joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16c74
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
xor ebx, ebx
mov rdi, r8
mov rsi, rcx
cmp rdx, rbx
je 0x16dda
cmp r8, rbx
je 0x16dda
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xa8]
mov edx, 0x20019
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x68], 0x240
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x16dda
mov rcx, qword [rsp + 0xa8]
lea rax, [rsp + 0x98]
lea r8d, [rbx + 2]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000034
je 0x16dcc
cmp dword [rsp + 0x98], ebx
je 0x16dcc
mov edx, dword [rsp + 0x98]
lea ecx, [rbx + 1]
mov r8d, 0x686c706d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, qword [rsp + 0xa8]
mov rdi, rax
cmp rax, rbx
je 0x16dd4
lea rax, [rsp + 0x98]
lea r8d, [rbx + 2]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x98]
mov r9, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
jl 0x16daf
mov r8d, dword [rsp + 0x98]
lea rdx, [rdi + 0xc]
mov rcx, rsi
call fcn.0001dd60
mov bl, 1
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, bl
jmp 0x16ddc
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x17ee8
Capabilities:
Create device object

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
lea rdx, [0x0001e6b0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [0x00022068]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], r11
mov r9d, 9
xor edx, edx
mov rcx, rbx
mov byte [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jns 0x17f3b
or eax, 0xffffffff
jmp 0x17fcb
lea rdx, [0x0001e6d0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
test eax, eax
js 0x17f33
lea rax, [0x00017bd0]
mov qword [rbx + 0x70], rax
lea rax, [0x00017c54]
mov qword [rbx + 0x80], rax
lea rax, [0x00017c9c]
mov qword [rbx + 0x100], rax
lea rax, [0x00017cc4]
mov qword [rbx + 0x88], rax
lea rax, [0x00017db8]
mov qword [rbx + 0x90], rax
lea rax, [0x00017e98]
mov qword [rbx + 0xe0], rax
mov rax, qword [0x00022068]
or dword [rax + 0x30], 0x10
mov rax, qword [0x00022068]
btr dword [rax + 0x30], 7
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x1832c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x18376
test rdx, rdx
je 0x18376
mov rsi, qword [rdx + 0x1b8]
test rsi, rsi
je 0x18376
movzx ecx, word [rcx]
sub ecx, 1
je 0x18454
sub ecx, 1
je 0x1838f
cmp ecx, 1
je 0x18508
or eax, 0xffffffff
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rsi, qword [rsi + 0x28]
test rsi, rsi
je 0x18376
mov r9d, dword [rdi + 4]
cmp dword [rsi + 0x88], r9d
je 0x183b0
mov r8d, 1
jmp 0x184fb
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and dword [rsp + 0x50], 0
xor eax, eax
lea rcx, [rdi + 0xc]
xor r9d, r9d
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
movzx eax, word [rdi + 2]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsi + 0x90]
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ecx, dword [rsp + 0x58]
add dword [rsi + 0x84], ecx
movzx eax, word [rdi + 2]
mov edx, dword [rsi + 0x84]
cmp ecx, eax
jne 0x18432
cmp edx, dword [rdi + 8]
jne 0x18432
cmp edx, dword [rsi + 0x80]
jl 0x18508
mov rcx, rbx
call fcn.000182dc
jmp 0x18508
mov r9d, dword [rdi + 4]
mov edx, 2
mov rcx, rbx
lea r8d, [rdx - 1]
call fcn.0001b2d0
mov rcx, rbx
call fcn.000182dc
jmp 0x18376
cmp qword [rsi + 0x28], 0
je 0x18463
mov rcx, rdx
call fcn.000182dc
mov edx, 0x98
xor ecx, ecx
mov r8d, 0x53434b4d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
test rax, rax
je 0x18376
xor edx, edx
mov r8d, 0x98
mov rcx, rax
call fcn.0001dc60
lea r8, [rdi + 0x10]
lea rdx, [0x0001e720]
mov rcx, rbp
mov qword [rsi + 0x28], rbp
call qword [sym.imp.ntoskrnl.exe_sprintf]
mov r11d, dword [rdi + 0xc]
mov rcx, rbp
mov dword [rbp + 0x80], r11d
call fcn.00017fd8
mov qword [rbp + 0x90], rax
mov ecx, dword [rdi + 4]
mov dword [rbp + 0x88], ecx
test rax, rax
jne 0x184f4
mov rcx, rbx
call fcn.000182dc
mov r9d, dword [rdi + 4]
mov edx, 2
lea r8d, [rdx - 1]
mov rcx, rbx
call fcn.0001b2d0
jmp 0x18376
mov r9d, dword [rdi + 4]
xor r8d, r8d
mov edx, 2
mov rcx, rbx
call fcn.0001b2d0
xor eax, eax
jmp 0x18379
Function at 0x18518
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x120
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x98
call fcn.0001dc60
mov r11d, 4
cmp r11w, word [rdi]
jne 0x1877c
lea r8, [rdi + 0xc]
lea rdx, [0x0001e720]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_sprintf]
lea rcx, [rsp + 0x60]
xor r13d, r13d
call fcn.00018170
or r12d, 0xffffffff
mov rbp, rax
cmp rax, r13
jne 0x1858f
mov ebx, r12d
jmp 0x185ca
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x50]
mov r9d, 0x18
mov rcx, rax
mov dword [rsp + 0x20], 5
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, r13d
mov rcx, rbp
cmp eax, r13d
cmovge ebx, dword [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0xe0], ebx
call fcn.00018170
mov qword [rsp + 0xf0], rax
cmp rax, r13
jne 0x1860d
mov rcx, rsi
call fcn.000182dc
mov r9d, dword [rdi + 4]
mov edx, 3
lea r8d, [rdx - 2]
mov rcx, rsi
call fcn.0001b2d0
mov eax, r12d
jmp 0x1877e
mov edx, 0xc14
xor ecx, ecx
mov r8d, 0x53434b4d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r13
je 0x18769
mov word [rax + 2], r13w
mov ebp, 3
mov word [rax], bp
mov ecx, dword [rdi + 4]
mov dword [rax + 4], ecx
mov word [rax + 0xa], r13w
lea ecx, [rbp - 2]
mov word [rax + 8], cx
mov eax, dword [rdi + 4]
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0xe0]
mov dword [rbx + 0x10], eax
cmp rsi, r13
je 0x1875e
lea r9d, [rbp + 0x11]
mov r8, rbx
xor edx, edx
mov rcx, rsi
call fcn.000195d0
cmp eax, r13d
jl 0x1875e
mov eax, dword [rsp + 0xe4]
cmp eax, dword [rsp + 0xe0]
jge 0x1875e
lea r12, [rbx + 0x14]
xor ecx, ecx
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x140], eax
lea rax, [rsp + 0x140]
mov dword [rsp + 0x54], ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x144], ecx
mov rcx, qword [rsp + 0xf0]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0xc00
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r13d
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov r9d, dword [rsp + 0x58]
cmp r9d, r13d
jle 0x1875e
add dword [rsp + 0xe4], r9d
mov word [rbx], bp
mov word [rbx + 2], r13w
mov eax, dword [rdi + 4]
mov r8, rbx
xor edx, edx
mov dword [rbx + 4], eax
mov eax, 2
mov rcx, rsi
mov word [rbx + 8], ax
movzx eax, r9w
add r9d, 0x14
mov word [rbx + 0xa], ax
mov eax, dword [rdi + 4]
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0xe4]
mov dword [rbx + 0x10], eax
call fcn.000195d0
cmp eax, r13d
jl 0x1875e
mov eax, dword [rsp + 0xe4]
cmp eax, dword [rsp + 0xe0]
jl 0x18696
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xf0]
cmp rcx, r13
je 0x1877c
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1a358
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x000201f0]
and dword [0x00022084], 0
mov edx, 0x20
mov rcx, qword [rax + 8]
lea rax, [0x0001a1c8]
mov r8d, 0xb8
mov qword [0x00032498], rcx
lea rcx, [0x000201b8]
mov qword [0x00032490], rax
call fcn.00012414
and qword [rsp + 0x30], 0
and qword [rsp + 0x50], 0
lea rax, [0x0001b808]
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
js 0x1a3fe
mov r8, qword [sym.imp.ntoskrnl.exe_PsThreadType]
and qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x50]
mov r8, qword [r8]
lea rax, [0x00022088]
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
call fcn.00017a34
call fcn.00017444
lea rax, [0x0001bd7c]
lea r11, [0x0001bdb8]
mov ecx, 0x40
mov qword [0x000221b0], rax
lea rax, [0x0001ad08]
mov qword [0x000221f0], r11
mov qword [0x00024260], rax
lea rax, [0x0001b030]
lea r8d, [rcx - 0x38]
mov qword [0x00024268], rax
movabs rax, 0xfffff78000000320
mov edx, 0x200
mov rax, qword [rax]
mov dword [0x00020148], eax
lea rax, [0x00018cac]
mov qword [0x00024270], rax
call fcn.00018830
and qword [0x00024280], 0
xor r8d, r8d
mov qword [0x00022070], rax
lea edx, [r8 + 0x20]
mov ecx, edx
call fcn.00018830
mov qword [0x00022078], rax
lea rax, [0x00032490]
add rsp, 0x48
ret

Function at 0x1a4b8
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x1a0
and dword [rsp + 0x30], 0
and dword [rsp + 0x34], 0
mov rbx, rdx
mov rdi, rcx
movsxd rsi, r8d
lea rdx, [rax + 0x18]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rax + 0x18], 0x3ca0f4e7
mov dword [rsp + 0x38], 0x67452301
mov dword [rsp + 0x3c], 0xefcdab89
mov dword [rsp + 0x40], 0x98badcfe
mov dword [rsp + 0x44], 0x10325476
call fcn.0001be90
lea rcx, [rsp + 0x30]
mov r8d, esi
mov rdx, rbx
call fcn.0001be90
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.0001bf54
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.0001dd60
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x90]
mov r8d, 0x10
call fcn.0001c86c
lea r8, [rsp + 0x90]
mov edx, esi
mov rcx, rdi
call fcn.0001c900
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1a58c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x130
mov r9d, dword [rcx + 0x1c0]
xor esi, esi
movsxd rdi, r8d
mov rbp, rdx
mov rbx, rcx
cmp r9d, 6
je 0x1a679
test r9d, r9d
je 0x1a679
lea eax, [r9 - 4]
cmp eax, 1
ja 0x1a63f
cmp r9d, 5
jne 0x1a602
cmp edi, 8
jbe 0x1a602
lea rdx, [rcx + 0x2ca]
lea r8d, [rsi + 0x10]
lea rcx, [rsp + 0x20]
call fcn.0001c86c
lea edx, [rdi - 8]
lea rcx, [rbp + 8]
lea r8, [rsp + 0x20]
call fcn.0001c900
xor r10d, r10d
xor r9d, r9d
test edi, edi
jle 0x1a63a
movzx eax, word [rbx + 0x2c6]
add eax, r10d
inc r10d
cdq
and edx, 0x7f
add eax, edx
and eax, 0x7f
sub eax, edx
movsxd rcx, eax
mov al, byte [rcx + rbx + 0x245]
xor byte [r9 + rbp], al
inc r9
cmp r9, rdi
jl 0x1a60c
mov esi, 1
mov rax, qword [rbx]
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
call qword [rax + 0x10]
mov r11d, eax
test eax, eax
jne 0x1a674
test esi, esi
je 0x1a674
movzx eax, word [rbx + 0x2c6]
add eax, edi
cdq
and edx, 0x7f
add eax, edx
and eax, 0x7f
sub eax, edx
mov word [rbx + 0x2c6], ax
mov eax, r11d
jmp 0x1a67c
or eax, 0xffffffff
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1a764
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x120
mov rdi, rcx
mov r8d, 0x114
add rcx, 0x9c
mov rsi, rdx
mov dword [rax + 8], 0x3ca0f4e7
call fcn.0001dd60
lea rdx, [rsi + 0x14]
mov ecx, 0x40
mov rax, rdx
mov r8d, 0x9910
xor word [rax], r8w
add rax, 2
sub rcx, 1
jne 0x1a7a2
lea rcx, [rdi + 0x245]
mov r8d, 0x80
call fcn.0001dd60
lea rdx, [rdi + 0x245]
lea rcx, [rdi + 0x245]
mov r8d, 0x80
call fcn.0001a4b8
lea rcx, [rdi + 0x1c5]
mov r8d, 0x80
mov rdx, rcx
call fcn.0001a4b8
and dword [rsp + 0x20], 0
and dword [rsp + 0x24], 0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.0001be90
lea rdx, [rdi + 0x245]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
call fcn.0001be90
lea rdx, [rdi + 0x205]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
call fcn.0001be90
lea rdx, [rdi + 0x2ca]
lea rcx, [rsp + 0x20]
call fcn.0001bf54
mov r11, qword [rdi + 0x338]
test r11, r11
je 0x1a88c
mov rdx, rsi
mov rcx, rdi
call r11
mov eax, 0x9911
mov ebx, 0x9c
lea rcx, [rsp + 0x88]
mov word [rsp + 0x80], ax
mov al, byte [rdi + 0x1c4]
lea rdx, [rdi + 8]
lea r8d, [rbx - 8]
mov byte [rsp + 0x82], 0x15
mov dword [rsp + 0x84], ebx
mov byte [rsp + 0x83], al
call fcn.0001dd60
lea rdx, [rsp + 0x80]
mov r8d, ebx
mov rcx, rdi
mov dword [rdi + 0x1c0], 4
call qword [rdi + 0x318]
lea r11, [rsp + 0x120]
xor eax, eax
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1a90c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x140
mov edx, dword [0x00020148]
xor ebx, ebx
mov rdi, rcx
mov rcx, rbx
mov ebp, 0x80
imul edx, edx, 0x343fd
inc rcx
add edx, 0x269ec3
mov eax, edx
shr eax, 0x10
cmp rcx, rbp
mov byte [rdi + rcx + 0x1c4], al
jl 0x1a93b
mov al, byte [rdi + 0x1c4]
mov dword [0x00020148], edx
lea rcx, [rsp + 0x3c]
lea rdx, [rdi + 0x1c5]
mov r12d, 0x9910
mov r8, rbp
mov byte [rsp + 0x23], al
mov byte [rsp + 0x22], 0x12
mov dword [rsp + 0x24], 0x11c
mov word [rsp + 0x20], r12w
call fcn.0001dd60
mov r11, qword [rdi + 0x348]
cmp r11, rbx
je 0x1a9af
lea rdx, [rsp + 0x28]
mov rcx, rdi
call r11
xor word [rsp + rbx + 0x3c], r12w
add rbx, 2
cmp rbx, rbp
jl 0x1a9af
lea rdx, [rdi + 0x1c5]
lea rcx, [rdi + 0x1c5]
mov r8d, ebp
call fcn.0001a4b8
lea rdx, [rsp + 0x20]
mov r8d, 0x11c
mov rcx, rdi
mov dword [rdi + 0x1c0], 2
call qword [rdi + 0x318]
lea r11, [rsp + 0x140]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x1aa18
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x80
mov r8d, dword [rdx + 0x10]
mov rdi, rcx
mov rbx, rdx
mov dword [rax + 8], 0x3ca0f4e7
call qword [rdi + 0x350]
xor esi, esi
cmp eax, esi
je 0x1aa7c
mov eax, 0x9911
mov byte [rsp + 0x9a], 0x17
mov dword [rdi + 0x1c0], 1
mov word [rsp + 0x98], ax
mov al, byte [rdi + 0x1c4]
or esi, 0xffffffff
mov byte [rsp + 0x9b], al
jmp 0x1ab67
lea rcx, [rdi + 8]
mov rdx, rbx
mov r8d, 0x94
call fcn.0001dd60
lea rcx, [rdi + 0x245]
lea rdx, [rdi + 0x1c]
mov r8d, 0x80
call fcn.0001dd60
lea rdx, [rdi + 0x245]
lea rcx, [rdi + 0x245]
mov r8d, 0x80
call fcn.0001a4b8
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.0001be90
mov ebx, 0x40
lea rdx, [rdi + 0x1c5]
lea rcx, [rsp + 0x20]
mov r8d, ebx
call fcn.0001be90
lea rdx, [rdi + 0x285]
lea rcx, [rsp + 0x20]
mov r8d, ebx
call fcn.0001be90
lea rdx, [rdi + 0x2ca]
lea rcx, [rsp + 0x20]
call fcn.0001bf54
mov cl, byte [rdi + 0x1c4]
mov eax, 0x9911
mov word [rsp + 0x98], ax
mov byte [rsp + 0x9a], 0x16
mov dword [rdi + 0x1c0], 5
mov byte [rsp + 0x9b], cl
mov r8d, 8
lea rdx, [rsp + 0x98]
mov rcx, rdi
mov dword [rsp + 0x9c], r8d
call qword [rdi + 0x318]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov eax, esi
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1c86c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r10d, r10d
lea rbx, [rcx + 8]
mov r9, rcx
mov dword [rcx + 4], r10d
mov dword [rcx], r10d
mov edi, r8d
mov rcx, rbx
mov rsi, rdx
mov eax, r10d
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x100
jl 0x1c898
mov r11d, r10d
movzx r8d, byte [rbx]
mov eax, r11d
inc r11d
cdq
idiv edi
movsxd rax, edx
movsx ecx, byte [rax + rsi]
lea edx, [r10 + rcx]
add edx, r8d
movzx r10d, dl
mov al, byte [r10 + r9 + 8]
mov byte [rbx], al
inc rbx
cmp r11d, 0x100
mov byte [r10 + r9 + 8], r8b
jl 0x1c8a9
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [r9], r11d
mov dword [r9 + 4], r10d
ret
Function at 0x34008
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
and qword [0x00032580], 0
mov rbp, rcx
lea rdx, [rsp + 0x30]
lea rcx, [0x0001e180]
call fcn.00016b6c
test al, al
jne 0x340e3
lea rcx, [0x0001e190]
call fcn.00011008
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea rcx, [0x0001e180]
mov qword [0x00020208], r9
call fcn.00016b6c
test al, al
jne 0x3417a
lea rcx, [0x0001e190]
call fcn.00011008
xor edx, edx
mov rax, qword [0x00020208]
lea r8, [rdx + 8]
lea rcx, [0x00034310]
lea r9, [r8 + 8]
mov qword [0x00020790], rdx
mov qword [0x00020798], r8
mov qword [0x000207a0], r9
mov qword [rsp + 0x20], rax
call fcn.00011008
test rdx, rdx
je 0x34264
test rax, rax
je 0x34264
mov rcx, qword [r8]
nop
nop
nop
nop
nop
test eax, eax
je 0x341f7
lea rcx, [0x00034370]
jmp 0x3426b
mov rcx, qword [rsp + 0x40]
lea rdx, [0x0001e1c0]
call fcn.00016a8c
mov rdi, rax
test rax, rax
je 0x3404f
lea rcx, [0x0001e1f0]
mov rdx, rax
call fcn.00011008
xor esi, esi
xor ebx, ebx
cmp byte [rbx + rdi], 0x49
jne 0x34148
cmp byte [rbx + rdi + 1], 0x8b
jne 0x34148
cmp byte [rbx + rdi + 2], 0xcc
jne 0x34148
movsxd rax, esi
mov edx, 0xe8
mov r8d, 8
lea rcx, [rax + rdi + 3]
call qword [sym.imp.ntoskrnl.exe_memchr]
mov rdx, rax
test rax, rax
jne 0x3415b
inc esi
inc rbx
cmp esi, 0x100
jge 0x3404f
jmp 0x34113
mov r8d, dword [rax + 1]
lea rcx, [0x0001e220]
add r8d, 5
movsxd r9, r8d
add r9, rax
call fcn.00011008
jmp 0x34052
mov rcx, qword [rsp + 0x40]
lea rdx, [0x0001e250]
call fcn.00016a8c
mov rdi, rax
test rax, rax
je 0x3407e
lea rcx, [0x0001e270]
mov rdx, rax
call fcn.00011008
xor edx, edx
xor ecx, ecx
mov r8d, 0xffffff
mov eax, dword [rcx + rdi]
and eax, r8d
cmp eax, 0x158b48
jne 0x341cb
mov eax, dword [rcx + rdi + 7]
and eax, r8d
cmp eax, 0xd8b48
je 0x341df
inc rcx
inc edx
cmp rcx, 0x600
jge 0x3407e
jmp 0x341b0
movsxd rcx, edx
mov eax, dword [rcx + rdi + 3]
add eax, 7
movsxd rdx, eax
add rdx, rcx
add rdx, rdi
jmp 0x34080
and qword [0x000201a0], 0
lea rax, [0x000201a0]
mov qword [0x000201f0], rax
lea rax, [0x00011740]
mov qword [0x000201b0], rax
lea rax, [0x00011be8]
mov qword [0x000201a8], rax
call fcn.00016490
call fcn.0001a358
mov qword [0x00032570], rax
lea rax, [0x00011020]
lea rdi, [rbp + 0x70]
mov ecx, 0x1c
rep stosq qword [rdi], rax
mov rcx, rbp
call fcn.00017ee8
lea rdx, [0x00012118]
xor eax, eax
mov qword [rbp + 0x68], rdx
jmp 0x34275
lea rcx, [0x00034350]
call fcn.00011008
mov eax, 0xc0000001
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00034294
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x34008
Function at 0x342f0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
and qword [0x00032580], 0
mov rbp, rcx
lea rdx, [rsp + 0x30]
lea rcx, [0x0001e180]
call fcn.00016b6c
test al, al
jne 0x340e3
lea rcx, [0x0001e190]
call fcn.00011008
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea rcx, [0x0001e180]
mov qword [0x00020208], r9
call fcn.00016b6c
test al, al
jne 0x3417a
lea rcx, [0x0001e190]
call fcn.00011008
xor edx, edx
mov rax, qword [0x00020208]
lea r8, [rdx + 8]
lea rcx, [0x00034310]
lea r9, [r8 + 8]
mov qword [0x00020790], rdx
mov qword [0x00020798], r8
mov qword [0x000207a0], r9
mov qword [rsp + 0x20], rax
call fcn.00011008
test rdx, rdx
je 0x34264
test rax, rax
je 0x34264
mov rcx, qword [r8]
nop
nop
nop
nop
nop
test eax, eax
je 0x341f7
lea rcx, [0x00034370]
jmp 0x3426b
mov rcx, qword [rsp + 0x40]
lea rdx, [0x0001e1c0]
call fcn.00016a8c
mov rdi, rax
test rax, rax
je 0x3404f
lea rcx, [0x0001e1f0]
mov rdx, rax
call fcn.00011008
xor esi, esi
xor ebx, ebx
cmp byte [rbx + rdi], 0x49
jne 0x34148
cmp byte [rbx + rdi + 1], 0x8b
jne 0x34148
cmp byte [rbx + rdi + 2], 0xcc
jne 0x34148
movsxd rax, esi
mov edx, 0xe8
mov r8d, 8
lea rcx, [rax + rdi + 3]
call qword [sym.imp.ntoskrnl.exe_memchr]
mov rdx, rax
test rax, rax
jne 0x3415b
inc esi
inc rbx
cmp esi, 0x100
jge 0x3404f
jmp 0x34113
mov r8d, dword [rax + 1]
lea rcx, [0x0001e220]
add r8d, 5
movsxd r9, r8d
add r9, rax
call fcn.00011008
jmp 0x34052
mov rcx, qword [rsp + 0x40]
lea rdx, [0x0001e250]
call fcn.00016a8c
mov rdi, rax
test rax, rax
je 0x3407e
lea rcx, [0x0001e270]
mov rdx, rax
call fcn.00011008
xor edx, edx
xor ecx, ecx
mov r8d, 0xffffff
mov eax, dword [rcx + rdi]
and eax, r8d
cmp eax, 0x158b48
jne 0x341cb
mov eax, dword [rcx + rdi + 7]
and eax, r8d
cmp eax, 0xd8b48
je 0x341df
inc rcx
inc edx
cmp rcx, 0x600
jge 0x3407e
jmp 0x341b0
movsxd rcx, edx
mov eax, dword [rcx + rdi + 3]
add eax, 7
movsxd rdx, eax
add rdx, rcx
add rdx, rdi
jmp 0x34080
and qword [0x000201a0], 0
lea rax, [0x000201a0]
mov qword [0x000201f0], rax
lea rax, [0x00011740]
mov qword [0x000201b0], rax
lea rax, [0x00011be8]
mov qword [0x000201a8], rax
call fcn.00016490
call fcn.0001a358
mov qword [0x00032570], rax
lea rax, [0x00011020]
lea rdi, [rbp + 0x70]
mov ecx, 0x1c
rep stosq qword [rdi], rax
mov rcx, rbp
call fcn.00017ee8
lea rdx, [0x00012118]
xor eax, eax
mov qword [rbp + 0x68], rdx
jmp 0x34275
lea rcx, [0x00034350]
call fcn.00011008
mov eax, 0xc0000001
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00034294
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x34008