joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400078b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14000d610], rbx
je 0x1400078fc
cmp rax, rbx
jne 0x1400078ef
mov ebx, 1
mov esi, ebx
jmp 0x140007901
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400078d4
mov ebx, 1
mov eax, dword [0x14000d618]
cmp eax, ebx
jne 0x140007917
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000797c
mov eax, dword [0x14000d618]
test eax, eax
jne 0x140007976
mov dword [0x14000d618], ebx
lea r15, [0x140009560]
lea rdi, [0x140009548]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140007968
test eax, eax
jne 0x14000796c
cmp qword [rdi], 0
je 0x14000795d
mov rax, qword [rdi]
mov rcx, qword [vtable.H_MA8HI.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000793e
test eax, eax
je 0x14000797c
mov eax, 0xff
jmp 0x140007a58
mov dword [0x14000b164], ebx
mov eax, dword [0x14000d618]
cmp eax, ebx
jne 0x1400079a3
lea rdx, [0x140009540]
lea rcx, [0x140009530]
call sub.msvcrt.dll__initterm
mov dword [0x14000d618], 2
test esi, esi
jne 0x1400079b0
xor eax, eax
xchg qword [0x14000d610], rax
cmp qword [0x14000d620], 0
je 0x1400079e4
lea rcx, [0x14000d620]
call fcn.140007e30
test eax, eax
je 0x1400079e4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000d620]
mov r9, qword [vtable.H_MA8HI.0]
call r9
mov r8, qword [0x14000b178]
mov rdx, qword [0x14000b170]
mov ecx, dword [0x14000b168]
call fcn.140002630
mov dword [0x14000b160], eax
cmp dword [0x14000b180], 0
jne 0x140007a14
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b164], 0
jne 0x140007a29
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b160]
jmp 0x140007a58
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400a0000
add rsp, 0x28
jmp 0x1400078b0

Function at 0x140007d1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140007d68
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140007d60
cmp dword [rcx + 0x3c], edx
jl 0x140007d60
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140007d60
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140007d68
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test byte [rdx], al
hlt
test byte [rdx], al
jo 0x140023288
clc
add al, byte [rbx]
hlt
Function at 0x140001e50
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140008100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400080e0]
test rbx, rbx
je 0x140001eac
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140001ea3
test rsi, rsi
je 0x140001ea3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001e88
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400020c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400020f8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002100
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400020d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400020f8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002100
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400020e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400020f8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002100
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002200
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140005860]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002220
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002228
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002220
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000227d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x140002274
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002220
add rax, 0x28
cmp rax, r9
jne 0x140002260
xor eax, eax
ret

Function at 0x140002280
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005860]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000229f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400022a8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000229f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140002340
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005860]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000235f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002368
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002520
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r8d, 0x2c
mov ecx, 2
lea rdx, str._stack_smashing_detected_:_terminated_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x140002550
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x140002b40
Capabilities:
Get local ipv4 addresses

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, qword [0x140005930]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rbp]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rsi, [rsp + 0x3c]
xor eax, eax
mov rdi, rcx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov dword [rsp + 0x3c], eax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
je 0x140002b8a
xor eax, eax
jmp 0x140002c0c
mov edx, dword [rsp + 0x3c]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rbx, rax
je 0x140002b83
mov qword [rsp + 0x20], rsi
mov r9, rax
xor r8d, r8d
xor edx, edx
lea r12, [rsp + 0x42]
xor ecx, ecx
mov rsi, rbx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp dword [rsi + 0x58], 6
jne 0x140002bf5
mov eax, dword [rsi + 0x50]
mov r8d, 3
mov rdx, r12
mov rcx, rdi
mov dword [rsp + 0x42], eax
mov ax, word [rsi + 0x54]
mov word [rsp + 0x46], ax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x140002bf5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x140002c0c
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x140002bbd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002b83
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rbp]
je 0x140002c1c
call fcn.140002520
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140002d40
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [0x140005930]
mov rsi, qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rcx, [rsp + 0x28]
call rsi
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x30]
call rsi
mov edx, dword [rsp + 0x30]
xor eax, eax
cmp dword [rsp + 0x28], edx
jne 0x140002d8e
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x2c], eax
sete al
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rbx]
je 0x140002d9d
call fcn.140002520
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x140002db0
Capabilities:
Enumerate processes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x160
mov rdi, qword [0x140005930]
xor edx, edx
mov rax, qword [rdi]
mov qword [rsp + 0x158], rax
xor eax, eax
mov rsi, rcx
mov ecx, 2
mov dword [rsp + 0x28], 0x238
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rbp, [rsp + 0x28]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
lea r12, [rsp + 0x54]
test eax, eax
jne 0x140002e08
xor eax, eax
jmp 0x140002e2a
mov rdx, rbp
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140002e04
mov rdx, rsi
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
test eax, eax
jne 0x140002e08
mov eax, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x158]
sub rdx, qword [rdi]
je 0x140002e3c
call fcn.140002520
add rsp, 0x160
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140002e50
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [0x140005930]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x48], 1
setbe al
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rbx]
je 0x140002e88
call fcn.140002520
add rsp, 0x60
pop rbx
ret

Function at 0x140002e90
Capabilities:
Get local ipv4 addresses

Disassembly:
sub rsp, 0x28
lea rcx, [0x140005090]
call fcn.140002b40
test al, al
jne 0x140002f04
lea rcx, [0x140005094]
call fcn.140002b40
test al, al
jne 0x140002f04
lea rcx, [0x140005098]
call fcn.140002b40
test al, al
jne 0x140002f04
lea rcx, [0x14000509c]
call fcn.140002b40
test al, al
jne 0x140002f04
lea rcx, [0x1400050a0]
call fcn.140002b40
test al, al
jne 0x140002f04
lea rcx, [0x1400050a4]
call fcn.140002b40
test al, al
jne 0x140002f04
lea rcx, [0x1400050a8]
add rsp, 0x28
jmp fcn.140002b40
mov al, 1
add rsp, 0x28
ret

Function at 0x140002f10
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, qword [0x140005930]
mov rax, qword [rbx]
mov qword [rsp + 0x68], rax
xor eax, eax
mov dword [rsp + 0x28], 0x40
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rsp + 0x30], 0x7fffffff
setbe al
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rbx]
je 0x140002f54
call fcn.140002520
add rsp, 0x70
pop rbx
ret
Function at 0x140003200
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rbx, qword [0x140005930]
lea rsi, section..rdata
mov rax, qword [rbx]
mov qword [rsp + 0x248], rax
xor eax, eax
lea rdi, [rsp + 0x28]
mov r9, rcx
mov ecx, 8
rep movsd dword [rdi], dword [rsi]
lea r10, [rsp + 0x148]
mov r11, rdx
lea rbp, [rsp + 0x48]
mov rdx, rax
mov byte [rax + r10], al
inc rax
and edx, 0x1f
mov dl, byte [rsp + rdx + 0x28]
mov byte [rax + rbp - 1], dl
cmp rax, 0x100
jne 0x14000324b
mov r12, r10
xor esi, esi
xor r13d, r13d
mov edi, 0x100
movzx eax, byte [r12]
movzx edx, byte [rbp + rsi]
inc rsi
add eax, r13d
add eax, edx
cdq
idiv edi
movsxd rcx, edx
mov rdx, r12
inc r12
mov r13, rcx
add rcx, r10
call fcn.140002ac0
cmp rsi, 0x100
jne 0x140003275
lea rdi, [r9 + r11]
xor ebp, ebp
xor r12d, r12d
cmp rdi, r9
je 0x140003305
lea eax, [rbp + 1]
cdq
idiv esi
movsxd r13, edx
movzx eax, byte [rsp + r13 + 0x148]
lea rcx, [r10 + r13]
mov rbp, r13
add eax, r12d
cdq
idiv esi
movsxd r14, edx
lea rdx, [r10 + r14]
mov r12, r14
call fcn.140002ac0
mov cl, byte [rsp + r14 + 0x148]
add cl, byte [rsp + r13 + 0x148]
movzx ecx, cl
mov al, byte [rsp + rcx + 0x148]
xor byte [r9], al
inc r9
jmp 0x1400032b0
mov rax, qword [rsp + 0x248]
sub rax, qword [rbx]
je 0x140003317
call fcn.140002520
mov rax, r11
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x1400034c0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x20]
mov rsi, rcx
test rbx, rbx
je 0x140003503
cmp word [rbx + 0x48], 0
je 0x140003501
mov rcx, qword [rbx + 0x50]
mov rdx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsicmp
test eax, eax
jne 0x1400034fc
mov rbx, qword [rbx + 0x20]
jmp 0x140003503
mov rbx, qword [rbx]
jmp 0x1400034da
xor ebx, ebx
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140003510
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor eax, eax
cmp word [rcx], 0x5a4d
mov rbx, rcx
mov rbp, rdx
jne 0x140003591
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140003591
mov edi, dword [rdx + 0x88]
xor esi, esi
add rdi, rcx
mov r12d, dword [rdi + 0x20]
mov r13d, dword [rdi + 0x14]
add r12, rcx
cmp esi, r13d
jae 0x14000358f
mov edx, dword [r12 + rsi*4]
mov rcx, rbp
add rdx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov edx, eax
lea rax, [rsi + 1]
test edx, edx
jne 0x14000358a
mov eax, dword [rdi + 0x24]
add rsi, rsi
add rsi, rbx
movzx edx, word [rsi + rax]
mov eax, dword [rdi + 0x1c]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
jmp 0x140003591
mov rsi, rax
jmp 0x140003550
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140004670
Capabilities:
Create directory
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov r15, rcx
mov dword [rbp - 0x31], 0
movabs rax, 0x3c318d05cf5f3ad2
mov qword [rbp - 0x39], rax
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x19], rax
movabs r12, 0x7934924d10da1bec
mov qword [rbp - 0x39], r12
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x11], rax
movabs r13, 0x3c50f964ab2f4ab3
mov qword [rbp - 0x39], r13
mov rax, qword [rbp - 0x39]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x39], r12
mov rax, qword [rbp - 0x39]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [rbp - 0x19]
xorps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm0
lea rcx, [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea rsi, [r15 + 0x50]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140004712
mov rcx, qword [rsi + 0x18]
cmp rbx, rcx
ja 0x140004749
mov r14, rsi
cmp rcx, 0xf
jbe 0x140004730
mov r14, qword [rsi]
mov qword [rsi + 0x10], rbx
mov r8, rbx
mov rdx, rax
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
jmp 0x140004758
mov r9, rax
mov rdx, rbx
mov rcx, rsi
call fcn.140005540
nop
mov rcx, qword [rsi + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 6
jb 0x14000489a
cmp qword [rsi + 0x18], 0xf
jbe 0x14000477d
mov rsi, qword [rsi]
mov qword [rsp + 0x30], 6
lea rax, str.Arial
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, rsi
lea rcx, [rbp - 9]
call fcn.140005680
mov ebx, 1
mov dword [rbp - 0x31], ebx
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
and ebx, 0xfffffffe
mov dword [rbp - 0x31], ebx
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x140004803
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400047fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400047fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007fd5c
movdqa xmm0, xmmword [0x14008c5f0]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
movabs rax, 0x3c0c9505c25d0bef
mov qword [rbp - 0x39], rax
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x39], r12
mov rax, qword [rbp - 0x39]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x39], r13
mov rax, qword [rbp - 0x39]
mov qword [rbp + 0x27], rax
mov qword [rbp - 0x39], r12
mov rax, qword [rbp - 0x39]
mov qword [rbp + 0x2f], rax
movdqa xmm0, xmmword [rbp - 0x29]
xorps xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 0x29], xmm0
lea rax, [rbp - 0x29]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140004860
mov r8, rdi
lea rcx, [r15 + 0x50]
lea rdx, [rbp - 0x29]
call fcn.140004d90
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001610
nop
Function at 0x140010ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov edi, edx
and edi, 7
je 0x140010f74
cmp edx, edi
jge 0x140010f65
mov r8d, dword [rcx + 0x18]
mov eax, 1
mov ecx, edx
mov r10d, edx
shl eax, cl
mov r9d, edx
cmp r8d, eax
jae 0x140010f5b
mov r11, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r11
jb 0x140010f23
xor cl, cl
jmp 0x140010f2c
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
lea edx, [r10 + 8]
mov ecx, r10d
mov dword [rbx + 0x10], edx
shl eax, cl
or r8d, eax
mov dword [rbx + 0x18], r8d
cmp edx, 0x18
jg 0x140010f65
mov ecx, edx
mov eax, 1
shl eax, cl
mov r10d, edx
mov r9d, edx
cmp r8d, eax
jb 0x140010f17
mov rax, qword [rbx + 8]
mov edx, r9d
mov qword [rbx], rax
mov eax, dword [rbx + 0x18]
mov ecx, edi
shr eax, cl
sub edx, edi
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x10], edx
xor r8d, r8d
mov eax, edx
test edx, edx
jle 0x140010fae
mov ecx, dword [rbx + 0x18]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x18], ecx
movzx r9d, cl
test eax, eax
jg 0x140010f90
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x140010fdb
mov rax, qword gs:[0x58]
mov edx, 0x13d0
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x14001100f
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax + rax]
cmp rax, r8
jb 0x140010ff9
xor dl, dl
jmp 0x140011002
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x140010ff0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x140010fb2
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x140011078
mov rax, qword gs:[0x58]
mov edx, 0x13d0
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rbx + 0x20]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x30]
jbe 0x140011096
mov rcx, rbx
call fcn.1400102e0
test eax, eax
je 0x140010fce
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x20]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x20], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002a2a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14002a301
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14002a2c0
mov ecx, dword [r9]
jmp 0x14002a3e8
cmp ecx, 0x4e0
jb 0x14002a3e8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14002a320
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14002a370
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14002c100
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14002c15d
lea rbx, [0x140086da0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14002c144
cmp r10, 2
jb 0x14002c144
cmp byte [r9], r8b
jne 0x14002c144
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14002c120
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14002c19f
lea rbx, [0x140086da0]
cmp r8b, 0x23
jne 0x14002c183
cmp byte [r9], r8b
jne 0x14002c183
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14002c170
mov rbx, qword [rsp + 8]
not eax
ret