joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400052eb
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140005321
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140005329
mov esi, dword [rdx]
mov r9d, 4
jmp 0x14000532e
xor r10d, r10d
jmp 0x1400053dc
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140005351
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140005368
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140005388
add r11, r8
jmp 0x1400054ac
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140005450
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400053fe
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140005462
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x140005468
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x14000548e
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x1400054a8
add r10, r8
movzx edx, byte [rdx + r10]
movzx edx, byte [rdx + rdx]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140005704
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test byte [rdx], 1
je 0x140005744
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x140005823
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x140005832
cmp byte [rdx + 0x1a], 0
jne 0x14000584a
mov r8, qword [rdx + 8]
mov rax, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10b, byte [rdx + 0x18]
mov r11d, r10d
xor r10b, 1
test r8, r8
je 0x140005781
cmp r8, r9
jae 0x14000577b
cmp byte [rax + r8], 0xbf
jg 0x140005781
jmp 0x14000586e
jne 0x14000586e
cmp r8, r9
je 0x14000583c
mov bl, byte [rax + r8]
movzx esi, bl
test sil, sil
jns 0x1400057e5
mov edi, esi
and edi, 0x1f
movzx ebp, byte [rax + r8 + 1]
and ebp, 0x3f
cmp sil, 0xdf
jbe 0x1400057d7
movzx esi, byte [rax + r8 + 2]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp bl, 0xf0
jb 0x1400057e0
movzx ebx, byte [rax + r8 + 3]
and edi, 7
shl edi, 0x12
shl esi, 6
and ebx, 0x3f
or ebx, esi
or ebx, edi
mov esi, ebx
jmp 0x1400057e5
shl edi, 6
or edi, ebp
mov esi, edi
jmp 0x1400057e5
shl edi, 0xc
or esi, edi
test r11b, 1
jne 0x14000584e
mov r11d, 1
cmp esi, 0x80
jb 0x140005817
mov r11d, 2
cmp esi, 0x800
jb 0x140005817
cmp esi, 0x10000
mov r11d, 4
sbb r11, 0
add r8, r11
mov qword [rdx + 8], r8
jmp 0x14000575e
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
mov rdx, rax
call fcn.140003ec9
jmp 0x140005865
mov byte [rdx + 0x18], r10b
test r11b, 1
jne 0x140005855
mov byte [rdx + 0x1a], 1
xor eax, eax
jmp 0x140005862
mov byte [rdx + 0x18], r10b
mov r9, r8
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov eax, 1
mov qword [rcx], rax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov byte [rdx + 0x18], r10b
lea rcx, [0x1400b6628]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, r9
call fcn.140084180
int3
Function at 0x140011064
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rdx, qword [rcx + 0x90]
mov r8, qword [rcx + 0x98]
mov rsi, qword [rcx + 0x150]
mov rdi, qword [rcx + 0x158]
lea rbx, [rbp - 0x20]
mov rcx, rbx
call fcn.140047430
mov rax, qword [rbx]
mov r8, qword [rbx + 8]
mov rcx, rax
neg rcx
jo 0x1400110e9
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x50]
mov qword [rdx], rax
mov qword [rdx + 8], r8
mov qword [rdx + 0x10], rcx
lea rbx, [rbp - 0x38]
mov rcx, rbx
mov r8b, 1
call fcn.140049390
mov rcx, qword [rbx]
mov r8, qword [rbx + 8]
mov rax, rcx
neg rax
jno 0x140011110
mov rdi, r8
lea rcx, [rbp - 0x48]
mov qword [rcx - 8], 1
mov qword [rcx], rdi
call fcn.14000286e
xor eax, eax
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 8], rcx
mov qword [rbp], r8
lea rcx, [rbp - 0x20]
mov rdx, rsi
mov r8, rdi
call fcn.140047430
mov rax, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x18]
mov rcx, rax
neg rcx
jo 0x140011166
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp - 0x50]
mov qword [rdx], rax
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], rcx
lea rcx, [rbp - 0x38]
mov r8b, 1
call fcn.140049390
mov rbx, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov rax, rbx
neg rax
jno 0x14001118f
mov r14, qword [rbp]
mov rdi, rsi
cmp qword [rbp - 8], 0
je 0x1400110ec
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400110ec
xor eax, eax
lea r9, [rbp - 0x50]
mov qword [r9], rax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea r8, [0x14005ed10]
mov r14, qword [rbp]
mov rcx, r14
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x1400111f7
test rbx, rbx
je 0x1400111d7
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp - 8], 0
je 0x1400111f0
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x140011102
call sub.KERNEL32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
test rbx, rbx
je 0x14001116d
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14001116d
Function at 0x1400116ec
Capabilities:
Set file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rdx, qword [rcx + 0x150]
mov r8, qword [rcx + 0x158]
lea rbx, [rsp + 0x48]
mov rcx, rbx
call fcn.140020a80
mov rdi, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
add rax, rdi
lea rdx, [rsp + 0x60]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
lea rcx, [rsp + 0x30]
call fcn.140063b72
cmp qword [rbx], 0
je 0x140011752
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
cmp rbx, r14
jne 0x140011771
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.1400644d5
mov r14, qword [rdi]
mov rdi, qword [rsp + 0x38]
mov word [rdi + rbx*2], 0
inc rbx
mov qword [rsp + 0x40], rbx
mov rcx, rdi
mov edx, 0x80
call sub.KERNEL32.dll_SetFileAttributesW
mov rcx, rdi
mov edx, 1
call sub.KERNEL32.dll_BeginUpdateResourceW
mov rbx, rax
mov rax, qword [rsi + 8]
mov ecx, dword [rsi + 0x10]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov edx, 0x10
mov r8d, 1
mov rcx, rbx
mov r9w, 0x409
call sub.KERNEL32.dll_UpdateResourceW
mov rcx, rbx
xor edx, edx
call sub.KERNEL32.dll_EndUpdateResourceW
mov rcx, rdi
mov edx, 7
call sub.KERNEL32.dll_SetFileAttributesW
test r14, r14
je 0x140011801
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, rdi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14001ee61
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, rdx
mov rdi, rcx
add r9, r8
lea rbx, [rsp + 0x50]
mov qword [rbx], r8
mov qword [rbx + 8], r9
xor r15d, r15d
mov word [rbx + 0x10], r15w
mov ebp, 1
mov dword [rbx + 0x18], ebp
lea r14, [rsp + 0x38]
mov rcx, r14
mov rdx, rbx
call fcn.140026875
add rsi, rdi
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
mov word [rbx + 0x10], r15w
mov dword [rbx + 0x18], ebp
lea rdi, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140026875
mov rsi, qword [rdi + 8]
mov r8, qword [r14 + 8]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rsi
xor r9d, r9d
call sub.SHELL32.dll_ShellExecuteW
cmp qword [rdi], 0
je 0x14001ef03
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x38], 0
je 0x14001ef2f
mov r8, qword [rsp + 0x40]
mov rcx, qword [0x1400cdc50]
xor edx, edx
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14002e080
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x14002e0e4
mov esi, eax
mov rcx, rbx
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14002e0c2
xor edi, edi
jmp 0x14002e0e4
mov al, byte [0x1400cdcc0]
mov edx, 4
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x14002e0ef
mov rdi, rax
and esi, 0x7fffffff
mov dword [rax], esi
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov ecx, 4
mov edx, 4
call fcn.140083a60
int3

Function at 0x14002efbd
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
and rsp, 0xffffffffffffff80
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rdx + 0x28]
mov r15b, byte [rdx + 0x30]
lea rcx, [rsp + 0x80]
call fcn.14002e25d
mov rax, qword [rsi + 0x60]
mov qword [rsp + 0x78], rax
movabs rax, 0x7465646279746573
movabs rcx, 0x6c7967656e657261
movabs rdx, 0xded7d4e2d7dedfc6
movabs r8, 0xa60c596fc19fead0
movabs r9, 0xe414a674f0de7325
mov r13d, 1
lock xadd qword [0x1400cdb80], r13
mov r10, r13
xor r10, rax
mov r11, r10
rol r11, 0x10
lea r12, [r10 + rcx]
xor r11, r12
lea rbx, [r11 + rdx]
xor r13, rbx
add r10, r8
mov r12, r10
rol r12, 0x20
rol r11, 0x15
xor r10, r9
xor r11, rbx
btc r11, 0x3b
add r13, r10
rol r10, 0xd
add r12, r11
xor r10, r13
rol r11, 0x10
xor r11, r12
rol r13, 0x20
add r12, r10
add r13, r11
rol r10, 0x11
xor r10, r12
rol r11, 0x15
rol r12, 0x20
xor r11, r13
btc r13, 0x3b
xor r12, 0xff
add r13, r10
add r12, r11
rol r10, 0xd
xor r10, r13
rol r11, 0x10
rol r13, 0x20
xor r11, r12
add r12, r10
rol r10, 0x11
add r13, r11
xor r10, r12
rol r11, 0x15
xor r11, r13
rol r12, 0x20
add r13, r10
add r12, r11
rol r10, 0xd
xor r10, r13
rol r11, 0x10
rol r13, 0x20
xor r11, r12
add r12, r10
rol r10, 0x11
add r13, r11
xor r10, r12
rol r11, 0x15
xor r11, r13
rol r12, 0x20
add r13, r10
add r12, r11
rol r10, 0xd
xor r10, r13
rol r11, 0x10
xor r11, r12
add r12, r10
rol r10, 0x11
rol r11, 0x15
mov r13, r12
rol r13, 0x20
xor r13, r10
xor r13, r11
cmp r13, r12
je 0x14002f032
xor r13, r12
mov rbx, qword [rsi + 0x58]
movups xmm0, xmmword [rsi + 0x38]
movups xmm1, xmmword [rsi + 0x48]
movups xmmword [rdi + 0x128], xmm1
movups xmmword [rdi + 0x118], xmm0
mov qword [rdi + 0x138], r14
mov byte [rdi + 0x140], r15b
lea rdx, [rsp + 0x80]
mov r8d, pe_nt_image_headers64
mov rcx, rdi
call fcn.140082480
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x100], rax
mov qword [rdi + 0x108], r13
mov qword [rdi + 0x110], rbx
mov rax, qword [rsi + 0x10]
neg rax
jo 0x14002f1bf
jae 0x14002f1bf
mov r8, qword [rsi + 0x18]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rsp, [rbp + 0x138]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400346e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400346f3
pop rbp
jmp fcn.140024280
nop
pop rbp
jmp fcn.140020fd0
Function at 0x1400410b8
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov r10d, r8d
rol r10d, 0x19
mov eax, dword [rdx]
mov esi, eax
rol esi, 0x19
mov r11d, dword [rdx + 4]
mov ebp, r11d
rol ebp, 0x19
mov edi, dword [rdx + 8]
mov r14d, edi
rol r14d, 0x19
mov ebx, r8d
rol ebx, 0xe
xor ebx, r10d
mov r15d, eax
rol r15d, 0xe
xor r15d, esi
mov r12d, r11d
rol r12d, 0xe
xor r12d, ebp
mov ebp, edi
rol ebp, 0xe
mov r10, qword [rsp + 0x60]
xor ebp, r14d
shr r8d, 3
mov esi, eax
shr esi, 3
xor esi, r15d
add esi, r11d
shr r11d, 3
xor r11d, r12d
add r11d, edi
shr edi, 3
xor edi, ebp
add edi, dword [rdx + 0xc]
add esi, dword [r9]
add r11d, dword [r9 + 4]
add edi, dword [r9 + 8]
mov edx, dword [r10 + 4]
mov ebp, edx
rol ebp, 0xf
xor r8d, ebx
mov ebx, edx
rol ebx, 0xd
mov r9d, dword [r10]
xor ebx, ebp
shr edx, 0xa
xor edx, ebx
add edx, edi
mov edi, r9d
rol edi, 0xf
mov ebx, r9d
rol ebx, 0xd
xor ebx, edi
shr r9d, 0xa
mov edi, edx
rol edi, 0xf
xor r9d, ebx
mov ebx, edx
rol ebx, 0xd
add r9d, r11d
xor ebx, edi
mov r11d, edx
shr r11d, 0xa
xor r11d, ebx
mov edi, r9d
rol edi, 0xf
add r11d, esi
mov esi, r9d
rol esi, 0xd
xor esi, edi
mov edi, r9d
shr edi, 0xa
xor edi, esi
add eax, dword [r10 + 0xc]
add eax, r8d
add eax, edi
mov dword [rcx], eax
mov dword [rcx + 4], r11d
mov dword [rcx + 8], r9d
mov dword [rcx + 0xc], edx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400419ec
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg1 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x140041a08
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg2 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x140042990
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1400b7dc0]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140042a00
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140042a2d
test eax, eax
js 0x140042a0c
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140042a23
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140041ff0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140042180
mov ecx, 7
int 0x29
ud2

Function at 0x140044950
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x140047f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi

Function at 0x140048350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov qword [rbp - 0x20], rcx
movzx r15d, byte [rdx + 0x18]
mov byte [rdx + 0x18], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 2
mov qword [rbp - 8], 0
mov r12, qword [rdx + 8]
movzx esi, word [rdx + 0x10]
mov eax, 2
xor edi, edi
xor r13d, r13d
jmp 0x1400483bc
mov word [rax + rdi*2], r14w
inc rdi
mov qword [rbp - 8], rdi
mov rdx, qword [rbx]
nop
mov r14d, esi
test si, si
jne 0x140048460
cmp rdx, r12
je 0x140048517
lea rcx, [rdx + 1]
mov qword [rbx], rcx
movzx r9d, byte [rdx]
movzx r14d, r9b
test r14b, r14b
jns 0x14004847b
mov r8d, r14d
and r8d, 0x1f
lea rcx, [rdx + 2]
mov qword [rbx], rcx
movzx r10d, byte [rdx + 1]
and r10d, 0x3f
cmp r14b, 0xdf
jbe 0x140048471
lea rcx, [rdx + 3]
mov qword [rbx], rcx
movzx r14d, byte [rdx + 2]
shl r10d, 6
and r14d, 0x3f
or r14d, r10d
cmp r9b, 0xf0
jb 0x140048490
lea rcx, [rdx + 4]
mov qword [rbx], rcx
movzx edx, byte [rdx + 3]
and r8d, 7
shl r8d, 0x12
shl r14d, 6
and edx, 0x3f
or edx, r14d
or edx, r8d
mov r14d, edx
cmp r14d, 0xffff
jbe 0x14004847b
jmp 0x1400484a0
mov word [rbx + 0x10], 0
xor esi, esi
cmp r14w, 0x22
je 0x140048487
jmp 0x1400484e0
shl r8d, 6
or r8d, r10d
mov r14d, r8d
xor esi, esi
mov rdx, rcx
cmp r14w, 0x22
jne 0x1400484e0
xor r13b, 1
jmp 0x1400483c0
shl r8d, 0xc
or r14d, r8d
cmp r14d, 0xffff
add byte [rax], al
jbe 0x14004847b
lea r8d, [r14 + 0xff0000]
shr r8d, 0xa
or r8d, 0xd800
and r14d, 0x3ff
add byte [rax], al
or r14d, 0xdc00
mov word [rbx + 0x10], r14w
mov rdx, rcx
mov esi, r14d
mov r14d, r8d
cmp r14w, 0x22
je 0x140048487
nop word cs:[rax + rax]
movzx ecx, r14w
cmp ecx, 0x3b
jne 0x1400484f7
test r13b, 1
je 0x140048513
mov r13b, 1
mov r14w, 0x3b
cmp rdi, qword [rbp - 0x18]
jne 0x1400483b0
lea rcx, [rbp - 0x18]
call fcn.140046af0
mov rax, qword [rbp - 0x10]
jmp 0x1400483b0
mov byte [rbx + 0x18], 1
test rdi, rdi
setne al
or r15b, al
je 0x14004855d
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 0x40]
mov r8, rdi
call fcn.140045430
movups xmm0, xmmword [rbp - 0x40]
movups xmm1, xmmword [rbp - 0x30]
mov rax, qword [rbp - 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
cmp qword [rbp - 0x18], 0
jne 0x140048575
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movabs rax, 0x8000000000000000
mov rcx, qword [rbp - 0x20]
mov qword [rcx], rax
cmp qword [rbp - 0x18], 0
je 0x14004854c
mov r8, qword [rbp - 0x10]
mov rcx, qword [0x1400cdc50]
xor edx, edx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x140048880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, r8
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov rbx, qword [rsi + 0x10]
xor r14d, r14d
mov eax, 0
cmp rbx, 3
jb 0x1400488ec
movzx r8d, byte [rbx + rcx - 2]
mov r9d, r8d
and r9b, 0xf0
xor r14d, r14d
cmp r9b, 0xa0
jne 0x1400488ec
xor r14d, r14d
cmp byte [rbx + rcx - 3], 0xed
jne 0x1400488ec
movzx r14d, byte [rbx + rcx - 1]
and r8d, 0xf
and r14d, 0x3f
shl r8d, 0x10
shl r14d, 0xa
or r14d, r8d
mov al, 1
cmp rdi, 3
jb 0x140048998
cmp byte [rdx], 0xed
jne 0x1400489a1
movzx r12d, byte [rdx + 1]
mov r8d, r12d
and r8b, 0xf0
cmp r8b, 0xb0
setne r8b
xor al, 1
or al, r8b
jne 0x1400489a1
movzx r13d, byte [rdx + 2]
cmp rbx, 3
jb 0x140048931
add rbx, 0xfffffffffffffffd
mov qword [rsi + 0x10], rbx
and r13d, 0x3f
shl r12d, 6
lea r8, [rdi + 1]
mov rax, qword [rsi]
sub rax, rbx
cmp rax, r8
jb 0x140048a8b
add rdx, 3
mov r15, rdx
and r12d, 0x3c0
or r14d, r13d
or r14d, r12d
add r14d, 0x10000
mov rcx, rsi
mov edx, r14d
call fcn.140046970
add rdi, 0xfffffffffffffffd
mov rax, qword [rsi]
mov rbx, qword [rsi + 0x10]
sub rax, rbx
cmp rax, rdi
jb 0x140048ab0
mov rcx, qword [rsi + 8]
add rcx, rbx
mov rdx, r15
jmp 0x140048a3e
test rdi, rdi
je 0x140048a30
lea rax, [rdx + rdi]
mov r9, rdx
jmp 0x1400489c8
add r9, 2
cmp r8, rax
cmovne r8, r9
nop word cs:[rax + rax]
mov r9, r8
cmp r8, rax
je 0x140048a30
lea r8, [r9 + 1]
movzx r10d, byte [r9]
test r10b, r10b
jns 0x1400489c0
cmp r10b, 0xe0
jb 0x1400489aa
cmp r10b, 0xed
jne 0x1400489ff
cmp r8, rax
je 0x140048a30
lea r8, [r9 + 2]
cmp r8, rax
je 0x140048a30
cmp byte [r9 + 1], 0x9f
ja 0x140048a2c
add r9, 3
mov r8, r9
jmp 0x1400489c0
add r9, 2
cmp r8, rax
cmove r9, r8
xor r8d, r8d
cmp r9, rax
setne r8b
add r8, r9
cmp r10b, 0xf0
jb 0x1400489c0
xor r9d, r9d
cmp r8, rax
setne r9b
add r8, r9
jmp 0x1400489c0
mov byte [rsi + 0x18], 0
mov rax, qword [rsi]
sub rax, rbx
cmp rax, rdi
jb 0x140048a5e
add rcx, rbx
mov r8, rdi
call fcn.140082480
add rbx, rdi
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r14, rdx
mov rdx, rbx
mov r8, rdi
call fcn.140086340
mov rdx, r14
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
jmp 0x140048a3b
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r15, rdx
mov rdx, rbx
call fcn.140086340
mov rdx, r15
jmp 0x14004894c
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.140086340
mov rbx, qword [rsi + 0x10]
jmp 0x140048989

Function at 0x140049120
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
Function at 0x140055c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x40]
call fcn.140047430
mov rax, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
mov rcx, rax
neg rcx
jno 0x140055c7d
mov qword [rbp - 0x20], rdi
movabs rax, 0x8000000000000000
mov qword [rbp - 0x28], rax
jmp 0x140055cae
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x58]
call fcn.140055b40
mov rbx, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
mov rax, rbx
neg rax
jno 0x140055d35
mov eax, edi
and eax, 3
cmp eax, 1
jne 0x140055d1a
lea rax, [rdi - 1]
mov qword [rbp - 0x10], rax
mov rax, qword [rdi - 1]
mov qword [rbp - 8], rax
mov rax, qword [rdi + 7]
mov qword [rbp], rax
mov rax, qword [rax]
test rax, rax
je 0x140055cde
mov rcx, qword [rbp - 8]
call rax
mov r8, qword [rbp - 8]
mov rax, qword [rbp]
cmp qword [rax + 8], 0
je 0x140055d07
cmp qword [rax + 0x10], 0x11
jb 0x140055cf8
mov r8, qword [r8 - 8]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movabs rax, 0x8000000000000000
mov qword [rsi], rax
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov r14, qword [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140055d54
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x140055d27
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
je 0x140055d27
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, rdi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp qword [sym.imp.KERNEL32.dll_HeapFree]