joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024ae0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401a2920]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov dword [rbp - 0x40], 0
cmp qword [0x1401ab050], 1
jle 0x140024d0d
mov rbx, qword [0x1401ab048]
lea rcx, [rbx + 0x58]
call qword [0x14011af98]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [0x14011af90]
mov dword [rbp - 0x40], 1
mov r9, qword [rbx + 0x58]
mov ecx, dword [r9 - 0x10]
lea rdx, str.UPDATE_Folders_SET_FolderId_SELECT_T2.Id_FROM_Folders_T2_WHERE_T2.
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140024b53
mov dword [rsp + 0x20], ecx
mov r8d, eax
lea rcx, [rbp - 0x20]
call qword [0x14011afa0]
nop
lea rcx, [rbp - 0x20]
call qword [0x14011af98]
mov rdx, rax
lea rcx, [rbp - 0x30]
call qword [0x14011af90]
mov dword [rbp - 0x40], 3
lea r9, str.filePath_Folders.
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [r9 + rax*2], 0
jne 0x140024ba0
mov rdx, qword [rbp - 0x20]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x30]
call qword [0x14011afa0]
cmp qword [0x1401ab050], 1
jle 0x140024d06
mov rbx, qword [0x1401ab048]
lea rcx, [rbp - 0x30]
call qword [0x14011af98]
mov rdx, rax
lea rcx, [rbp - 0x38]
call qword [0x14011af90]
mov dword [rbp - 0x40], 7
mov r9, qword [rbx + 0x58]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rbp - 0x30]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x38]
call qword [0x14011afa0]
nop
lea rcx, [rbp - 0x38]
call qword [0x14011af98]
mov rdx, rax
lea rcx, [rbp - 0x18]
call qword [0x14011af90]
mov dword [rbp - 0x40], 0xf
lea r9, [0x14015e658]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [r9 + rax*2], 0
jne 0x140024c40
mov rdx, qword [rbp - 0x38]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x18]
call qword [0x14011afa0]
nop
lea rcx, [rbp - 0x38]
call qword [0x14011a9b0]
nop
lea rcx, [rbp - 0x30]
call qword [0x14011a9b0]
mov dword [rbp - 0x40], 8
lea rcx, [rbp - 0x20]
call qword [0x14011a9b0]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x28]
call qword [0x14011b020]
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x20]
mov r8d, 0xffffffff
mov rdx, qword [rax]
mov rcx, qword [rdi + 0xc0]
call qword [0x14011b190]
test eax, eax
jne 0x140024cd4
mov rcx, qword [rbp - 0x20]
call qword [0x14011b1a8]
mov rcx, qword [rbp - 0x20]
call qword [0x14011b1b0]
mov rcx, rbx
call qword [0x14011a9b0]
nop
lea rcx, [rbp - 0x18]
call qword [0x14011a9b0]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400feb00
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [0x14011aaa8]
nop
call qword [0x14011aaa8]
int3
Function at 0x14002f410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401a2920]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rdx
add rcx, 8
mov rdx, qword [rdx]
call fcn.14002adf0
test al, al
je 0x14002f580
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [0x14011b020]
mov rdx, rax
mov rcx, rbx
call fcn.140030160
movzx esi, al
lea r8, [rbx + 0x58]
xor r9d, r9d
xor edx, edx
mov rcx, qword [rbx + 0x30]
call qword [0x1401183c0]
mov rcx, qword [rbx + 0x30]
call qword [0x1401183b8]
xor ecx, ecx
mov qword [rbx + 0x30], rcx
mov dword [rbx + 0x2c], ecx
mov rdx, qword [rbx + 0x60]
mov eax, dword [rbx + 0xd8]
mov r8, rdx
cmp eax, dword [rdx + 0x1c]
jbe 0x14002f4ab
mov dword [rdx + 0x1c], eax
mov rdx, qword [rbx + 0x60]
mov r8, rdx
mov eax, dword [rbx + 0xdc]
test eax, eax
je 0x14002f4e1
mov ecx, dword [r8 + 0x38]
imul rcx, rax
add rcx, 0x1f4
movabs rax, 0x624dd2f1a9fbe77
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 9
mov rdx, r8
mov eax, ecx
mov rcx, qword [rbx + 0x90]
sub rcx, rax
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14002f507
shr rax, 4
lea rax, [rax*8]
jmp 0x14002f512
mov eax, dword [r8 + 0x1c]
shl rax, 3
mov rdx, r8
sub rcx, rax
mov eax, dword [rdx + 0x38]
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
movsd xmm2, qword [0x140180e48]
divsd xmm1, xmm2
xorps xmm0, xmm0
comisd xmm1, xmm0
jbe 0x14002f571
xorps xmm0, xmm0
test rcx, rcx
js 0x14002f544
cvtsi2sd xmm0, rcx
jmp 0x14002f559
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, qword [0x140180e08]
divsd xmm0, xmm1
divsd xmm0, xmm2
cvttsd2si rax, xmm0
mov dword [rdx + 0x3c], eax
mov rcx, rdi
call qword [0x14011a9b0]
movzx eax, sil
jmp 0x14002f58b
mov rcx, rdi
call qword [0x14011a9b0]
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400feb00
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140076b10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov qword [rsp + 0x10], rbx
mov ebx, r8d
mov r10, rdx
mov r11, rcx
cmp r8d, 8
jb 0x140076bb4
mov qword [rsp], rdi
mov edi, 2
nop word [rax + rax]
mov r8, qword [r10 + rax*8]
lea ecx, [rdi - 1]
xor qword [r11 + rax*8], r8
add eax, 8
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
mov ecx, edi
lea rdx, [r11 + rcx*8]
mov rcx, qword [r10 + rcx*8]
xor qword [rdx], rcx
lea ecx, [rdi + 1]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 2]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 3]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 4]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 5]
mov edx, ecx
add edi, 8
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 6]
cmp ecx, ebx
jbe 0x140076b40
mov rdi, qword [rsp]
lea ecx, [rax + 4]
cmp ecx, ebx
ja 0x140076c01
lea r8d, [rax + 2]
nop
mov rcx, qword [r10 + rax*8]
lea rdx, [r11 + rax*8]
xor qword [rdx], rcx
add eax, 4
lea ecx, [r8 - 1]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea rdx, [r11 + r8*8]
mov rcx, qword [r10 + r8*8]
xor qword [rdx], rcx
lea ecx, [r8 + 1]
mov edx, ecx
lea r8d, [r8 + 4]
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [r8 + 2]
cmp ecx, ebx
jbe 0x140076bc0
lea r8d, [rax + 2]
cmp r8d, ebx
ja 0x140076c35
nop word [rax + rax]
mov rcx, qword [r10 + rax*8]
lea rdx, [r11 + rax*8]
xor qword [rdx], rcx
add eax, 2
lea ecx, [r8 - 1]
add r8d, 2
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
cmp r8d, ebx
jbe 0x140076c10
cmp eax, ebx
mov rbx, qword [rsp + 0x10]
jae 0x140076c48
mov ecx, eax
mov rax, qword [r10 + rax*8]
xor qword [r11 + rcx*8], rax
add rsp, 8
ret
Function at 0x1400a6620
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rcx
cmp dword [rax + 0x2ad0], 0
je 0x1400a6640
mov dword [rcx + 0x10], 0xffffffff
xor esi, esi
cmp dword [rax + 0x28a0], esi
je 0x1400a6674
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x68], rsi
mov dword [rcx + 0x70], esi
cmp dword [rax + 0x28a4], esi
je 0x1400a66d0
mov dword [rcx + 0x74], 0x6a09e667
mov dword [rcx + 0x78], 0xbb67ae85
mov dword [rcx + 0x7c], 0x3c6ef372
mov dword [rcx + 0x80], 0xa54ff53a
mov dword [rcx + 0x84], 0x510e527f
mov dword [rcx + 0x88], 0x9b05688c
mov dword [rcx + 0x8c], 0x1f83d9ab
mov dword [rcx + 0x90], 0x5be0cd19
mov qword [rcx + 0xd4], rsi
mov dword [rcx + 0xdc], esi
cmp dword [rax + 0x28a8], esi
je 0x1400a6760
mov rax, qword [0x14016cc70]
mov qword [rcx + 0xe0], rax
mov rax, qword [0x14016cc78]
mov qword [rcx + 0xe8], rax
mov rax, qword [0x14016cc80]
mov qword [rcx + 0xf0], rax
mov rax, qword [0x14016cc88]
mov qword [rcx + 0xf8], rax
mov rax, qword [0x14016cc90]
mov qword [rcx + 0x100], rax
mov rax, qword [0x14016cc98]
mov qword [rcx + 0x108], rax
mov rax, qword [0x14016cca0]
mov qword [rcx + 0x110], rax
mov rax, qword [0x14016cca8]
mov qword [rcx + 0x118], rax
mov qword [rcx + 0x1a0], rsi
mov qword [rcx + 0x1a8], rsi
mov dword [rcx + 0x1b0], esi
mov rax, qword [rcx]
mov qword [rsp + 0x30], rbx
cmp dword [rax + 0x28ac], esi
je 0x1400a67a9
lea rbx, [rcx + 0x1b8]
xor edx, edx
mov rcx, rbx
mov r8d, 0xc8
call fcn.140100000
mov qword [rbx + 0xc8], 0x440
mov dword [rbx + 0xd0], esi
mov dword [rbx + 0xd8], 0x100
mov byte [rbx + 0xdc], 6
mov rax, qword [rdi]
cmp dword [rax + 0x28b0], esi
je 0x1400a67ea
xor edx, edx
lea rcx, [rdi + 0x298]
mov r8d, 0xc8
call fcn.140100000
mov qword [rdi + 0x360], 0x240
mov dword [rdi + 0x368], esi
mov dword [rdi + 0x370], 0x200
mov byte [rdi + 0x374], 6
mov rax, qword [rdi]
mov rbx, qword [rsp + 0x30]
cmp dword [rax + 0x289c], esi
je 0x1400a6829
mov qword [rdi + 0x378], rsi
mov dword [rdi + 0x380], 0x67452301
mov dword [rdi + 0x384], 0xefcdab89
mov dword [rdi + 0x388], 0x98badcfe
mov dword [rdi + 0x38c], 0x10325476
cmp dword [rax + 0x28b4], esi
je 0x1400a6888
xorps xmm0, xmm0
movups xmmword [rdi + 0x3e0], xmm0
movups xmmword [rdi + 0x3f0], xmm0
mov qword [rdi + 0x440], rsi
mov byte [rdi + 0x400], sil
mov qword [rdi + 0x448], rsi
mov qword [rdi + 0x450], rsi
mov qword [rdi + 0x458], rsi
mov qword [rdi + 0x460], rsi
mov qword [rdi + 0x468], rsi
mov qword [rdi + 0x470], rsi
mov qword [rdi + 0x478], rsi
mov qword [rdi + 0x480], rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c9820
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xa0
mov rax, qword [0x1401a2920]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, r8
mov dword [rsp + 0x24], 0xbb67ae85
mov r8d, dword [rdx + 8]
lea rcx, [rsp + 0x20]
sub r8d, dword [rdx]
xor eax, eax
mov rdx, qword [rdx]
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x28], 0x3c6ef372
movups xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x2c], 0xa54ff53a
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x30], 0x510e527f
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x28], rax
mov dword [r11 - 0x20], eax
call fcn.140076530
mov edx, 0x20
mov rcx, rbx
call fcn.140015d80
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
call fcn.140076850
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400feb00
add rsp, 0xa0
pop rbx
ret
Function at 0x1400c98f0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1401a2920]
xor rax, rsp
mov qword [rbp + 0x10], rax
lea rbx, [rcx + 0x178]
mov qword [rsp + 0x150], r15
lea rax, [0x1401ad398]
mov rdi, rcx
cmp rbx, rax
je 0x1400c994a
mov r8, qword [0x1401ad3a0]
mov rcx, rbx
mov rdx, qword [0x1401ad398]
sub r8, rdx
call fcn.1400cbdf0
mov r8d, dword [rbx + 8]
lea rcx, [rsp + 0x30]
sub r8d, dword [rbx]
xorps xmm0, xmm0
mov rdx, qword [rbx]
xor r15d, r15d
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x30], r15
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x38], 0x67452301
movups xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x3c], 0xefcdab89
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x40], 0x98badcfe
movups xmmword [rbp - 0x78], xmm0
mov dword [rsp + 0x44], 0x10325476
call fcn.1400a8f70
mov r8d, dword [rdi + 0x1c0]
lea rcx, [rsp + 0x30]
sub r8d, dword [rdi + 0x1b8]
mov rdx, qword [rdi + 0x1b8]
call fcn.1400a8f70
lea rdx, [rdi + 0x208]
lea r8d, [r15 + 4]
lea rcx, [rsp + 0x30]
call fcn.1400a8f70
mov rdx, qword [rdi + 0x160]
lea rcx, [rsp + 0x30]
mov r8d, dword [rdx + 8]
sub r8d, dword [rdx]
mov rdx, qword [rdx]
call fcn.1400a8f70
cmp dword [rdi + 0x1d0], 4
jl 0x1400c9a1d
cmp byte [rdi + 0x20c], r15b
jne 0x1400c9a1d
lea r8d, [r15 + 4]
mov dword [rsp + 0x20], 0xffffffff
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400a8f70
lea rcx, [rsp + 0x30]
call fcn.1400a9260
mov rax, qword [rbx]
cmp rax, qword [rbx + 8]
je 0x1400c9a34
mov qword [rbx + 8], rax
mov r14d, 0x10
lea r8, [rbp - 0x78]
mov r9d, r14d
mov rdx, rax
mov rcx, rbx
call fcn.14002a6a0
cmp dword [rdi + 0x1d0], 3
jl 0x1400c9b15
mov qword [rsp + 0x148], rsi
lea esi, [r14 + 0x22]
nop word [rax + rax]
mov eax, dword [rdi + 0x1a8]
mov rcx, rbx
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, r14d
cmovg eax, r14d
movsxd rdx, eax
call fcn.140015d80
mov r8d, dword [rbx + 8]
lea rcx, [rbp - 0x60]
sub r8d, dword [rbx]
xorps xmm0, xmm0
mov rdx, qword [rbx]
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x60], r15
movups xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x58], 0x67452301
movups xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x54], 0xefcdab89
movups xmmword [rbp - 0x18], xmm0
mov dword [rbp - 0x50], 0x98badcfe
movups xmmword [rbp - 8], xmm0
mov dword [rbp - 0x4c], 0x10325476
call fcn.1400a8f70
lea rcx, [rbp - 0x60]
call fcn.1400a9260
mov rax, qword [rbx]
cmp rax, qword [rbx + 8]
je 0x1400c9af1
mov qword [rbx + 8], rax
mov rdx, rax
lea r8, [rbp - 8]
mov r9, r14
mov rcx, rbx
call fcn.14002a6a0
sub rsi, 1
jne 0x1400c9a70
mov rsi, qword [rsp + 0x148]
mov eax, dword [rdi + 0x1d0]
mov r15, qword [rsp + 0x150]
cmp eax, 2
jne 0x1400c9b2d
lea edx, [rax + 3]
jmp 0x1400c9b4b
cmp eax, 3
jl 0x1400c9b53
mov eax, dword [rdi + 0x1a8]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, r14d
cmovg eax, r14d
movsxd rdx, eax
mov rcx, rbx
call fcn.140015d80
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400feb00
mov rbx, qword [rsp + 0x158]
add rsp, 0x120
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ca830
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
mov rsi, qword [r8]
lea rcx, [rsp]
mov ebx, dword [r8 + 8]
mov rdi, rdx
sub ebx, esi
xor r9d, r9d
mov eax, r9d
nop dword [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jb 0x1400ca860
xor r10b, r10b
mov r8, r9
xor r11b, r11b
nop dword [rax + rax]
movzx edx, byte [rsp + r8]
movzx ecx, dl
movzx eax, r11b
add cl, byte [rax + rsi]
add r10b, cl
lea rcx, [rsp]
movzx eax, r10b
add rcx, rax
movzx eax, byte [rcx]
mov byte [rsp + r8], al
inc r8
movzx eax, r11b
mov byte [rcx], dl
inc eax
xor edx, edx
div ebx
mov r11d, edx
cmp r8, 0x100
jl 0x1400ca880
mov r10, qword [rdi]
xor r11b, r11b
xor bl, bl
cmp qword [rdi + 8], r10
je 0x1400ca913
nop dword [rax]
inc r11b
lea rdx, [rsp]
movzx eax, r11b
add rdx, rax
movzx r8d, byte [rdx]
add bl, r8b
movzx eax, bl
movzx ecx, byte [rsp + rax]
mov byte [rdx], cl
mov byte [rsp + rax], r8b
lea eax, [r8 + rcx]
movzx eax, al
movzx ecx, byte [rsp + rax]
xor byte [r10 + r9], cl
inc r9
mov r10, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, r10
cmp r9, rax
jb 0x1400ca8d0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400ff700
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140118458]
test rax, rax
je 0x1400ff74a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ff74a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ff74a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ff74a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ff74a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ff74c
xor al, al
add rsp, 0x28
ret

Function at 0x1404bb63b
Capabilities:
Encode data using xor

Disassembly:
mov r15, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x590502e9
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.1406ce084
add byte [rax], al
jae 0x1404bb6cd
insb byte [rdi], dx
imul esi, dword [rbp + riz*2 + 0x33], 0x6c61765f
jne 0x1404bb6cc
pop rdi
imul ebp, dword [rsi + 0x74], 0x3c8d4800
lea rdi, [rdi*4 + 0x5962bec]
adc byte [rcx - 0x43c7ffcf], 0x4b
add byte [rax], al
add byte [rax], al
xchg ecx, eax
xor dword [rax], eax
cmp byte [rbx + rcx*2], bh
add byte [rax], al
add byte [rax], al
add ah, ah
movabs byte [0xbc6800319270004a], al
add byte [r8], al
Function at 0x1405b7c8d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ja 0x1405b7bec
call 0x140330e73
add byte [rax], al
add byte [rdi + 0x65], al
je 0x140325428
jb 0x140325443
jbe 0x14032543d
je 0x140325443
push rax
jb 0x140325450
imul bp, word [rbp + riz*2 + 0x53], 0x7274
imul ebp, dword [rsi + 0x67], 0x74ff0057
and al, 0x28
and eax, 0x278f500
clc
invalid
call 0x140553a65
repne scasw ax, word [rdi]
call fcn.14046a09b
repne scasw ax, word [rdi]
push r8
movabs r8, 0x6cad276f0e2a07e7
call fcn.140571e65
scasd eax, dword [rdi]
push rdx
push rbp
call fcn.140552ca1
lodsd eax, dword [rsi]
push r8
movabs r8, 0x57aa5a814b2a7753
pushfq
add r8b, 0x77
or r8d, r8d
push rsi
mov r8, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x2c2fea1f
movabs rsi, 0x60120ba75b0e1654
xor esi, 0x42a320d9
not esi
push rsi
mov rsi, qword [rsp + 8]
call fcn.1404c6fa8
or byte [rcx + 0x53], al
movabs r11, 0x2df76a665ed67efa
pushfq
and r11, 0x3fe702be
and r11d, 0x6d6106ff
bswap r11d
seta r11b
mov r11, qword [rsp + 8]
mov qword [rsp + 8], 0xd38ae79
call fcn.1405aa56d
cld
mov dl, 0x11
push rsi
sar r10d, 0x58
xor r11d, r11d
movsx r10, r14w
bts si, cx
and r10b, sil
mov r10, rcx
not sil
mov esi, r8d
cmp r9w, 0x3121
test r8d, r8d
jmp 0x1405b7cba
je 0x1405b7e22
mov qword [rsp + 0x10], rbx
and ebx, eax
sal ebx, 0xe5
mov ebx, edx
movzx rax, bp
ror ax, cl
xor rax, r10
mov qword [rsp + 0x18], rdi
cdqe
mov rdi, qword [rsp + 0x30]
add rbx, r9
neg al
nop
ror ax, 0x9b
bswap ax
btr eax, 0xab
mov eax, dword [rbx + r11 + 4]
jmp 0x1405b7d01
cmp eax, 8
jmp 0x1405b7d09
jb 0x1405b7e08
lea r8, [rax - 8]
jmp 0x1405b7d18
shr r8, 1
jmp 0x1405b7d20
je 0x1405b7def
lea r9, [rbx + r11 + 8]
cmova edx, edx
ror ax, cl
nop
movzx edx, word [r9]
shr ah, 0x7f
mov ecx, dword [rbx + r11]
mov eax, edx
jmp 0x1405b7d44
and dl, 0xf
cmp dh, 0x8a
shr rax, 4
cmp bpl, 0xbf
add rax, rdi
stc
cmp ax, 0x601f
add rcx, rax
cmp cx, 0xd7a
cmp dl, 3
jmp 0x1405b7d6a
jne 0x1405b7d7d
add dword [rcx], r10d
jmp 0x1405b7d78
jmp 0x1405b7ddd
cmp dl, 0xa
jmp 0x1405b7d85
jne 0x1405b7d98
add qword [rcx], r10
jmp 0x1405b7d93
jmp 0x1405b7ddd
cmp dl, 1
jmp 0x1405b7da0
jne 0x1405b7dc4
mov rax, r10
cmp bl, 0x5e
stc
cmp r9w, sp
sar rax, 0x10
cmp r11b, 0x2e
test dl, r10b
add word [rcx], ax
jmp 0x1405b7ddd
cmp dl, 2
jmp 0x1405b7dcc
jne 0x1405b7ddd
add word [rcx], r10w
test bpl, 0x15
cmp r10d, edi
add r9, 2
dec r8
jmp 0x1405b7de9
jne 0x1405b7d32
mov eax, dword [rbx + r11 + 4]
add r11, rax
cmp rdi, rbx
cmp r11, rsi
jmp 0x1405b7e02
jb 0x1405b7cf3
mov rbx, qword [rsp + 0x10]
movzx edi, dx
movsx esi, bp
movsxd rsi, edx
mov rdi, qword [rsp + 0x18]
movzx rsi, r10w
not rsi
pop rsi
jmp 0x1405b7e28
ret
Function at 0x140001880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
movups xmm0, xmmword [str.ntdll.dll]
mov eax, dword [0x140020180]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x40], eax
movups xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x10], 0x6d654d6c
movdqa xmm0, xmmword [str.ZwAllocateVirtuaNtProtectVirtual]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0xc], 0x79726f
movdqa xmm0, xmmword [0x140015350]
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x28], 0x6f6d654d
mov word [rbp - 0x24], 0x7972
mov byte [rbp - 0x22], 0
call fcn.1400014a0
test eax, eax
jne 0x140001902
lea rdx, [rbp - 0x20]
lea rcx, [0x140020188]
call fcn.140001a20
mov eax, 0xffffffff
add rsp, 0x70
pop rbp
ret
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x50]
call fcn.1400014a0
test eax, eax
jne 0x14000192e
lea rdx, [rbp - 0x38]
lea rcx, str.____Error_attempting_to_unhook_function:__s_n
call fcn.140001a20
mov eax, 0xffffffff
add rsp, 0x70
pop rbp
ret
lea rcx, str.Press_enter_to_allocate_mem...
mov qword [rsp + 0x88], rbx
call fcn.140003a0c
call fcn.14000392c
mov edx, 0x64
mov dword [rbp + 0x10], 0
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rdx - 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140001992
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_allocating_mem:__d_n
call fcn.140001a20
lea eax, [rbx - 1]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret
mov rdx, rbx
lea rcx, str.Location_of_mem:__p_nPress_enter_to_change_protections..._n
call fcn.140001a20
call fcn.14000392c
mov edx, 0x64
lea r9, [rbp + 0x10]
mov rcx, rbx
lea r8d, [rdx - 0x44]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400019e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error_chaing_protections:__d_n
call fcn.140001a20
mov rbx, qword [rsp + 0x88]
mov eax, 0xffffffff
add rsp, 0x70
pop rbp
ret
lea rcx, str.End_of_program.
call fcn.140003a0c
call fcn.14000392c
mov rbx, qword [rsp + 0x88]
xor eax, eax
add rsp, 0x70
pop rbp
ret

Function at 0x140005e60
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005c8c
Function at 0xb4d430
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xb4d43d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xb4d44d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xb4d435
lea eax, [rcx + 1]
jmp 0xb4d45b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xb4d46e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xb4d454
sub eax, 3
jb 0xb4d48e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xb4d4dd
sar eax, 1
movsxd rbp, eax
jb 0xb4d4c4
jmp 0xb4d49c
add ebx, ebx
jne 0xb4d49a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xb4d4c4
inc ecx
add ebx, ebx
jne 0xb4d4aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xb4d4c4
call r11
adc ecx, ecx
add ebx, ebx
jne 0xb4d4bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xb4d4ac
add ecx, 2
jmp 0xb4d4c9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00b4d3f2
jmp 0xb4d43d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x37a000
mov dl, 0xba
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xb4d529
cmp rsi, rcx
jae 0xb4d531
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xb4d510
cmp al, 0x8f
ja 0xb4d510
cmp byte [rsi - 2], 0xf
je 0xb4d516
sub al, 0xe8
cmp al, 1
ja 0xb4d4fa
cmp rsi, rcx
jae 0xb4d531
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xb4d500
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xb4d531
lodsb al, byte [rsi]
jmp 0xb4d510
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x72a000]
mov eax, dword [rdi]
or eax, eax
je 0xb4d58e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x74db2c]
add rbx, rsi
add rdi, 8
call qword [0x00b4ee30]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xb4d53e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [0x00b4ee40]
or rax, rax
je 0xb4d588
mov qword [rbx], rax
add rbx, 8
jmp 0xb4d55e
jmp qword [0x00b4ee38]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xb4d5c8
cmp al, 0xef
ja 0xb4d5ba
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xb4d59a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0xb4d5a9
mov rbp, qword [0x00b4ee48]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x32f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xb4d61c
sub rsp, 0xffffffffffffff80
jmp 0x407570