joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005bda0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov r9d, ecx
mov rax, qword [0x14021fc40]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x140221790]
movsxd rcx, dword [rax + 0x48b0]
cmp dword [rax + 0x48a0], ecx
jle 0x14005bc72
mov esi, edx
mov rdx, qword [rax + 0x48a8]
imul rcx, rcx, 0x38
cmp dword [rdx + rcx], r9d
jne 0x14005bc72
test esi, 0x10000000
jne 0x14005bc94
lea r8, str.Popup__08x
jmp 0x14005bca2
mov dword [rax + 0x47d0], 0
xor esi, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14011bef0
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret
mov r9d, dword [rax + 0x48c0]
lea r8, str.Menu__02d
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.14003f530
or esi, 0x4000000
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.14004f6c0
mov esi, eax
test al, al
jne 0x14005bc7e
mov rdi, qword [0x140221790]
mov rax, qword [rdi + 0x3ef8]
cmp qword [rdi + 0x48d8], rax
je 0x14005bcfe
test byte [rax + 0x17], 1
je 0x14005bcf0
mov byte [rdi + 0x3e5e], 1
call fcn.140055510
mov byte [rdi + 0x3e5e], 0
jmp 0x14005bc7e
cmp byte [rdi + 0x4951], 0
je 0x14005bce3
cmp dword [rdi + 0x4910], 0
jne 0x14005bce3
mov ecx, dword [rdi + 0x4954]
and ecx, 0xfffffff0
or ecx, 2
mov dword [rdi + 0x4954], ecx
jmp 0x14005bce3
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r8, rcx
mov rax, qword [0x140221790]
mov ecx, dword [rax + 0x48a0]
cmp ecx, dword [rax + 0x48b0]
jle 0x14005be3b
mov esi, edx
mov rax, qword [rax + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov edi, dword [rcx + rdx*4 - 4]
movzx r10d, byte [r8]
test r10b, r10b
je 0x14005be55
not edi
lea rcx, [r8 + 2]
lea rdx, [0x1401260e0]
mov r9d, edi
jmp 0x14005be1e
movzx r10d, r10b
movzx ebx, r9b
shr r9d, 8
xor ebx, r10d
xor r9d, dword [rdx + rbx*4]
inc rcx
mov r10d, r11d
test r11b, r11b
je 0x14005be4f
movzx r11d, byte [rcx - 1]
cmp r10b, 0x23
jne 0x14005be00
cmp r11b, 0x23
jne 0x14005be00
cmp byte [rcx], 0x23
cmove r9d, edi
mov r11b, 0x23
jmp 0x14005be00
mov dword [rax + 0x47d0], 0
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
not r9d
mov edi, r9d
or esi, 0x141
mov rax, qword [rax]
cmp dword [rax + 0x3f40], edi
jne 0x14005be75
mov ecx, edi
mov edx, 0xb
xor r9d, r9d
call fcn.1400475b0
mov ecx, edi
mov edx, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x14005bc20
Function at 0x14005be90
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [0x140221790]
mov eax, edx
and eax, 0x1f
cmp byte [rbx + rax + 0x3766], 0
je 0x14005bf59
mov esi, edx
mov rdi, rcx
mov r14, qword [rbx + 0x3ef8]
cmp eax, 0xa
ja 0x14005bedb
add eax, 0x81
lea rax, [rax + rax*2]
cmp byte [rbx + rax*4 + 0x3fa8], 0
jne 0x14005bf59
mov ecx, 0x20
call fcn.140047f80
test al, al
je 0x14005bf59
test rdi, rdi
je 0x14005bf86
mov rax, qword [r14 + 0xf8]
movsxd rcx, dword [r14 + 0xf0]
mov ebx, dword [rax + rcx*4 - 4]
movzx r8d, byte [rdi]
test r8b, r8b
je 0x14005bf67
not ebx
lea rax, [rdi + 2]
lea rcx, [0x1401260e0]
mov edx, ebx
jmp 0x14005bf3d
movzx r8d, r8b
movzx r10d, dl
shr edx, 8
xor r10d, r8d
xor edx, dword [rcx + r10*4]
inc rax
mov r8d, r9d
test r9b, r9b
je 0x14005bf63
movzx r9d, byte [rax - 1]
cmp r8b, 0x23
jne 0x14005bf20
cmp r9b, 0x23
jne 0x14005bf20
cmp byte [rax], 0x23
cmove edx, ebx
mov r9b, 0x23
jmp 0x14005bf20
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
not edx
mov ebx, edx
mov rax, qword [r14]
cmp dword [rax + 0x3f40], ebx
jne 0x14005bf8c
mov ecx, ebx
mov edx, 0xb
mov r8, rdi
xor r9d, r9d
call fcn.1400475b0
jmp 0x14005bf8c
mov ebx, dword [rbx + 0x4794]
mov ecx, ebx
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14005b590
Function at 0x14005da90
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
lea r14, [rcx + 0x5cb0]
cmp qword [rcx + 0x5ca8], 0
je 0x14005db99
mov rsi, rcx
cmp dword [rcx + 0x5cb4], 0
jns 0x14005db3d
mov rax, qword [0x140221790]
test rax, rax
je 0x14005dad4
inc dword [rax + 0xf4]
mov rdx, qword [0x1402217a0]
xor ecx, ecx
call qword [0x1402034d8]
mov r15, rax
mov rdx, qword [rsi + 0x5cb8]
test rdx, rdx
je 0x14005db2c
movsxd r8, dword [rsi + 0x5cb0]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsi + 0x5cb8]
test rcx, rcx
je 0x14005db1f
mov rax, qword [0x140221790]
test rax, rax
je 0x14005db1f
dec dword [rax + 0xf4]
mov rdx, qword [0x1402217a0]
call qword [0x1402034e0]
mov qword [rsi + 0x5cb8], r15
mov dword [rsi + 0x5cb4], 0
mov dword [rsi + 0x5cb0], 0
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140040680
mov r9, qword [rsi + 0x5ca8]
mov eax, dword [rsi + 0x5cb0]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
movsxd r8, eax
mov rax, qword [rsi + 0x5cb8]
test rax, rax
lea rcx, [0x140221798]
cmovne rcx, rax
mov edx, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140040680
Function at 0x14005e170
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r14, qword [0x140221790]
lea rdx, [0x140127839]
call sub.VCRUNTIME140.dll_strstr
mov rsi, rax
test rax, rax
cmove rsi, rdi
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
movsxd r15, dword [r14 + 0x5c30]
and eax, 0xfffffffc
lea r12d, [rax + r15]
add r12d, 0x18
mov ebp, eax
add ebp, 0x18
mov eax, dword [r14 + 0x5c34]
cmp eax, r12d
jge 0x14005e268
test eax, eax
je 0x14005e1e8
mov r13d, eax
shr r13d, 0x1f
add r13d, eax
sar r13d, 1
add r13d, eax
jmp 0x14005e1ee
mov r13d, 8
cmp r13d, r12d
cmovle r13d, r12d
cmp eax, r13d
jge 0x14005e268
movsxd rcx, r13d
inc dword [r14 + 0xf4]
mov rdx, qword [0x1402217a0]
call qword [0x1402034d8]
mov rbx, rax
mov rdx, qword [r14 + 0x5c38]
test rdx, rdx
je 0x14005e25a
movsxd r8, dword [r14 + 0x5c30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r14 + 0x5c38]
test rcx, rcx
je 0x14005e24d
mov rax, qword [0x140221790]
test rax, rax
je 0x14005e24d
dec dword [rax + 0xf4]
mov rdx, qword [0x1402217a0]
call qword [0x1402034e0]
mov qword [r14 + 0x5c38], rbx
mov dword [r14 + 0x5c34], r13d
mov dword [r14 + 0x5c30], r12d
mov rax, qword [r14 + 0x5c38]
mov dword [rax + r15], ebp
mov rax, qword [r14 + 0x5c38]
lea rbx, [rax + r15]
add rbx, 4
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rax + r15 + 4], xmm0
test rdi, rdi
je 0x14005e302
lea rax, [rdi - 1]
lea rcx, [rsi + 2]
mov edx, 0xffffffff
lea r8, [0x1401260e0]
mov r10d, 0xffffffff
jmp 0x14005e2e2
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r11d
xor r9d, dword [r8 + r10*4]
inc rcx
mov r10d, r9d
add rax, 0xffffffffffffffff
jae 0x14005e377
movzx r11d, byte [rcx - 2]
cmp r11d, 0x23
jne 0x14005e2c0
cmp rax, 2
jb 0x14005e2c0
cmp byte [rcx - 1], 0x23
jne 0x14005e2c0
cmp byte [rcx], 0x23
cmove r10d, edx
jmp 0x14005e2c0
movzx r8d, byte [rsi]
test r8b, r8b
je 0x14005e371
lea rax, [rsi + 2]
mov ecx, 0xffffffff
lea rdx, [0x1401260e0]
mov r10d, 0xffffffff
jmp 0x14005e354
movzx r8d, r8b
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r8d
xor r9d, dword [rdx + r10*4]
inc rax
mov r8d, r11d
mov r10d, r9d
test r11b, r11b
je 0x14005e377
movzx r11d, byte [rax - 1]
cmp r8b, 0x23
jne 0x14005e330
cmp r11b, 0x23
jne 0x14005e330
cmp byte [rax], 0x23
cmove r10d, ecx
mov r11b, 0x23
jmp 0x14005e330
mov r9d, 0xffffffff
not r9d
mov dword [rbx], r9d
lea rcx, [rbx + 0x10]
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140072d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
vmovaps xmmword [rsp + 0x30], xmm7
vmovaps xmmword [rsp + 0x20], xmm6
mov rsi, rdx
movzx eax, word [rsp + 0x88]
movsxd rdx, dword [rcx + 0x18]
cmp rax, rdx
jae 0x140072d97
mov rdx, qword [rcx + 0x20]
movzx eax, word [rdx + rax*2]
cmp rax, 0xffff
jne 0x140072da5
mov rbx, qword [rcx + 0x38]
test rbx, rbx
jne 0x140072dba
jmp 0x140072f07
lea rbx, [rax + rax*4]
shl rbx, 3
add rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x140072f07
mov eax, dword [rbx]
test al, 2
je 0x140072f07
mov edx, dword [rsp + 0x80]
mov edi, edx
or edi, 0xffffff
test al, 1
cmove edi, edx
vxorps xmm0, xmm0, xmm0
vucomiss xmm2, xmm0
jae 0x140072dec
vmovss xmm7, dword [0x140120e00]
jmp 0x140072df1
vdivss xmm7, xmm2, dword [rcx + 0x14]
vmovsd xmm0, qword [r9]
vroundps xmm6, xmm0, 0xb
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.140061bd0
mov eax, dword [rbx + 0x24]
mov edx, dword [rbx + 0x20]
mov r8d, dword [rbx + 0x1c]
mov ecx, dword [rbx + 0x18]
vbroadcastss xmm2, xmm7
vmovsd xmm0, qword [rbx + 8]
vmovsd xmm1, qword [rbx + 0x10]
vfmadd213ps xmm0, xmm2, xmm6
mov r9d, dword [rsi + 0x34]
mov r10, qword [rsi + 0x50]
lea r11d, [r9 + 1]
lea ebx, [r9 + 2]
mov word [r10], r9w
mov r10, qword [rsi + 0x50]
mov word [r10 + 2], r11w
mov r10, qword [rsi + 0x50]
mov word [r10 + 4], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 6], r9w
add r9d, 3
vfmadd213ps xmm1, xmm2, xmm6
mov r10, qword [rsi + 0x50]
mov word [r10 + 8], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 0xa], r9w
mov r9, qword [rsi + 0x48]
vmovlps qword [r9], xmm0
mov r9, qword [rsi + 0x48]
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], r8d
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x10], edi
mov r9, qword [rsi + 0x48]
vmovss dword [r9 + 0x14], xmm1
vextractps dword [r9 + 0x18], xmm0, 1
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x1c], edx
mov dword [r9 + 0x20], r8d
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x24], edi
mov r8, qword [rsi + 0x48]
vmovlps qword [r8 + 0x28], xmm1
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x30], edx
mov dword [r8 + 0x34], eax
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x38], edi
mov rdx, qword [rsi + 0x48]
vblendps xmm0, xmm0, xmm1, 2
vmovlps qword [rdx + 0x3c], xmm0
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x44], ecx
mov dword [rdx + 0x48], eax
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x48], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x50], 0xc
vmovaps xmm6, xmmword [rsp + 0x20]
vmovaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140093360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov r14d, edx
mov edi, edx
sar edi, 0x1f
and edi, edx
dec edi
mov ebp, 0x8000
jmp 0x1400933b1
call fcn.140093a20
or r15b, bl
and r15b, r12b
xor bl, 1
movzx ecx, r15b
movzx edx, bl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x140093421
mov rax, r14
test eax, eax
jle 0x140093424
lea r14, [rax - 1]
xor ecx, ecx
test r14d, r14d
je 0x1400933ad
mov edx, dword [rsi + 0xe88]
and edx, ebp
jne 0x1400933ad
add eax, 0xfffffffe
mov r12, qword [rsi + 0x20]
movzx ecx, word [r12 + rax*2]
mov r15b, 1
cmp ecx, 9
je 0x1400933f1
cmp ecx, 0x20
je 0x1400933f1
cmp ecx, 0x3000
je 0x1400933f1
xor r15d, r15d
call fcn.140093a20
mov ebx, eax
mov eax, r14d
movzx ecx, word [r12 + rax*2]
xor r12d, r12d
cmp ecx, 9
je 0x140093390
cmp ecx, 0x20
je 0x140093390
cmp ecx, 0x3000
je 0x140093390
mov r12b, 1
jmp 0x140093390
mov edi, r14d
mov eax, edi
sar eax, 0x1f
andn eax, eax, edi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140093440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, edx
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax + 0x79], 0
mov esi, dword [rcx + 0xc]
je 0x140093505
inc edi
cmp edi, esi
jge 0x1400935b8
mov r14d, dword [rbx + 0xe88]
jmp 0x1400934a8
or r15b, al
call fcn.140093a20
movzx ecx, r15b
movzx edx, bpl
test al, al
cmove edx, ecx
cmp dl, 1
jne 0x1400935b8
inc edi
cmp esi, edi
je 0x1400935b1
test r14w, r14w
js 0x14009349e
mov r12d, edi
dec r12d
js 0x14009349e
mov r13, qword [rbx + 0x20]
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r15d, r15d
cmp ecx, 9
je 0x1400934da
cmp ecx, 0x20
je 0x1400934da
cmp ecx, 0x3000
je 0x1400934da
mov r15b, 1
call fcn.140093a20
mov ebp, eax
mov eax, r12d
movzx ecx, word [r13 + rax*2]
mov al, 1
cmp ecx, 9
je 0x140093480
cmp ecx, 0x20
je 0x140093480
cmp ecx, 0x3000
je 0x140093480
xor eax, eax
jmp 0x140093480
lea r14d, [rdi + 1]
cmp esi, r14d
cmovg r14d, esi
mov r15d, 0x8000
jmp 0x140093543
call fcn.140093a20
or r12b, bpl
and r12b, r13b
xor bpl, 1
movzx ecx, r12b
movzx edx, bpl
test al, al
cmove edx, ecx
movzx ecx, dl
test ecx, ecx
jne 0x1400935b8
mov eax, edi
lea edi, [rax + 1]
cmp edi, esi
jge 0x1400935b5
xor ecx, ecx
test eax, eax
js 0x14009353f
mov edx, dword [rbx + 0xe88]
and edx, r15d
jne 0x14009353f
mov r13, qword [rbx + 0x20]
mov eax, eax
movzx ecx, word [r13 + rax*2]
mov r12b, 1
cmp ecx, 9
je 0x140093581
cmp ecx, 0x20
je 0x140093581
cmp ecx, 0x3000
je 0x140093581
xor r12d, r12d
call fcn.140093a20
mov ebp, eax
mov eax, edi
movzx ecx, word [r13 + rax*2]
xor r13d, r13d
cmp ecx, 9
je 0x140093520
cmp ecx, 0x20
je 0x140093520
cmp ecx, 0x3000
je 0x140093520
mov r13b, 1
jmp 0x140093520
mov edi, esi
jmp 0x1400935b8
mov edi, r14d
cmp edi, esi
cmovl esi, edi
mov eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140097ac0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rdx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
add rsp, 0x38
ret
Function at 0x1400b4aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r10, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov qword [rcx], r8
mov qword [r10], rax
mov rsi, qword [rcx]
cmp rsi, r9
je 0x1400b4c6e
mov r11, qword [rsp + 0x60]
cmp rax, r11
je 0x1400b4c6e
nop word cs:[rax + rax]
movzx edi, byte [rsi]
test dil, dil
js 0x1400b4b00
inc rsi
mov qword [rcx], rsi
jmp 0x1400b4c40
cmp dil, 0xbf
jbe 0x1400b4c84
cmp dil, 0xdf
ja 0x1400b4b1c
and edi, 0x1f
mov ebx, 1
mov ebp, edi
jmp 0x1400b4b60
cmp dil, 0xef
ja 0x1400b4b2e
and edi, 0xf
mov ebx, 2
mov ebp, edi
jmp 0x1400b4b60
cmp dil, 0xf7
ja 0x1400b4b40
and edi, 7
mov ebx, 3
mov ebp, edi
jmp 0x1400b4b60
mov ebp, edi
and ebp, 3
xor ebx, ebx
cmp dil, 0xfc
setb bl
xor ebx, 5
nop word cs:[rax + rax]
mov rax, r9
sub rax, rsi
lea edi, [rbx + 1]
cmp rax, rdi
jl 0x1400b4c6e
lea rax, [rsi + 1]
mov qword [rcx], rax
movzx edi, byte [rsi + 1]
mov eax, 2
cmp dil, 0xbf
jg 0x1400b4c76
shl ebp, 6
and edi, 0x3f
or edi, ebp
lea r14, [rsi + 2]
mov qword [rcx], r14
cmp ebx, 2
jb 0x1400b4c40
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x1400b4c76
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 3]
mov qword [rcx], r14
cmp ebx, 3
jb 0x1400b4c40
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x1400b4c76
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 4]
mov qword [rcx], r14
cmp ebx, 4
jb 0x1400b4c40
movzx ebp, byte [r14]
cmp bpl, 0xbf
jg 0x1400b4c76
mov r14d, edi
shl r14d, 6
and ebp, 0x3f
mov edi, ebp
or edi, r14d
lea r14, [rsi + 5]
mov qword [rcx], r14
cmp ebx, 5
jb 0x1400b4c40
movzx ebx, byte [r14]
cmp bl, 0xbf
jg 0x1400b4c76
shl edi, 6
and ebx, 0x3f
or edi, ebx
add rsi, 6
jmp 0x1400b4aeb
cmp byte [rdx], 0
jne 0x1400b4c48
mov byte [rdx], 1
cmp edi, 0x10ffff
ja 0x1400b4c7d
mov rax, qword [r10]
lea rsi, [rax + 2]
mov qword [r10], rsi
mov word [rax], di
mov rsi, qword [rcx]
cmp rsi, r9
je 0x1400b4c6e
cmp qword [r10], r11
jne 0x1400b4ae0
xor eax, eax
cmp rsi, r8
sete al
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov eax, 2
jmp 0x1400b4c76
inc rsi
mov qword [rcx], rsi
mov eax, 2
jmp 0x1400b4c76
Function at 0x1400b4e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov rcx, r8
cmp r8, r9
je 0x1400b4f8b
mov rax, qword [rsp + 0x48]
mov rcx, r8
test rax, rax
je 0x1400b4f8b
movzx r10d, byte [rdx]
dec rax
mov rcx, r8
nop dword [rax + rax]
movzx ebx, byte [rcx]
movzx r11d, bl
test r11b, r11b
js 0x1400b4e50
lea rsi, [rcx + 1]
jmp 0x1400b4f50
cmp bl, 0xc0
jb 0x1400b4f8b
cmp bl, 0xdf
ja 0x1400b4e69
and r11d, 0x1f
mov edi, 1
jmp 0x1400b4ea0
cmp bl, 0xef
ja 0x1400b4e79
and r11d, 0xf
mov edi, 2
jmp 0x1400b4ea0
cmp bl, 0xf7
ja 0x1400b4e89
and r11d, 7
mov edi, 3
jmp 0x1400b4ea0
and r11d, 3
xor edi, edi
cmp bl, 0xfc
setb dil
xor edi, 5
nop dword [rax]
mov ebx, r11d
mov r11, r9
sub r11, rcx
lea esi, [rdi + 1]
cmp r11, rsi
jl 0x1400b4f8b
movzx r11d, byte [rcx + 1]
cmp r11b, 0xbf
jg 0x1400b4f8b
lea esi, [rdi - 1]
add rsi, rcx
add rsi, 2
shl ebx, 6
and r11d, 0x3f
or r11d, ebx
cmp edi, 2
jb 0x1400b4f50
movzx ebx, byte [rcx + 2]
cmp bl, 0xbf
jg 0x1400b4f8b
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 3
jb 0x1400b4f50
movzx ebx, byte [rcx + 3]
cmp bl, 0xbf
jg 0x1400b4f8b
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 4
jb 0x1400b4f50
movzx ebx, byte [rcx + 4]
cmp bl, 0xbf
jg 0x1400b4f8b
mov ebp, r11d
shl ebp, 6
and ebx, 0x3f
mov r11d, ebx
or r11d, ebp
cmp edi, 5
jb 0x1400b4f50
movzx edi, byte [rcx + 5]
cmp dil, 0xbf
jg 0x1400b4f8b
shl r11d, 6
and edi, 0x3f
or r11d, edi
test r10b, r10b
je 0x1400b4f60
cmp r11d, 0x10ffff
jbe 0x1400b4f6f
jmp 0x1400b4f8b
mov byte [rdx], 1
mov r10b, 1
cmp r11d, 0x10ffff
ja 0x1400b4f8b
cmp rsi, rcx
je 0x1400b4f8b
add rax, 0xffffffffffffffff
jae 0x1400b4f88
mov rcx, rsi
cmp rsi, r9
jne 0x1400b4e30
jmp 0x1400b4f8b
mov rcx, rsi
sub rcx, r8
cmp rcx, 0x7fffffff
mov eax, 0x7fffffff
cmovl rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1400b9360
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rcx, qword [0x1402200a8]
test rcx, rcx
je 0x1400b95ef
cmp dword [0x1402200b0], 0
je 0x1400b95ef
mov edx, 0x13b0
add rdx, qword [rsi + 0x48]
mov qword [rsp + 0x20], 0
lea r8, [0x1402287c8]
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400b95ef
mov eax, dword [0x1402287c8]
cmp eax, 0xffffffff
je 0x1400b95ef
shr rax, 9
lea rdi, [rax*8 + 0x10]
mov ecx, 8
call fcn.14011c038
mov qword [rbp - 0x38], rax
lea rcx, [rax + 8]
mov qword [rbp - 0x28], rcx
mov qword [rax], rdi
mov qword [rbp - 0x30], rcx
lea rcx, [0x1402200e0]
call fcn.140021300
lea rcx, [0x1402200a0]
lea r8, [rbp - 0x38]
mov rdx, rax
call fcn.14001adf0
mov qword [0x1402287d0], rax
test rax, rax
je 0x1400b95ef
mov rcx, qword [0x1402200a8]
test rcx, rcx
je 0x1400b95ef
cmp dword [0x1402200b0], 0
je 0x1400b95ef
mov edx, dword [0x1402287c8]
and edx, 0x1ff
imul rdx, rdx, 0x78
add rax, rdx
mov qword [rsp + 0x20], 0
lea r8, [0x1402287d8]
mov r9d, 8
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400b95ef
lea rcx, [0x1402287e0]
lea rdx, [0x1402287d8]
call fcn.14001a170
test al, al
je 0x1400b95ef
cmp byte [0x140220c50], 0
jne 0x1400b94b9
vmovss xmm0, dword [rsi + 0x104]
vxorps xmm1, xmm1, xmm1
vucomiss xmm0, xmm1
ja 0x1400b95ef
cmp byte [0x140220c40], 0
je 0x1400b9503
mov rcx, qword [0x1402200a8]
test rcx, rcx
je 0x1400b9503
cmp dword [0x1402200b0], 0
je 0x1400b9503
mov edx, 0x2290
add rdx, qword [rsi + 0x48]
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x20]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp - 0x20], 0
je 0x1400b95ef
cmp byte [0x1401912f9], 0
je 0x1400b9537
mov eax, dword [rsi + 0xf0]
cmp eax, dword [0x1402288d0]
setne al
cmp dword [0x1402288c0], 0
setg cl
and cl, al
mov byte [0x1402288f8], cl
cmp cl, 1
je 0x1400b954b
jmp 0x1400b95ef
cmp dword [0x1402288c0], 0
setg byte [0x1402288f8]
jle 0x1400b95ef
mov eax, dword [0x140228908]
mov ecx, dword [0x1402293c0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x28]
jg 0x1400b95f7
lea rcx, [rbp - 0x10]
call fcn.1400b96a0
movsxd rax, dword [str.ZZ_]
mov rcx, qword [rbp - 0x10]
sub rcx, qword [0x140228900]
imul rax, rax, 0xf4240
cmp rcx, rax
jl 0x1400b95ef
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1400b95e4
mov qword [rsp + 0x20], 0
mov ecx, 2
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_mouse_event]
lea rdx, [0x1400b9300]
lea rsi, [rbp - 0x20]
mov rcx, rsi
call fcn.1400b9780
mov rcx, rsi
call fcn.1400b9830
cmp dword [rbp - 0x18], 0
jne 0x1400b962d
mov rax, qword [rbp - 0x10]
mov qword [0x140228900], rax
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140228908]
call fcn.14011bfb8
cmp dword [0x140228908], 0xffffffff
jne 0x1400b9570
lea rcx, [0x140228900]
call fcn.1400b96a0
lea rcx, [0x140228908]
call fcn.14011bf4c
jmp 0x1400b9570
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
Function at 0x1400b9780
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov ecx, 8
call fcn.14011c038
mov rbx, rax
mov qword [rax], rdi
lea rdi, [rsi + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x1400b9a40]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x1400b97e4
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 8], rbx
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140113950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov ebx, dword [rcx + 0x14]
mov rsi, rcx
call fcn.140113680
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140113680
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
je 0x140113adb
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r14
cmp ebx, 2
mov qword [rsp + 0x20], r15
lea r14, [rsp + 0x40]
setne al
lea r15, [rsp + 0x40]
add r14, rax
xor rax, 1
add r15, rax
movzx edi, byte [r14]
movzx eax, byte [r15]
shl edi, 8
or edi, eax
lea eax, [rdi - 0xdc00]
cmp eax, 0x3ff
ja 0x1401139e5
lea rcx, [rsi + 0x18]
mov edx, 0xfffd
call fcn.140113720
jmp 0x140113acc
lea eax, [rdi - 0xd800]
mov qword [rsp + 0x48], rbp
cmp eax, 0x3ff
ja 0x140113ab9
mov rcx, rsi
call fcn.140113680
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140113680
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
lea rbp, [rsi + 0x18]
test al, al
je 0x140113a99
nop
movzx eax, byte [r15]
movzx ebx, byte [r14]
shl ebx, 8
or ebx, eax
lea eax, [rbx - 0xdc00]
cmp eax, 0x3ff
jbe 0x140113aa0
lea rbp, [rsi + 0x18]
mov edx, 0xfffd
mov rcx, rbp
call fcn.140113720
lea eax, [rbx - 0xd800]
cmp eax, 0x7ff
ja 0x140113abd
mov rcx, rsi
mov edi, ebx
call fcn.140113680
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140113680
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
jne 0x140113a30
mov edx, 0xfffd
jmp 0x140113abf
and edi, 0x3ff
and ebx, 0x3ff
shl edi, 0xa
or edi, ebx
add edi, 0x10000
jmp 0x140113abd
lea rbp, [rsi + 0x18]
mov edx, edi
mov rcx, rbp
call fcn.140113720
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret