joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037db0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1400f54f8]
cmp rdi, 1
jbe 0x140037dd9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140051720
lea rcx, [0x1400f54f8]
call fcn.140037cf0
test al, al
je 0x140037e1f
mov qword [0x1400f5500], 0
lea rbx, [0x1400f54f8]
lea rdi, [0x1400f5500]
mov rcx, rdi
xor edx, edx
call fcn.140031780
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140037d90
jmp 0x140037dc7
mov rdi, qword [0x1400f54f8]
jmp 0x140037dc7

Function at 0x14003a700
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp qword [0x1400f6b48], 0
jne 0x14003a73d
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14003a730
mov dword [rdi], eax
mov dword [0x1400f6b50], eax
mov qword [0x1400f6b48], rsi
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rdi
pop rsi
ret
int3

Function at 0x14003d680
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, qword [0x1400f7040]
cmp rdi, 1
jbe 0x14003d6a9
mov rcx, rdi
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140051720
lea rcx, [0x1400f7040]
call fcn.140037cf0
test al, al
je 0x14003d6ef
mov qword [0x1400f7048], 0
lea rbx, [0x1400f7040]
lea rdi, [0x1400f7048]
mov rcx, rdi
xor edx, edx
call fcn.140031780
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140037d90
jmp 0x14003d697
mov rdi, qword [0x1400f7040]
jmp 0x14003d697
Function at 0x140043510
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
cmp rdx, 1
mov qword [rsp + 0x28], rcx
je 0x1400437e8
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
je 0x140043549
mov rcx, rdi
int3
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x1400437fb
mov rax, rdi
shr rax, 0x3d
jne 0x14004382a
lea rcx, [rdi*8]
int3
mov rbx, qword [rsi + 8]
mov edi, 2
cmp rbx, 2
jb 0x140043563
cmp rdi, rbx
jb 0x14004382f
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
mov rax, qword [rsi + 0x18]
test rax, rax
js 0x14004383f
cvtsi2ss xmm0, rax
jmp 0x140043854
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rax, qword [rsp + 0x28]
divss xmm0, dword [rax + 0x20]
call fcn.14008f190
cvttss2si rcx, xmm0
movss xmm1, dword [0x1400d5cc8]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
btc rax, 0x3f
ucomiss xmm0, xmm1
cmovb rax, rcx
cmp rbx, 3
jb 0x14004390b
mov rcx, rbx
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rbp, rbx
sub rbp, rdx
movabs rdx, 0x3333333333333333
mov rcx, rbp
shr rcx, 2
and rbp, rdx
and rcx, rdx
add rcx, rbp
mov rdx, rcx
shr rdx, 4
add rdx, rcx
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rdx
movabs rdx, 0x101010101010101
imul rdx, rcx
shr rdx, 0x38
cmp edx, 1
ja 0x14004390b
cmp rax, 2
jb 0x140043913
dec rax
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
jmp 0x140043913
mov rcx, rax
int3
cmp rdi, rax
cmovb rdi, rax
cmp rdi, rbx
mov rcx, qword [rsp + 0x28]
jae 0x140043800
mov rdx, rdi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140090d40

Function at 0x140050750
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [0x1400f5420]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test esi, esi
jne 0x14005077d
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140050773

Function at 0x1400516e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400ef1e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140051714
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140051714
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14005170e

Function at 0x140051720
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1400ef1e8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14005175e
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x140051757
call fcn.140031570
jmp 0x14005173e
Function at 0x140052420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movzx eax, byte [rcx + 0x4f]
test al, al
js 0x1400524b8
test rax, rax
jne 0x1400524a7
cmp dword [rsi + 0x50], 0
jne 0x1400524a7
mov byte [rsi + 0x54], 0
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
je 0x140052495
lea rdi, [rsi + 0x20]
movabs r14, 0x100003600
lea rcx, [rax + 1]
mov qword [rsi + 0x10], rcx
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400457f0
cmp rax, 0xffffffffffffffff
jne 0x140052487
cmp dword [rsi + 0x58], 1
jne 0x1400524d4
jmp 0x1400524c1
mov rax, qword [rsi + 0x10]
mov qword [rsi + 8], rax
cmp rax, qword [rsi + 0x18]
jne 0x140052463
mov byte [rsi + 0x54], 1
xor ebx, ebx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400b2ba0
mov rax, qword [rsi + 0x40]
jmp 0x140052438
mov rax, qword [rsi + 8]
movzx eax, byte [rax]
cmp rax, 0x20
ja 0x1400524d4
bt r14, rax
jb 0x140052487
mov rax, qword [rsi + 0x10]
mov bl, 1
nop word [rax + rax]
cmp rax, qword [rsi + 0x18]
je 0x14005249b
movzx edx, byte [rax]
mov rcx, rdi
xor r8d, r8d
call fcn.1400457f0
cmp rax, 0xffffffffffffffff
jne 0x14005249b
cmp dword [rsi + 0x58], 1
mov rax, qword [rsi + 0x10]
je 0x14005250e
add rax, 1
mov qword [rsi + 0x10], rax
jmp 0x1400524e0
movzx ecx, byte [rax]
cmp rcx, 0x20
ja 0x140052504
bt r14, rcx
jae 0x140052504
jmp 0x14005249b
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1400ec028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], 0
mov byte [rsp + 0x22], 0
mov rbx, qword [rcx + 0x10]
mov rax, qword [rcx + 0x18]
mov rcx, rax
cmp rbx, rax
je 0x1400b2c0b
cmp dword [rsi + 0x58], 1
jne 0x1400b2c08
movabs rdx, 0x100003600
mov rcx, rbx
movzx ebx, byte [rcx]
cmp rbx, 0x20
ja 0x1400b2c0b
bt rdx, rbx
jae 0x1400b2c0b
inc rcx
mov qword [rsi + 0x10], rcx
cmp rax, rcx
jne 0x1400b2be8
mov rcx, rax
jmp 0x1400b2c0b
mov rcx, rbx
cmp byte [rsi + 0x54], 0
sete dil
lea rbx, [rsp + 0x20]
test dil, 1
je 0x1400b2c48
mov rdx, rax
mov rax, rcx
mov byte [rsi + 0x54], 1
mov qword [rsi + 8], rax
cmp rax, rdx
je 0x1400b2ca7
mov rcx, rax
inc rcx
mov qword [rsi + 0x10], rcx
xor edi, edi
test byte [rsi + 0x50], 1
mov rax, rdx
je 0x1400b2c18
jmp 0x1400b2c8d
mov byte [rsi + 0x54], 0
mov qword [rsi + 8], rcx
cmp rcx, rax
je 0x1400b2c81
mov r8b, byte [rcx]
mov rcx, rsi
mov rdx, rbx
call fcn.1400b2cb0
mov rcx, qword [rsi + 0x10]
test al, al
je 0x1400b2c78
inc rcx
mov qword [rsi + 0x10], rcx
cmp rcx, qword [rsi + 0x18]
jne 0x1400b2c55
mov rax, rcx
cmp qword [rsi + 8], rcx
jne 0x1400b2c8d
test byte [rsi + 0x50], 2
jne 0x1400b2c8d
mov rdx, qword [rsi + 0x18]
jmp 0x1400b2c24
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140066890
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1400b2c90
Function at 0x14005f000
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1400f7020]
cmp rsi, 1
jbe 0x14005f023
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140051720
lea rcx, [0x1400f7020]
call fcn.140037cf0
test al, al
je 0x14005f069
mov qword [0x1400f7028], 0
lea rdi, [0x1400f7020]
lea rsi, [0x1400f7028]
mov rcx, rsi
xor edx, edx
call fcn.140031780
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140037d90
jmp 0x14005f013
mov rsi, qword [0x1400f7020]
jmp 0x14005f013

Function at 0x14006764d
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14006766b
je 0x140067676
call 0x1400676c5
mov bl, 0xc7
lahf
pop rsi
jne 0x140067656
call 0x14006766e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140067656
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400676a4
je 0x1400676e2
invalid
je 0x1400676f3
jne 0x140067656
lea rax, [0x14006757c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400632dd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140067794
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400677ed
je 0x1400677f3
call 0x1400677e4
fild qword [rdi - 0x7c]
jmp 0x174fa3f66
jne 0x1400677b6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140067776
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140067660
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14006766b
je 0x140067676
call 0x1400676c5
mov bl, 0xc7
lahf
pop rsi
jne 0x140067656
call 0x14006766e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140067656
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400676a4
je 0x1400676e2
invalid
je 0x1400676f3
jne 0x140067656
lea rax, [0x14006757c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400632dd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140067794
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400677ed
je 0x1400677f3
call 0x1400677e4
fild qword [rdi - 0x7c]
jmp 0x174fa3f66
jne 0x1400677b6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140067776
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14006768c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14006766b
je 0x140067676
call 0x1400676c5
mov bl, 0xc7
lahf
pop rsi
jne 0x140067656
call 0x14006766e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140067656
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400676a4
je 0x1400676e2
invalid
je 0x1400676f3
jne 0x140067656
lea rax, [0x14006757c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400632dd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140067794
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400677ed
je 0x1400677f3
call 0x1400677e4
fild qword [rdi - 0x7c]
jmp 0x174fa3f66
jne 0x1400677b6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140067776
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x1400676c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14006766b
je 0x140067676
call 0x1400676c5
mov bl, 0xc7
lahf
pop rsi
jne 0x140067656
call 0x14006766e
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x140067656
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x1400676a4
je 0x1400676e2
invalid
je 0x1400676f3
jne 0x140067656
lea rax, [0x14006757c]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x1400632dd]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140067794
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x1400677ed
je 0x1400677f3
call 0x1400677e4
fild qword [rdi - 0x7c]
jmp 0x174fa3f66
jne 0x1400677b6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x140067776
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x140091fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400920d0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x1400ec028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x14009212e
movzx edi, word [rsi + 0x5c]
test r15b, r15b
je 0x14009210e
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140066890
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r14, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r14
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.14007ad50
cmp eax, 0xffffffff
je 0x1400921b3
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x14009214c
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1400921bc
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test r15b, r15b
je 0x14009218d
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x14009210e
mov edi, edi
test rdi, rdi
jle 0x140092260
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.14007c7a4
cmp eax, 0xffffffff
jne 0x14009218f
mov di, 0xffff
jmp 0x14009210e
lea rax, [rsp + 0x48]
mov qword [rax], r14
lea r12, [rsp + 0x40]
mov qword [r12], r14
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx r14d, word [rdx + 6]
lea r9, [rsp + rdi + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x30], rbx
lea rbx, [rsp + 0x56]
mov qword [rsp + 0x28], rbx
lea rbx, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x58]
call qword [rax + 0x18]
cmp eax, 1
jne 0x140092249
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], r14w
cmp edi, 8
je 0x1400921b3
mov rcx, qword [rsi + 0x40]
call fcn.14007ad50
cmp eax, 0xffffffff
je 0x1400921b3
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x1400921cd
cmp eax, 2
je 0x1400921b3
cmp eax, 3
je 0x140092173
jmp 0x14009217d
movzx edi, word [rsp + 0x56]
jmp 0x14009210e
Function at 0x1400922b0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1400ec028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14007a974
cmp rax, rbx
jne 0x14009234c
cmp edi, 1
je 0x1400922f4
cmp edi, 2
je 0x14009234c
mov rcx, qword [rsi + 0x40]
call fcn.14007a620
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140066890
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140092570
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400925a5
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14007a974
xor ebx, ebx
test rsi, rsi
jle 0x1400925cb
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x1400925cb
inc rbx
cmp rsi, rbx
jne 0x1400925ac
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400925e0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1400ec028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp dx, 0xffff
je 0x14009264a
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x140092670
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14007a974
mov si, 0xffff
cmp rax, 1
je 0x14009264d
jmp 0x140092650
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140066890
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140092720
mov ebp, eax
cmp eax, 3
je 0x1400926ff
cmp ebp, 1
ja 0x140092720
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14007a974
cmp rax, rsi
jne 0x140092720
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140092688
jmp 0x14009264d
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14007a974
cmp rax, 1
je 0x14009264d
mov si, 0xffff
jmp 0x140092650

Function at 0x140092770
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400927a7
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x140092781
ret

Function at 0x140092800
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140092838
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x140092811
ret
Function at 0x1400984b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov r15b, byte [rbp + 0x78]
test byte [r9 + 8], 1
jne 0x14009850f
movzx eax, word [rbp + 0x70]
movzx edx, r15b
mov rbx, qword [rcx]
mov dword [rsp + 0x28], edx
mov word [rsp + 0x20], ax
mov rdx, r14
mov r8, rdi
call qword [rbx + 0x30]
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rsi, [rbp - 0x20]
mov rcx, r9
mov rdx, rsi
call fcn.1400444f0
lea rdx, [0x1400f1278]
mov rcx, rsi
call fcn.140044cc0
mov r12, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x140098548
mov rax, qword [rcx]
call qword [rax + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r13, [rbp - 0x20]
mov qword [r13 + 0x10], rax
movaps xmm0, xmmword [0x1400d5930]
movaps xmmword [r13], xmm0
mov rax, qword [r12]
xor r15b, 1
movzx esi, r15b
mov rcx, r12
mov rdx, r13
call qword [rax + rsi*8 + 0x28]
movzx ebx, byte [r13 + 0x17]
test bl, bl
mov rcx, qword [r13]
mov r8, qword [r13 + 8]
mov rax, rbx
cmovs rax, r8
test rax, rax
je 0x140098600
test bl, bl
mov rsi, rcx
cmovns rsi, r13
test rdi, rdi
je 0x1400985ef
movzx eax, word [rsi]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x1400985f3
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
cmp ax, 0xffff
jne 0x1400985c5
xor edi, edi
mov bl, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
add rsi, 2
test bl, bl
mov rax, r13
cmovs rax, rcx
movzx edx, bl
cmovs rdx, r8
lea rax, [rax + rdx*2]
cmp rsi, rax
jne 0x1400985a0
jmp 0x140098600
xor edi, edi
jmp 0x1400985d0
mov rbx, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [rbx + 0x60]
jmp 0x1400985bd
shr bl, 7
mov qword [r14], rdi
test bl, bl
je 0x1400984fb
call fcn.140065b58
jmp 0x1400984fb