joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400706bb
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov dword [0x14007b720], eax
mov eax, dword [0x14007b720]
cmp eax, 0xffffffff
jne 0x1400706e2
call sym.abort
nop
add rsp, 0x20
pop rbp
ret

Function at 0x140070895
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x1400b6150]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x14007b720]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x1400708e8
mov rax, qword [rbp - 0x10]
jmp 0x140070a48
call sym.pop_pthread_mem
mov qword [rbp - 0x10], rax
mov rax, qword [sym.__dyn_tls_pthread]
test rax, rax
je 0x140070904
cmp qword [rbp - 0x10], 0
jne 0x14007090e
mov eax, 0
jmp 0x140070a48
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call sym.replace_spin_keys
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x1400709e9
call sym.abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x14007b720]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x140070a44
call sym.abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140070b42
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call sym.__pthread_self_lite
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x140070baf
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_longjmp]
call rax
mov eax, dword [0x14007b720]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x140070cf3
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140070c4c
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140070c07
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 0x10], 0
mov eax, dword [0x14007b720]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x140070cf3
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140070c86
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x140070cf3
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 0x10], 0
mov eax, dword [0x14007b720]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140071935
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x14007b730]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x1400b6150]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x14007b720]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x140071a4a
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x14007b730]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x140071a18
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x14007b730]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x140071a59
lea rax, [0x14007b730]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140071a95
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140071b03
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x14007b720]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x140071b4d
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x140071b4d
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x14007b730]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x140071b3f
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140001750
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x798]
sub rsp, 0x880
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400ada20]
xor rax, rsp
mov qword [rbp + 0x770], rax
mov rbx, rcx
cmp byte [rcx + 0x68], 0
jne 0x140001973
xor r15d, r15d
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rcx
lea r8, [0x140001440]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea r8, [0x1400015d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea r8, [0x1400019a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
mov qword [rsp + 0x60], rax
lea r9, str.DRWRawImg_Rised_Event
xor r8d, r8d
lea edx, [r15 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x20], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
lea r8, [rsp + 0x50]
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140001de0
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
cmp r14, rbx
je 0x140001875
mov qword [rbx], rdi
add rbx, 8
mov qword [rsp + 0x40], rbx
jmp 0x140001891
lea r8, [rsp + 0x58]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140001de0
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
cmp r14, rbx
je 0x1400018a4
mov qword [rbx], rsi
add rbx, 8
mov qword [rsp + 0x40], rbx
jmp 0x1400018c0
lea r8, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140001de0
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x38]
sub rbx, rsi
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memmove
sar rbx, 3
mov r9d, 0xffffffff
mov r8d, 1
lea rdx, [rsp + 0x70]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rdi, r15
test rbx, rbx
je 0x140001926
nop
mov rcx, qword [rsi + rdi*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + rdi*8], r15
inc rdi
cmp rdi, rbx
jb 0x140001910
test rsi, rsi
je 0x140001973
sub r14, rsi
and r14, 0xfffffffffffffff8
mov rax, rsi
cmp r14, 0x1000
jb 0x14000195a
add r14, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000195a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, rsi
call fcn.14007c570
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r15
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.14007c510
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000ad80
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1400ada20]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rax, vtable.LibRaw_bigfile_buffered_datastream.0
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
add rcx, 0x20
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x14000ade4
call fcn.140003c30
nop
mov qword [rbx + 0x50], rsi
mov qword [rbx + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x40], 0
lea rcx, [rbx + 0x60]
lea rax, [fcn.140002e80]
mov qword [rsp + 0x20], rax
lea r9, [0x14000b2c0]
mov edx, 0x28
lea r8d, [rdx - 0x26]
call fcn.14007ca60
mov dword [rbx + 0xb0], 1
lea rdi, [rbx + 0x20]
cmp qword [rbx + 0x30], 0
jbe 0x14000ae99
cmp qword [rdi + 0x18], 8
jb 0x14000ae48
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x14000aecc
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14000aecc
mov rcx, qword [rsp + 0x40]
mov qword [rbx + 0x10], rcx
jmp 0x14000aecc
movdqa xmm6, xmmword [0x1400815e0]
mov word [rsp + 0x50], si
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x14000aec4
mov rcx, rdi
call fcn.140003a30
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm6
mov qword [rbx + 8], 0xffffffffffffffff
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14007c510
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret
Function at 0x14000b5e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
xor eax, eax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, rsi
lea r8d, [rax + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x20], rax
test rax, rax
je 0x14000b662
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x60], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14000b685
mov rax, qword [rbx + 0x30]
xor r9d, r9d
mov rcx, qword [rbx + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x14000b6a8
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
lea rdx, str.failed_to_create_file_mapping
lea rcx, [rsp + 0x30]
call fcn.14000b380
lea rdx, [0x1400a4c60]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.failed_to_get_the_file_size
lea rcx, [rsp + 0x30]
call fcn.14000b380
lea rdx, [0x1400a4c60]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.failed_to_map_the_file
lea rcx, [rsp + 0x30]
call fcn.14000b380
lea rdx, [0x1400a4c60]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14000bc60
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rax, r9
mov r10, r8
mov r9, qword [rcx + 8]
mov r11, rdx
test r9, r9
je 0x14000bc8a
mov r8, rax
mov rdx, r10
mov rcx, r11
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
lea rdx, [0x1400a4c08]
mov dword [rsp + 0x30], 4
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14000bd40
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rcx, qword [rcx + 8]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000bd99
xor eax, eax
mov qword [r11 - 0x20], rax
mov dword [r11 - 0x20], r9d
sar r9, 0x20
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x18], rax
lea rax, [r11 - 0x30]
mov dword [r11 - 0x1c], r9d
lea r9, [r11 + 8]
mov qword [r11 - 0x48], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000bd92
mov eax, dword [rsp + 0x70]
add rsp, 0x68
ret
xor eax, eax
add rsp, 0x68
ret
lea rdx, [0x1400a4c08]
mov dword [rsp + 0x30], 4
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14002b5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 0x48d000
jne 0x14002b62b
cmp qword [rcx + 0x2efb8], 0
jne 0x14002b6de
call sym.EURawImg.exe_protected:_int___cdecl_LibRaw::nikon_e995_void____ptr64
test eax, eax
je 0x14002b6de
mov eax, dword [0x140094844]
mov dword [rbx + 0x10c], eax
movzx eax, byte [0x140094848]
mov byte [rbx + 0x110], al
add rsp, 0x20
pop rbx
ret
cmp edx, 0x2ce000
jne 0x14002b66e
cmp qword [rcx + 0x2efb8], 0
jne 0x14002b6de
call sym.EURawImg.exe_protected:_int___cdecl_LibRaw::nikon_e2100_void____ptr64
test eax, eax
jne 0x14002b6de
mov eax, dword [0x14009484c]
mov dword [rbx + 0x10c], eax
movzx eax, word [0x140094850]
mov word [rbx + 0x110], ax
add rsp, 0x20
pop rbx
ret
cmp edx, 0x48e000
jne 0x14002b68a
cmp qword [rcx + 0x2efb8], 0
jne 0x14002b6de
add rsp, 0x20
pop rbx
jmp sym.EURawImg.exe_protected:_void___cdecl_LibRaw::nikon_3700_void____ptr64
cmp edx, 0x599000
jne 0x14002b6de
cmp qword [rcx + 0x2efb8], 0
jne 0x14002b6de
call sym.EURawImg.exe_protected:_int___cdecl_LibRaw::minolta_z2_void____ptr64
test eax, eax
je 0x14002b6de
movabs rax, 0x61746c6f6e694d
mov dword [rbx + 0x20c], 0x28
mov qword [rbx + 0xcc], rax
movsd xmm0, qword [str.DiMAGE_Z2]
movsd qword [rbx + 0x10c], xmm0
movzx eax, word [0x140090858]
mov word [rbx + 0x114], ax
add rsp, 0x20
pop rbx
ret
Function at 0x140030a20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x5a8
mov rax, qword [0x1400ada20]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov rbp, rcx
mov esi, r9d
mov ecx, 0xff
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov rdx, rbx
mov ecx, 0xd8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
xor eax, eax
lea rdx, str.Exif
nop dword [rax]
movzx ecx, byte [rdi + rax + 6]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x140030a86
cmp rax, 5
jne 0x140030a70
jmp 0x140030afc
movsd xmm0, qword [0x140080ee0]
mov ecx, 0x568
movzx eax, word [0x140080ee8]
movsd qword [rsp + 0x580], xmm0
mov word [rsp + 0x588], ax
call qword [sym.imp.WS2_32.dll_htons]
mov edx, 1
lea rcx, [rsp + 0x580]
mov r9, rbx
mov word [rsp + 0x582], ax
lea r8d, [rdx + 9]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rbp
call sym.EURawImg.exe_protected:_void___cdecl_LibRaw::tiff_head_struct_tiff_hdr____ptr64__int____ptr64
mov r9, rbx
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x560
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea eax, [rsi - 2]
mov r9, rbx
movsxd r8, eax
lea rcx, [rdi + 2]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.14007c510
add rsp, 0x5a8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400349c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x330
mov rax, qword [0x1400ada20]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rbx, rcx
xor edi, edi
mov rcx, rbx
call sym.EURawImg.exe_protected:_void___cdecl_LibRaw::checkCancel_void____ptr64
mov rcx, qword [rbx + 0x5d158]
lea rdx, [rsp + 0x20]
mov r9d, 0x300
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp eax, 0x300
jge 0x140034a19
mov rcx, rbx
call sym.EURawImg.exe_protected:_void___cdecl_LibRaw::derror_void____ptr64
mov eax, 0xc7ce0c7d
mul edi
shr edx, 6
cmp edx, 0xc
jae 0x140034a31
mov r8d, edx
or r8d, 1
jmp 0x140034a39
lea r8d, [rdx*2 - 0x18]
imul eax, edx, 0x52
mov ecx, edi
sub ecx, eax
lea eax, [rcx + rcx*2]
lea r10d, [r8 + rax*4]
mov eax, edi
sub eax, 0x5c4
je 0x140034a81
sub eax, 1
je 0x140034b81
sub eax, 1
je 0x140034a74
sub eax, 1
je 0x140034b81
cmp eax, 1
jne 0x140034a87
mov r10d, 0x3d9
jmp 0x140034a87
mov edx, 1
mov r10d, 0x3d9
jmp 0x140034a90
mov r10d, 0x3d8
cmp edx, 0xc
jae 0x140034b45
test dl, 1
je 0x140034b45
xor eax, eax
xor r11d, r11d
nop
cmp eax, 1
je 0x140034af2
lea ecx, [rax + 1]
test cl, 2
je 0x140034acc
mov r8d, eax
shr r8d, 1
lea ecx, [r8 - 1]
movzx r9d, byte [rsp + rcx + 0x20]
lea ecx, [r8 + 1]
movzx ecx, byte [rsp + rcx + 0x20]
add r9w, cx
jmp 0x140034adc
mov rcx, r11
shr rcx, 1
movzx r9d, byte [rsp + rcx + 0x20]
add r9w, r9w
movzx edx, word [rbx + 0x12]
mov rcx, qword [rbx + 0x2f3f0]
imul edx, r10d
add edx, eax
mov word [rcx + rdx*2], r9w
inc eax
inc r11
xor r10d, 1
cmp eax, 0x5fd
jb 0x140034aa0
movzx edx, byte [rsp + 0x21]
movzx ecx, word [rbx + 0x12]
add dx, dx
mov rax, qword [rbx + 0x2f3f0]
imul ecx, r10d
inc ecx
mov word [rax + rcx*2], dx
movzx ecx, word [rbx + 0x12]
movzx edx, byte [rsp + 0x31d]
mov rax, qword [rbx + 0x2f3f0]
add dx, dx
imul ecx, r10d
add ecx, 0x5fd
mov word [rax + rcx*2], dx
jmp 0x140034b81
mov r8d, r10d
and r8d, 1
nop dword [rax]
movzx ecx, word [rbx + 0x12]
imul ecx, r10d
mov eax, r8d
shr rax, 1
add ecx, r8d
add r8d, 2
movzx edx, byte [rsp + rax + 0x20]
mov rax, qword [rbx + 0x2f3f0]
add dx, dx
mov word [rax + rcx*2], dx
cmp r8d, 0x5fe
jb 0x140034b50
inc edi
cmp edi, 0x5c9
jb 0x1400349e4
mov dword [rbx + 0x25538], 0x1fe
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.14007c510
mov rbx, qword [rsp + 0x348]
add rsp, 0x330
pop rdi
ret
Function at 0x14003cd20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov rbx, rcx
mov ecx, 0x4949
xor r15d, r15d
mov r14d, r15d
mov eax, 3
cmp word [rbx + 0x5d1e0], cx
cmove r14d, eax
movzx edx, word [rbx + 0x5db18]
add rdx, rdx
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.14000aa70
nop
mov ebp, r15d
mov rdi, qword [rsp + 0x28]
cmp r15w, word [rbx + 0x10]
jae 0x14003cf02
nop dword [rax]
mov rcx, qword [rbx + 0x5d158]
movzx esi, word [rbx + 0x5db18]
mov rax, qword [rcx]
lea rdx, [rsi + rdi]
mov r9d, esi
mov r8d, 1
call qword [rax + 0x10]
cmp eax, esi
jge 0x14003cdc4
mov rcx, rbx
call sym.EURawImg.exe_protected:_void___cdecl_LibRaw::derror_void____ptr64
movzx esi, word [rbx + 0x5db18]
mov eax, r15d
cmp r15w, si
jae 0x14003ce01
movzx edx, word [rbx + 0x5db18]
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
xor ecx, r14d
add ecx, edx
movsxd rcx, ecx
movsxd rdx, eax
movzx ecx, byte [rcx + rdi]
mov byte [rdx + rdi], cl
inc eax
movzx edx, word [rbx + 0x5db18]
cmp eax, edx
jl 0x14003cde0
mov r9d, r15d
movzx r10d, word [rbx + 0x12]
cmp r15w, r10w
jae 0x14003cef4
lea r8, [rdi + 4]
nop word [rax + rax]
movzx edx, byte [r8 - 4]
shl dx, 2
movzx eax, byte [r8]
and al, 3
movzx ecx, al
or dx, cx
movzx eax, r10w
imul eax, ebp
add eax, r9d
movsxd rcx, eax
mov rax, qword [rbx + 0x2f3f0]
mov word [rax + rcx*2], dx
movzx edx, byte [r8 - 3]
shl dx, 2
movzx eax, byte [r8]
shr al, 2
and al, 3
movzx eax, al
or dx, ax
movzx eax, word [rbx + 0x12]
imul eax, ebp
add eax, r9d
movsxd rcx, eax
mov rax, qword [rbx + 0x2f3f0]
mov word [rax + rcx*2 + 2], dx
movzx edx, byte [r8 - 2]
shl dx, 2
movzx eax, byte [r8]
shr al, 4
and al, 3
movzx eax, al
or dx, ax
movzx eax, word [rbx + 0x12]
imul eax, ebp
add eax, r9d
movsxd rcx, eax
mov rax, qword [rbx + 0x2f3f0]
mov word [rax + rcx*2 + 4], dx
movzx edx, byte [r8 - 1]
shl dx, 2
movzx eax, byte [r8]
shr al, 6
movzx ecx, al
or dx, cx
movzx eax, word [rbx + 0x12]
imul eax, ebp
add eax, r9d
movsxd rcx, eax
mov rax, qword [rbx + 0x2f3f0]
mov word [rax + rcx*2 + 6], dx
movzx r10d, word [rbx + 0x12]
lea r8, [r8 + 5]
add r9d, 4
cmp r9d, r10d
jl 0x14003ce20
inc ebp
movzx eax, word [rbx + 0x10]
cmp ebp, eax
jl 0x14003cd90
test rdi, rdi
je 0x14003cf3f
mov rdx, qword [rsp + 0x38]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003cf37
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003cf37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14007c570
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret