r11
je 0x14009f05e
nop word cs:[rax + rax]
movzx edi, byte [rsi]
test dil, dil
js 0x14009eef0
inc rsi
mov qword [rcx], rsi
jmp 0x14009f030
cmp dil, 0xbf
jbe 0x14009f074
cmp dil, 0xdf
ja 0x14009ef0c
and edi, 0x1f
mov ebx, 1
mov ebp, edi
jmp 0x14009ef50
cmp dil, 0xef
ja 0x14009ef1e
and edi, 0xf
mov ebx, 2
mov ebp, edi
jmp 0x14009ef50
cmp dil, 0xf7
ja 0x14009ef30
and edi, 7
mov ebx, 3
mov ebp, edi
jmp 0x14009ef50
mov ebp, edi
and ebp, 3
xor ebx, ebx
cmp dil, 0xfc
setb bl
xor ebx, 5
nop word cs:[rax + rax]
mov rax, r9
sub rax, rsi
lea edi, [rbx + 1]
cmp rax, rdi
jl 0x14009f05e
lea rax, [rsi + 1]
mov qword [rcx], rax
movzx edi, byte [rsi + 1]
mov eax, 2
cmp dil, 0xbf
jg 0x14009f066
shl ebp, 6
and edi, 0x3f
or edi, ebp
lea r14, [rsi + 2]
mov qword [rcx], r14
cmp ebx, 2
jb 0x14009f030
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x14009f066
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 3]
mov qword [rcx], r14
cmp ebx, 3
jb 0x14009f030
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x14009f066
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 4]
mov qword [rcx], r14
cmp ebx, 4
jb 0x14009f030
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x14009f066
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 5]
mov qword [rcx], r14
cmp ebx, 5
jb 0x14009f030
movzx ebx, byte [r14]
cmp bl, 0xbf
jg 0x14009f066
shl edi, 6
and ebx, 0x3f
or edi, ebx
add rsi, 6
jmp 0x14009eedb
cmp byte [rdx], 0
jne 0x14009f038
mov byte [rdx], 1
cmp edi, 0x10ffff
ja 0x14009f06d
mov rax, qword [r10]
lea rsi, [rax + 2]
mov qword [r10], rsi
mov word [rax], di
mov rsi, qword [rcx]
cmp rsi, r9
je 0x14009f05e
cmp qword [r10], r11
jne 0x14009eed0
xor eax, eax
cmp rsi, r8
sete al
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, 2
jmp 0x14009f066
inc rsi
mov qword [rcx], rsi
mov eax, 2
jmp 0x14009f066
Function at 0x14009f1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov rcx, r8
cmp r8, r9
je 0x14009f36b
mov rax, qword [rsp + 0x48]
mov rcx, r8
test rax, rax
je 0x14009f36b
movzx r10d, byte [rdx]
dec rax
mov rcx, r8
nop dword [rax + rax]
movzx ebx, byte [rcx]
movzx r11d, bl
test r11b, r11b
js 0x14009f230
lea rsi, [rcx + 1]
jmp 0x14009f330
cmp bl, 0xc0
jb 0x14009f36b
cmp bl, 0xdf
ja 0x14009f249
and r11d, 0x1f
mov edi, 1
jmp 0x14009f280
cmp bl, 0xef
ja 0x14009f259
and r11d, 0xf
mov edi, 2
jmp 0x14009f280
cmp bl, 0xf7
ja 0x14009f269
and r11d, 7
mov edi, 3
jmp 0x14009f280
and r11d, 3
xor edi, edi
cmp bl, 0xfc
setb dil
xor edi, 5
nop dword [rax]
mov ebx, r11d
mov r11, r9
sub r11, rcx
lea esi, [rdi + 1]
cmp r11, rsi
jl 0x14009f36b
movzx r11d, byte [rcx + 1]
cmp r11b, 0xbf
jg 0x14009f36b
lea esi, [rdi - 1]
add rsi, rcx
add rsi, 2
shl ebx, 6
and r11d, 0x3f
or r11d, ebx
cmp edi, 2
jb 0x14009f330
movzx ebx, byte [rcx + 2]
cmp bl, 0xbf
jg 0x14009f36b
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 3
jb 0x14009f330
movzx ebx, byte [rcx + 3]
cmp bl, 0xbf
jg 0x14009f36b
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 4
jb 0x14009f330
movzx ebx, byte [rcx + 4]
cmp bl, 0xbf
jg 0x14009f36b
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 5
jb 0x14009f330
movzx edi, byte [rcx + 5]
cmp dil, 0xbf
jg 0x14009f36b
shl r11d, 6
and edi, 0x3f
or r11d, edi
test r10b, r10b
je 0x14009f340
cmp r11d, 0x10ffff
jbe 0x14009f34f
jmp 0x14009f36b
mov byte [rdx], 1
mov r10b, 1
cmp r11d, 0x10ffff
ja 0x14009f36b
cmp rsi, rcx
je 0x14009f36b
add rax, 0xffffffffffffffff
jae 0x14009f368
mov rcx, rsi
cmp rsi, r9
jne 0x14009f210
jmp 0x14009f36b
mov rcx, rsi
sub rcx, r8
cmp rcx, 0x7fffffff
mov eax, 0x7fffffff
cmovl rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
ret