joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140141430
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x98]
xorps xmm0, xmm0
mov r13, qword [rsp + 0x90]
xor eax, eax
mov r12d, r9d
xor r14d, r14d
and r12d, 8
mov r15d, r9d
movups xmmword [rbx + 8], xmm0
mov rdi, rcx
mov ebp, 1
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm0
movups xmmword [rbx + 0x68], xmm0
mov qword [rbx + 0x78], rax
mov qword [rbx], r13
cmp qword [rcx + 0x70], rax
jne 0x1401414c7
mov rdx, qword [rcx]
lea rcx, str.SELECT_pgno_FROM__q._q_idx_WHERE_segid__AND_term___ORDER_BY_term_DESC_LIMIT_1
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.1400ea510
mov r8, rax
lea rdx, [rdi + 0x70]
mov rcx, rdi
call fcn.140137990
mov rsi, qword [rdi + 0x70]
cmp dword [rdi + 0x3c], r14d
jne 0x140141646
movsxd r8, dword [r13]
mov edx, ebp
mov rcx, rsi
call fcn.1400ee1d0
mov r9d, dword [rsp + 0x80]
mov edx, 2
mov r8, qword [rsp + 0x78]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call fcn.1400ed510
mov rcx, rsi
call fcn.1400c06c0
cmp eax, 0x64
jne 0x140141524
xor edx, edx
mov rcx, rsi
call fcn.1400c0a80
mov ebp, eax
mov r14d, eax
sar ebp, 1
and r14d, 1
mov rcx, rsi
call fcn.1400c1490
mov edx, 1
mov dword [rdi + 0x3c], eax
mov rcx, rsi
call fcn.1401ee140
test eax, eax
jne 0x140141552
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140141552
call qword [0x1402cd320]
mov eax, dword [r13 + 4]
cmp ebp, eax
jge 0x14014155f
mov ebp, eax
xor r14d, r14d
lea eax, [rbp - 1]
mov rdx, rbx
mov rcx, rdi
mov dword [rbx + 0xc], eax
call fcn.140140890
cmp qword [rbx + 0x10], 0
je 0x140141595
mov eax, dword [rsp + 0x80]
mov r8, rbx
mov r9, qword [rsp + 0x78]
mov edx, r12d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.14013ac30
cmp dword [rdi + 0x3c], 0
jne 0x1401415e4
test r12d, r12d
je 0x1401415a7
bt r15d, 8
jae 0x1401415e4
mov eax, dword [rbx + 8]
or eax, 1
cmp qword [rbx + 0x10], 0
mov dword [rbx + 8], eax
je 0x1401415e4
mov esi, r15d
and esi, 2
je 0x1401415c5
or eax, 2
mov dword [rbx + 8], eax
test r14d, r14d
je 0x1401415d5
mov rdx, rbx
mov rcx, rdi
call fcn.14013fe90
test esi, esi
je 0x1401415e4
mov rdx, rbx
mov rcx, rdi
call fcn.140140c80
test byte [rbx + 8], 2
je 0x1401415f3
lea rcx, [0x140140bf0]
jmp 0x14014160c
mov rax, qword [rdi]
lea rcx, [0x1401401a0]
lea rdx, [0x1401409a0]
cmp dword [rax + 0x60], 1
cmove rcx, rdx
mov qword [rbx + 0x30], rcx
bt r15d, 8
jb 0x140141646
mov rax, qword [rbx]
mov esi, dword [rax + 0x20]
test esi, esi
jle 0x140141646
lea eax, [rsi*8 + 0x10]
movsxd rdx, eax
lea rcx, [rdi + 0x3c]
call fcn.1401a1ac0
test rax, rax
je 0x140141646
mov dword [rax + 4], esi
mov dword [rax], 1
mov qword [rbx + 0x28], rax
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140144f30
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r12d, r12d
lea rbx, [rcx + 0x68]
mov r13, rdx
mov r15, rcx
mov esi, r12d
mov ebp, r12d
cmp qword [rbx], r12
jne 0x140145043
mov r14, qword [rcx]
lea rax, str._origin
lea rdx, [0x14028bcb8]
lea rcx, str.SELECT_sz_s_FROM__Q._q_docsize_WHERE_id_
cmp dword [r14 + 0x44], esi
mov r9, qword [r14 + 0x10]
mov r8, qword [r14 + 8]
cmovne rdx, rax
call fcn.1400ea510
mov rdi, rax
test rax, rax
jne 0x140144faf
mov rcx, qword [rbx]
call fcn.1400c1490
mov eax, 7
jmp 0x140145187
mov rax, qword [r15]
mov r9d, 0x85
mov qword [rsp + 0x30], r12
mov r8d, 0xffffffff
mov qword [rsp + 0x28], rbx
mov rdx, rdi
mov qword [rsp + 0x20], r12
inc dword [rax + 0x80]
mov rcx, qword [r14]
call fcn.1401ae9b0
mov ebp, eax
mov rax, qword [r15]
dec dword [rax + 0x80]
cmp dword [0x1402cd290], esi
je 0x14014503a
mov rcx, qword [0x1402d3ab0]
test rcx, rcx
je 0x140145003
call qword [0x1402cd310]
mov rcx, rdi
call qword [0x1402cd2c8]
dec qword [0x1402d3a38]
movsxd rcx, eax
sub qword [0x1402d39f0], rcx
mov rcx, rdi
call qword [0x1402cd2b8]
mov rcx, qword [0x1402d3ab0]
test rcx, rcx
je 0x140145043
call qword [0x1402cd320]
jmp 0x140145043
mov rcx, rdi
call qword [0x1402cd2b8]
mov rbx, qword [rbx]
mov rcx, rbx
call fcn.1400c1490
test ebp, ebp
jne 0x140145185
mov r8, r13
mov edx, 1
mov rcx, rbx
call fcn.1400ee1d0
mov rcx, rbx
call fcn.1400c06c0
cmp eax, 0x64
jne 0x140145083
mov edx, 1
mov rcx, rbx
call fcn.1400c0ba0
mov rsi, rax
mov rcx, rbx
call fcn.1400c1490
test eax, eax
jne 0x140145187
test rsi, rsi
je 0x140145187
mov r15, qword [r15 + 8]
cmp qword [r15 + 0xa0], r12
jne 0x1401450d1
mov rcx, r15
call fcn.140134220
mov qword [r15 + 0x98], rax
cmp dword [r15 + 0x3c], r12d
jne 0x14014517b
mov rcx, r15
call fcn.1401475a0
mov qword [r15 + 0xa0], rax
cmp dword [r15 + 0x3c], r12d
jne 0x14014517b
mov rax, qword [r15 + 0xa0]
inc dword [rax]
mov rcx, qword [r15 + 0xa0]
test rcx, rcx
je 0x14014517b
mov eax, dword [rcx + 0x1c]
mov ebp, r12d
sub eax, 1
movsxd r12, eax
js 0x140145173
mov r14, r12
mov qword [rsp + 0x70], rcx
shl r14, 4
add r14, 0x28
add r14, rcx
nop word [rax + rax]
mov eax, dword [r14 - 4]
sub eax, 1
movsxd rbx, eax
js 0x140145164
imul rdi, rbx, 0x38
mov rdx, qword [r14]
add rdx, rdi
cmp qword [rdx + 0x10], rsi
ja 0x14014515a
cmp qword [rdx + 0x18], rsi
jb 0x14014515a
test ebp, ebp
jne 0x14014514f
inc qword [rdx + 0x28]
mov ebp, 1
mov r8, r13
mov rcx, r15
call fcn.140137a70
sub rdi, 0x38
sub rbx, 1
jns 0x140145130
sub r14, 0x10
sub r12, 1
jns 0x140145120
mov rcx, qword [rsp + 0x70]
call fcn.1401477a0
xor r12d, r12d
mov eax, dword [r15 + 0x3c]
mov dword [r15 + 0x3c], r12d
jmp 0x140145187
mov eax, ebp
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14016ca80
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.1401afc00
test ebx, ebx
jne 0x14016cae9
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.1401afc00
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140170320
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r15
sub rsp, 0x20
xor edi, edi
mov r12, r8
mov r15, rdx
mov rbx, rcx
cmp dword [rcx + 0x40], edi
jne 0x14017035c
cmp qword [rcx + 0x20], rdi
jne 0x14017035c
mov r9, qword [rcx + 0x10]
lea rdx, str.SELECT_data_FROM__Q._q_node_WHERE_nodeno_
mov r8, qword [rcx + 8]
call fcn.140170950
mov qword [rbx + 0x20], rax
cmp dword [rbx + 0x40], edi
jne 0x1401704aa
mov rcx, qword [rbx + 0x20]
mov r8, r15
mov edx, 1
call fcn.1400ee1d0
mov rcx, qword [rbx + 0x20]
call fcn.1400c06c0
cmp eax, 0x64
jne 0x14017047a
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x40], rbp
call fcn.1400c10d0
mov rsi, qword [rbx + 0x20]
movsxd r14, eax
test rsi, rsi
jne 0x1401703bf
lea rcx, [0x1402886d0]
call fcn.1400c2050
mov rbp, rax
jmp 0x140170437
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1401703d1
call qword [0x1402cd310]
mov rcx, qword [rsi + 0xa0]
test rcx, rcx
je 0x1401703e6
cmp di, word [rsi + 0xc0]
jb 0x140170401
mov rcx, qword [rsi]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call fcn.1401897a0
lea rcx, [0x1402886d0]
call fcn.1400c2050
mov rcx, qword [rsi]
mov rbp, rax
mov edx, dword [rsi + 0x34]
cmp byte [rcx + 0x67], dil
jne 0x14017041d
test edx, edx
jne 0x14017041d
mov eax, edi
jmp 0x140170422
call fcn.1400f41e0
mov dword [rsi + 0x34], eax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140170437
call qword [0x1402cd320]
call fcn.1401e45d0
test eax, eax
jne 0x140170450
mov rcx, r14
call fcn.1401aeec0
mov rdi, rax
test rax, rax
jne 0x140170459
mov dword [rbx + 0x40], 7
jmp 0x14017046b
mov r8, r14
mov rdx, rbp
mov rcx, rax
call fcn.140067c10
mov dword [r12], r14d
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rbx + 0x20]
call fcn.1400c1490
mov ecx, dword [rbx + 0x40]
test ecx, ecx
jne 0x1401704aa
mov dword [rbx + 0x40], eax
mov ecx, eax
test eax, eax
jne 0x1401704aa
test rdi, rdi
jne 0x1401704aa
mov r8, r15
lea rdx, str.Node__lld_missing_from_database
mov rcx, rbx
call fcn.1401702a0
mov rbx, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x1401704c0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r15, edx
mov rdi, qword [rcx + r15*8 + 0x28]
lea r14, [rcx + r15*8]
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rsi, r8
mov rbx, rcx
test rdi, rdi
jne 0x140170523
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov rdx, qword [rsp + r15*8 + 0x40]
call fcn.140170950
mov rdi, rax
mov qword [r14 + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x1401705d9
mov r8, rsi
mov edx, 1
mov rcx, rdi
call fcn.1400ee1d0
mov rcx, rdi
call fcn.1400c06c0
cmp eax, 0x65
jne 0x14017057b
test r15d, r15d
lea rcx, str.__rowid
lea rax, str.__parent
mov r9, rbp
cmovne rax, rcx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call fcn.1401702a0
jmp 0x1401705c8
cmp eax, 0x64
jne 0x1401705c8
xor edx, edx
mov rcx, rdi
call fcn.1400c0ba0
mov r9, rax
cmp rax, rbp
je 0x1401705c8
test r15d, r15d
mov qword [rsp + 0x30], rbp
lea rcx, str.__rowid
mov qword [rsp + 0x28], rsi
lea rax, str.__parent
mov r8, rsi
cmovne rax, rcx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1401702a0
mov rcx, rdi
call fcn.1400c1490
cmp dword [rbx + 0x40], 0
jne 0x1401705d9
mov dword [rbx + 0x40], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x140190f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x140191009
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x140286ff0]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x140190f81
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x140190fbc
test ecx, ecx
jne 0x140190fca
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.140109cd0
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x140190fa0
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x140190f40
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x140190fcf
inc r8
jmp 0x140190f70
test r10d, r10d
jne 0x140190f99
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x140190ff5
test edx, edx
je 0x140190f81
inc rax
jmp 0x140190fe0
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x140190f99
inc rax
jmp 0x140190fe0
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401a38b0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, qword [rcx]
lea rbp, [rcx + 0x68]
xor ebx, ebx
mov r13, r8
mov r15, rcx
mov esi, ebx
mov r12d, dword [r14 + 0x18]
cmp qword [rbp], rbx
jne 0x1401a39c0
cmp dword [r14 + 0x44], ebx
lea rax, str._origin
mov r9, qword [r14 + 0x10]
lea rdx, [0x14028bcb8]
mov r8, qword [r14 + 8]
lea rcx, str.SELECT_sz_s_FROM__Q._q_docsize_WHERE_id_
cmovne rdx, rax
call fcn.1400ea510
mov rdi, rax
test rax, rax
jne 0x1401a392c
mov esi, 7
jmp 0x1401a39c0
mov rax, qword [r15]
mov r9d, 0x85
mov qword [rsp + 0x30], rbx
mov r8d, 0xffffffff
mov qword [rsp + 0x28], rbp
mov rdx, rdi
mov qword [rsp + 0x20], rbx
inc dword [rax + 0x80]
mov rcx, qword [r14]
call fcn.1401ae9b0
mov esi, eax
mov rax, qword [r15]
dec dword [rax + 0x80]
cmp dword [0x1402cd290], ebx
je 0x1401a39b7
mov rcx, qword [0x1402d3ab0]
test rcx, rcx
je 0x1401a3980
call qword [0x1402cd310]
mov rcx, rdi
call qword [0x1402cd2c8]
dec qword [0x1402d3a38]
movsxd rcx, eax
sub qword [0x1402d39f0], rcx
mov rcx, rdi
call qword [0x1402cd2b8]
mov rcx, qword [0x1402d3ab0]
test rcx, rcx
je 0x1401a39c0
call qword [0x1402cd320]
jmp 0x1401a39c0
mov rcx, rdi
call qword [0x1402cd2b8]
mov rdi, qword [rbp]
mov rcx, rdi
call fcn.1400c1490
test rdi, rdi
je 0x1401a3aca
mov r8, qword [rsp + 0x78]
mov edx, 1
mov rcx, rdi
call fcn.1400ee1d0
mov rcx, rdi
call fcn.1400c06c0
cmp eax, 0x64
jne 0x1401a3ab6
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1401a3a0a
call qword [0x1402cd310]
mov rcx, qword [rdi + 0xa0]
test rcx, rcx
je 0x1401a3a1f
cmp bx, word [rdi + 0xc0]
jb 0x1401a3a3a
mov rcx, qword [rdi]
mov edx, 0x19
mov dword [rcx + 0x50], 0x19
call fcn.1401897a0
lea rcx, [0x1402886d0]
call fcn.1400c2050
mov rcx, qword [rdi]
mov r14, rax
mov edx, dword [rdi + 0x34]
cmp byte [rcx + 0x67], bl
jne 0x1401a3a55
test edx, edx
jne 0x1401a3a55
mov eax, ebx
jmp 0x1401a3a5a
call fcn.1400f41e0
mov dword [rdi + 0x34], eax
mov rax, qword [rdi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1401a3a6f
call qword [0x1402cd320]
xor edx, edx
mov rcx, rdi
call fcn.1400c10d0
mov ebp, eax
mov esi, ebx
test r12d, r12d
jle 0x1401a3aa8
cmp ebx, ebp
jge 0x1401a3ab6
movsxd rcx, esi
lea rdx, [rcx*4]
movsxd rcx, ebx
add rcx, r14
add rdx, r13
call fcn.14019e0b0
add ebx, eax
inc esi
cmp esi, r12d
jl 0x1401a3a82
cmp ebx, ebp
jne 0x1401a3ab6
mov rcx, rdi
call fcn.1400c1490
jmp 0x1401a3acc
mov rcx, rdi
call fcn.1400c1490
test eax, eax
mov ecx, 0x10b
cmove eax, ecx
jmp 0x1401a3acc
mov eax, esi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401a52f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [rsp + 0x70]
xor ebp, ebp
movsxd rdi, r9d
mov rsi, r8
mov r14d, edx
mov r13, rcx
mov r8d, edx
mov dword [r15], ebp
test rcx, rcx
je 0x1401a5434
lea eax, [rdi - 1]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r12
mov r9d, 0xd
movsxd rdx, eax
test eax, eax
js 0x1401a5357
nop dword [rax]
movsx ecx, byte [rdx + rsi]
lea eax, [r9*8]
xor ecx, eax
xor r9d, ecx
sub rdx, 1
jns 0x1401a5340
lea r12d, [r9*8]
mov eax, r9d
xor r12, r8
xor r12, rax
and r12d, 0x1ff
mov rbx, qword [r13 + r12*8]
test rbx, rbx
je 0x1401a53a6
nop dword [rax]
cmp dword [rbx + 0xc], r14d
jne 0x1401a539d
cmp dword [rbx + 8], edi
jne 0x1401a539d
mov rcx, qword [rbx]
mov r8, rdi
mov rdx, rsi
call fcn.140067fa0
test eax, eax
je 0x1401a5417
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1401a5380
lea rbp, [rdi + 0x18]
call fcn.1401e45d0
test eax, eax
jne 0x1401a5422
mov rcx, rbp
call fcn.1401aeec0
mov rbx, rax
test rax, rax
je 0x1401a5422
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.140067b50
lea rcx, [rbx + 0x18]
mov dword [rbx + 8], edi
mov r8, rdi
mov qword [rbx], rcx
mov rdx, rsi
mov dword [rbx + 0xc], r14d
call fcn.140067c10
mov rcx, qword [r13 + r12*8]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov eax, ecx
mov qword [r13 + r12*8], rbx
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov dword [r15], 1
mov eax, ebp
jmp 0x1401a53fb
test rbp, rbp
mov eax, 7
mov ecx, 0
cmovle eax, ecx
jmp 0x1401a53fb
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x1401a5a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
cmp ecx, 0x80
jge 0x1401a5a32
lea edx, [rcx - 0x41]
cmp edx, 0x19
lea eax, [rcx + 0x20]
cmova eax, ecx
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x10000
jge 0x1401a5af7
mov qword [rsp + 0x30], rbx
xor r10d, r10d
mov qword [rsp + 0x38], rsi
mov r11d, r10d
lea rsi, [0x140000000]
mov r9d, 0xa2
mov ebx, 0xffffffff
lea eax, [r11 + r9]
mov r8d, ecx
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
movzx edx, word [rsi + rdx*4 + 0x287350]
sub r8d, edx
mov edx, eax
cmovs edx, ebx
test r8d, r8d
movsxd rbx, edx
lea edx, [rax + 1]
cmovs edx, r11d
dec eax
test r8d, r8d
mov r11d, edx
cmovs r9d, eax
cmp r9d, edx
jge 0x1401a5a60
lea r8, [rbx*4 + 0x287350]
mov rbx, qword [rsp + 0x30]
movzx edx, word [r8 + rsi]
movzx eax, byte [r8 + rsi + 3]
add eax, edx
cmp ecx, eax
jge 0x1401a5ada
movzx eax, byte [r8 + rsi + 2]
xor edx, ecx
and edx, eax
test dl, 1
jne 0x1401a5ada
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x2875e0]
add eax, ecx
movzx ecx, ax
mov rsi, qword [rsp + 0x38]
test edi, edi
je 0x1401a5b05
cmp edi, 2
sete r10b
mov edx, r10d
add rsp, 0x20
pop rdi
jmp fcn.14014b450
lea eax, [rcx - 0x10400]
cmp eax, 0x27
lea eax, [rcx + 0x28]
jbe 0x1401a5b07
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x1401ece00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rbp, r8
mov r15, rdx
call fcn.1401aeec0
mov rbx, rax
test rax, rax
jne 0x1401ece44
mov eax, 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
cmp byte [0x1402cd294], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
je 0x1401ecea9
mov rax, qword [0x1402cd420]
test rax, rax
je 0x1401ece6e
mov ecx, 0xc8
call rax
test eax, eax
jne 0x1401ecea9
lea rsi, [rbx + 8]
mov qword [rbx + 0x10], r15
lea rdi, [rbx + 0x10]
mov qword [rsp + 0x28], rsi
mov r9, rbx
mov dword [rsp + 0x20], 0
lea r8, [0x1401c3ca0]
mov qword [rbx + 0x18], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
jne 0x1401ecec1
jmp 0x1401eceb1
lea rdi, [rbx + 0x10]
lea rsi, [rbx + 8]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
cmp qword [rdi], 0
mov rdi, qword [rsp + 0x58]
jne 0x1401ecede
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rbp
mov dword [rsi], eax
call r15
mov qword [rbx + 0x20], rax
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [r14], rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x140204240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rbx, qword [rcx]
mov rdi, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rbx, 0x20
jb 0x140204328
mov r8, qword [rcx + 8]
mov r10, qword [rcx + 0x20]
mov rdx, r8
mov r9, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov rax, r9
rol rax, 0xc
mov r11, rcx
rol r11, 7
add r11, rax
rol r8, 1
mov rax, r10
imul rdx, rbp
imul rcx, rbp
imul r9, rbp
imul r10, rbp
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
add r11, r8
rol rcx, 0x1f
imul rdx, rsi
imul rcx, rsi
rol r9, 0x1f
movabs rax, 0x85ebca77c2b2ae63
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r9, rsi
imul r10, rsi
sub r11, r15
xor r11, rcx
imul r11, rsi
sub r11, r15
xor r11, r9
imul r11, rsi
sub r11, r15
xor r11, r10
imul r11, rsi
add rax, r11
jmp 0x14020432f
mov rax, qword [rcx + 0x18]
add rax, r14
add rax, rbx
lea r8, [rdi + 0x28]
and ebx, 0x1f
cmp rbx, 8
jb 0x140204377
mov edx, ebx
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add rbx, rcx
nop dword [rax]
mov rcx, qword [r8]
add r8, 8
imul rcx, rbp
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
sub rdx, 1
jne 0x140204350
movabs r9, 0x165667b19e3779f9
cmp rbx, 4
jb 0x1402043a4
mov edx, dword [r8]
add r8, 4
imul rdx, rsi
xor rax, rdx
rol rax, 0x17
imul rax, rbp
add rax, r9
sub rbx, 4
test rbx, rbx
je 0x1402043cd
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
sub rbx, 1
jne 0x1402043b0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r9
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret
Function at 0x1402566b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x1402566ec
mov edx, dword [rcx + 0x288]
lea r11, [0x1402d3270]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
mov dword [rcx + 0x288], edx
sub r9, 1
jne 0x1402566d0
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x1402567c4
sub edx, 1
je 0x1402567b6
cmp edx, 1
je 0x140256780
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x14025679f
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret
Function at 0x14025e9ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14025e9f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14025e9f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14025e9f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14025e9f6
cmp dword [rcx + 0x84], 0xe
jbe 0x14025e9f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14025e9f8
xor al, al
add rsp, 0x28
ret