joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400772a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140094040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140077314
nop dword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140077340
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400772f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140078400
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x1400e8318], eax
jmp 0x14007731f

Function at 0x140077b38
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140077b72
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140077b77
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140077bc0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14007daa0]
cmp byte [rcx + rax], 0
je 0x140077bc0
dec r8
sub rdx, 1
jne 0x140077ba6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140079214
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007925e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007925e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007925e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007925e
cmp dword [rcx + 0x84], 0xe
jbe 0x14007925e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140079260
xor al, al
add rsp, 0x28
ret
Function at 0x1400037c4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140003598
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003598
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003598
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003598
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003598
cmp dword [rcx + 0x84], 0xe
jbe 0x140003598
cmp dword [rcx + 0xf8], esi
je 0x140003598
mov ecx, r14d
call fcn.1400036e0
mov ecx, 2
call fcn.140006840
nop
cmp byte [0x140043560], 0
jne 0x140003662
mov r15d, 1
mov eax, r15d
xchg dword [0x140043554], eax
test ebx, ebx
jne 0x14000360b
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140043558]
cmp rcx, rax
je 0x140003602
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400017b0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140043570]
jmp 0x140003617
cmp ebx, r15d
jne 0x14000361d
lea rcx, [0x140043588]
call fcn.140003de4
nop
test ebx, ebx
jne 0x140003634
lea rdx, [0x1400375c0]
lea rcx, [0x1400375a0]
call fcn.140003458
lea rdx, [0x1400375d0]
lea rcx, [0x1400375c8]
call fcn.140003458
movzx eax, byte [0x140043560]
test esi, esi
cmove eax, r15d
mov byte [0x140043560], al
jmp 0x140003662
mov ecx, 2
call fcn.140006894
test esi, esi
jne 0x140003679
mov ecx, r14d
call fcn.140003694
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140003528
Function at 0x140004e10
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140004ded
call fcn.14000455c
mov dword [rax], 0x16
call fcn.14000443c
or eax, 0xffffffff
jmp 0x140004e0a
sub dword [rcx + 0x10], 1
jns 0x140004dfc
add rsp, 0x28
jmp 0x140009a94
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140004dcc
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140009750
call fcn.14000455c
mov dword [rax], 0x16
call fcn.14000443c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140009738
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140009738
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140009782
lock or dword [rax + 0x14], 0x10
jmp 0x140009738
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14000979f
mov rcx, qword [rbp + 0x10]
call fcn.14000c004
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140004da4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14000b9e0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400097f6
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140009738
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140009862
mov rcx, qword [rbp + 0x10]
call fcn.140004da4
cmp eax, 0xffffffff
je 0x140009849
mov rcx, qword [rbp + 0x10]
call fcn.140004da4
cmp eax, 0xfffffffe
je 0x140009849
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140004da4
movsxd rdi, eax
lea rsi, [0x1400435c0]
mov rcx, rbx
sar rdi, 6
call fcn.140004da4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140009850
lea rax, [0x140042150]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140009862
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140009898
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140009894
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140009894
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14000973b
jmp 0x140009708
Function at 0x140009a9c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140009902
call fcn.14000455c
mov dword [rax], 0x16
call fcn.14000443c
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400098e4
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400098e4
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x140009934
lock or dword [rax + 0x14], 0x10
jmp 0x1400098e4
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140009951
mov rcx, qword [rbp + 0x20]
call fcn.14000c004
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x140009966
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x14000996c
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140004da4
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14000b9e0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1400099bf
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1400098e4
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140009a2b
mov rcx, qword [rbp + 0x20]
call fcn.140004da4
cmp eax, 0xffffffff
je 0x140009a12
mov rcx, qword [rbp + 0x20]
call fcn.140004da4
cmp eax, 0xfffffffe
je 0x140009a12
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.140004da4
movsxd rdi, eax
lea r15, [0x1400435c0]
mov rcx, rbx
sar rdi, 6
call fcn.140004da4
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x140009a19
lea rax, [0x140042150]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140009a2b
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x140009a61
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140009a5d
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140009a5d
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x140009a7f
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x140009a8a
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1400098e9
jmp 0x1400098b0
Function at 0x14000ff20
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
push rbp
lea rbp, [rsp - 0x19e0]
mov eax, 0x1ae0
call fcn.14000d0f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x19d0], rax
xor eax, eax
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x1980], rax
lea r8, [rbp + 0x1980]
mov qword [rbp + 0x1988], rax
xor edx, edx
mov qword [rbp + 0x1990], rax
mov qword [rbp + 0x1998], rax
mov qword [rbp + 0x19a0], rax
mov qword [rbp + 0x19a8], rax
mov qword [rbp + 0x19b0], rax
mov qword [rbp + 0x19b8], rax
mov word [rbp + 0x19c0], ax
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x14001005c
mov ecx, dword [rsp + 0x40]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x1af8], rbx
lea edx, [rax + 1]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x140010054
mov ecx, dword [rsp + 0x40]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x44]
mov dword [rsp + 0x44], 0xa
lea rdx, [rsp + 0x4c]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
jne 0x140010054
cmp dword [rsp + 0x44], ebx
jbe 0x140010054
mov ecx, dword [rsp + 0x40]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.RstrtMgr.DLL_RmShutdown]
test eax, eax
jne 0x14001002f
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov ecx, dword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.RstrtMgr.DLL_RmRestart]
test eax, eax
jne 0x14001004c
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
inc ebx
cmp ebx, dword [rsp + 0x44]
jb 0x140010010
mov rbx, qword [rsp + 0x1af8]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
mov rcx, qword [rbp + 0x19d0]
xor rcx, rsp
call fcn.140001030
add rsp, 0x1ae0
pop rbp
ret
Function at 0x140010090
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x858
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x840], rax
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [rsp + 0x20]
lea rdx, [rsp + 0x20]
xor ecx, ecx
test ax, ax
je 0x1400103b2
nop dword [rax]
rol ecx, 7
lea rdx, [rdx + 2]
movzx eax, ax
xor ecx, eax
movzx eax, word [rdx]
test ax, ax
jne 0x1400100e0
cmp ecx, 0x6fb678ae
ja 0x140010274
je 0x140010395
cmp ecx, 0x3830e441
ja 0x1400101cc
je 0x140010395
cmp ecx, 0x13bcefbd
ja 0x14001017f
je 0x140010395
cmp ecx, 0x853e7d4
je 0x140010395
cmp ecx, 0x8916cc4
je 0x140010395
cmp ecx, 0xa70aef6
je 0x140010395
cmp ecx, 0xa932103
je 0x140010395
cmp ecx, 0xd6cc512
jne 0x1400103b2
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0x191cb07e
je 0x140010395
cmp ecx, 0x197244af
je 0x140010395
cmp ecx, 0x1be85856
je 0x140010395
cmp ecx, 0x28b5fd61
jne 0x1400103b2
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0x58cae791
ja 0x140010227
je 0x140010395
cmp ecx, 0x389ff251
je 0x140010395
cmp ecx, 0x38abaa39
je 0x140010395
cmp ecx, 0x55b2ac88
je 0x140010395
cmp ecx, 0x58532646
jne 0x1400103b2
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0x621ec8d1
je 0x140010395
cmp ecx, 0x68347478
je 0x140010395
cmp ecx, 0x693126b4
je 0x140010395
cmp ecx, 0x6932f547
jne 0x1400103b2
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0xbeba4434
ja 0x14001032e
je 0x140010395
cmp ecx, 0x9663be08
ja 0x1400102e1
je 0x140010395
cmp ecx, 0x71adf2e1
je 0x140010395
cmp ecx, 0x7933a751
je 0x140010395
cmp ecx, 0x89d322ce
je 0x140010395
cmp ecx, 0x8a53e4d9
jne 0x1400103b2
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0x971f3464
je 0x140010395
cmp ecx, 0x9b6d2710
je 0x140010395
cmp ecx, 0xb7e0edc0
je 0x140010395
cmp ecx, 0xb890e4cf
jne 0x1400103b2
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0xfa747f45
ja 0x140010375
je 0x140010395
cmp ecx, 0xdded5961
je 0x140010395
cmp ecx, 0xe892b59f
je 0x140010395
cmp ecx, 0xf9736caf
je 0x140010395
cmp ecx, 0xfa12254f
jne 0x1400103b2
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0xfa9269ae
je 0x140010395
cmp ecx, 0xfb52008a
je 0x140010395
cmp ecx, 0xfb520a0d
je 0x140010395
cmp ecx, 0xfb5acd1d
jne 0x1400103b2
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
xor eax, eax
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
Function at 0x1400103e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x858
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [rsp + 0x20]
lea rdx, [rsp + 0x20]
xor ecx, ecx
test ax, ax
je 0x14001063f
nop word [rax + rax]
rol ecx, 7
lea rdx, [rdx + 2]
movzx eax, ax
xor ecx, eax
movzx eax, word [rdx]
test ax, ax
jne 0x140010430
cmp ecx, 0x7a53f792
ja 0x140010545
je 0x1400105f5
cmp ecx, 0x5131b871
ja 0x1400104ec
je 0x1400105f5
cmp ecx, 0x451fc816
ja 0x1400104b7
je 0x1400105f5
cmp ecx, 0x7024f2
je 0x1400105f5
cmp ecx, 0x1105a4b2
je 0x1400105f5
cmp ecx, 0x314d3d80
jne 0x14001063f
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0x45575934
je 0x1400105f5
cmp ecx, 0x462194b9
jne 0x14001063f
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0x5132ffec
je 0x1400105f5
cmp ecx, 0x5aba650c
je 0x1400105f5
cmp ecx, 0x62610d8b
je 0x1400105f5
cmp ecx, 0x71792943
je 0x1400105f5
cmp ecx, 0x717a6ede
jne 0x14001063f
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0xe2c4812a
ja 0x1400105d3
je 0x1400105f5
cmp ecx, 0xb1337c03
ja 0x1400105a2
je 0x1400105f5
cmp ecx, 0x7efaf42e
je 0x1400105f5
cmp ecx, 0x917fe531
je 0x1400105f5
cmp ecx, 0xb119506e
jne 0x14001063f
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0xc0c81819
je 0x1400105f5
cmp ecx, 0xd6452416
jne 0x14001063f
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0xfa12254f
ja 0x140010612
je 0x1400105f5
cmp ecx, 0xea932256
je 0x1400105f5
cmp ecx, 0xee9b3274
je 0x1400105f5
cmp ecx, 0xf60dbd24
jne 0x14001063f
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
cmp ecx, 0xfa747f45
je 0x1400105f5
cmp ecx, 0xfa9269ae
jne 0x14001063f
mov eax, 1
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
xor eax, eax
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.140001030
add rsp, 0x858
ret
Function at 0x140010b90
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push r14
sub rsp, 0x48
mov r14, rcx
mov rsi, rdx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x78]
xor r9d, r9d
mov dword [rsp + 0x30], 0x75
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x70], 0x75
mov dword [rsp + 0x78], 0x75
lea r8d, [r9 + 1]
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x140010c69
mov qword [rsp + 0x60], rbx
xor edx, edx
mov ebx, dword [rsp + 0x78]
mov qword [rsp + 0x40], rdi
mov r8d, ebx
mov rdi, qword [rsp + 0x90]
mov rcx, rdi
call fcn.140002350
mov r8d, dword [rsp + 0x70]
mov rdx, r14
mov rcx, rdi
call fcn.140001cb0
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x140010c69
mov eax, dword [rsp + 0x78]
mov dword [rsi], eax
xor eax, eax
add rsp, 0x48
pop r14
pop rsi
ret

Function at 0x140010c80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x120
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r10, r8
mov edi, r9d
xor r8b, r8b
mov word [rsp + 0x100], 0
xor bl, bl
lea rdx, [rsp]
xor ebp, ebp
mov rsi, rcx
movzx eax, bp
mov r9d, 0x100
nop dword [rax + rax]
mov byte [rdx], al
lea rdx, [rdx + 1]
inc ax
cmp ax, r9w
jb 0x140010cd0
lea r11, [rsp]
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r11]
movzx eax, r8b
inc r8b
movzx ecx, byte [rax + rsi]
add cl, dl
add bl, cl
lea rcx, [rsp]
movzx eax, bl
add rcx, rax
movzx eax, byte [rcx]
mov byte [r11], al
inc r11
movzx eax, r8b
mov r8d, ebp
cmp al, 0x75
mov byte [rcx], dl
cmovne r8d, eax
sub r9, 1
jne 0x140010cf0
movzx r9d, byte [rsp + 0x100]
movzx r11d, byte [rsp + 0x101]
test edi, edi
je 0x140010d94
mov rbx, rdi
nop dword [rax]
nop dword [rax + rax]
inc r9b
lea r8, [rsp]
movzx eax, r9b
lea rcx, [rsp]
add r8, rax
lea r10, [r10 + 1]
movzx edx, byte [r8]
add r11b, dl
movzx eax, r11b
add rcx, rax
movzx eax, byte [rcx]
mov byte [r8], al
mov byte [rcx], dl
movzx ecx, byte [r8]
add rcx, rdx
movzx eax, cl
movzx ecx, byte [rsp + rax]
xor byte [r10 - 1], cl
sub rbx, 1
jne 0x140010d50
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140001030
mov rbx, qword [rsp + 0x148]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010f10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x140045394]
je 0x140010f71
mov dword [0x140045394], eax
lea r9, [0x1400453a0]
mov dword [0x1400453a0], eax
mov eax, 1
nop word [rax + rax]
lea ecx, [rax - 1]
movsxd rdx, ecx
mov ecx, dword [r9 + rdx*4]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
movsxd rcx, eax
imul r8d, edx, 0x6c078965
add r8d, eax
inc eax
mov dword [r9 + rcx*4], r8d
cmp eax, 0x270
jl 0x140010f40
mov dword [0x140045398], eax
call fcn.140011010
mov r11d, eax
mov eax, 0xff00ff01
mul r11d
shr edx, 8
imul ecx, edx, 0x101
sub r11d, ecx
mov eax, r11d
add rsp, 0x28
ret

Function at 0x140011010
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [0x140045398]
lea r10, [0x1400453a0]
cmp edx, 0x270
jl 0x1400110da
mov r8, r10
lea r9, [0x14003f028]
lea rdx, [0x14004572c]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
xor ecx, dword [r8]
btr ecx, 0x1f
xor ecx, dword [r8]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [r9 + rax*4]
xor eax, ecx
xor eax, dword [r8 + 0x634]
mov dword [r8], eax
add r8, 4
cmp r8, rdx
jl 0x140011040
lea r8, [0x140045d5c]
nop word [rax + rax]
mov ecx, dword [rdx + 4]
xor ecx, dword [rdx]
btr ecx, 0x1f
xor ecx, dword [rdx]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [r9 + rax*4]
xor eax, ecx
xor eax, dword [rdx - 0x38c]
mov dword [rdx], eax
add rdx, 4
cmp rdx, r8
jl 0x140011080
mov ecx, dword [0x1400453a0]
xor ecx, dword [0x140045d5c]
btr ecx, 0x1f
xor ecx, dword [0x140045d5c]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [r9 + rax*4]
xor eax, ecx
xor eax, dword [0x1400459d0]
mov dword [0x140045d5c], eax
xor edx, edx
movsxd rax, edx
inc edx
mov dword [0x140045398], edx
mov ecx, dword [r10 + rax*4]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret