joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d2f80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4060
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d3982
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d3a1a
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d39fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d39f2
cmp qword [rbp - 0x10], 0
je 0x2fc4d39f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d39b8
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d3a1b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d3b20
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d3b48
mov eax, 0
jmp 0x2fc4d3b96
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d3b71
mov eax, 0
jmp 0x2fc4d3b96
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d3b91
mov eax, 0
jmp 0x2fc4d3b96
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d3b9c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d3c1a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d3c11
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d3c11
mov rax, qword [rbp - 8]
jmp 0x2fc4d3c2f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d3be4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x4022d2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40238c
jmp 0x40230f
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4022f1
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x402387
jmp 0x402335
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x402317
mov rax, qword [rbp + 0x18]
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
add rax, rcx
mov ecx, dword [rbp + 0x10]
shl ecx, 2
shl ecx, 2
movzx edx, byte [rbp - 1]
shl edx, 2
add ecx, edx
movzx edx, byte [rbp - 2]
add ecx, edx
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
add rdx, rcx
movzx ecx, byte [rax]
mov qword [rbp - 0x10], rax
movzx eax, byte [rdx]
xor ecx, eax
mov rax, qword [rbp - 0x10]
mov byte [rax], cl
jmp 0x402329
jmp 0x402303
leave
ret

Function at 0x4022dd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40238c
jmp 0x40230f
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4022f1
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x402387
jmp 0x402335
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x402317
mov rax, qword [rbp + 0x18]
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
add rax, rcx
mov ecx, dword [rbp + 0x10]
shl ecx, 2
shl ecx, 2
movzx edx, byte [rbp - 1]
shl edx, 2
add ecx, edx
movzx edx, byte [rbp - 2]
add ecx, edx
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
add rdx, rcx
movzx ecx, byte [rax]
mov qword [rbp - 0x10], rax
movzx eax, byte [rdx]
xor ecx, eax
mov rax, qword [rbp - 0x10]
mov byte [rax], cl
jmp 0x402329
jmp 0x402303
leave
ret

Function at 0x40238e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40243d
jmp 0x4023c3
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4023a5
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x402438
jmp 0x4023e9
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4023cb
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, str.cw
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x4023dd
jmp 0x4023b7
leave
ret
Function at 0x402399
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x40243d
jmp 0x4023c3
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x4023a5
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x402438
jmp 0x4023e9
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x4023cb
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, str.cw
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x4023dd
jmp 0x4023b7
leave
ret

Function at 0x40370c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x4037bb
jmp 0x403741
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403723
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x4037b6
jmp 0x403767
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x403749
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x0066f6bd]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x40375b
jmp 0x403735
leave
ret

Function at 0x403717
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 4
jge 0x4037bb
jmp 0x403741
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403723
mov eax, 0
mov byte [rbp - 2], al
movzx eax, byte [rbp - 2]
cmp eax, 4
jge 0x4037b6
jmp 0x403767
movzx eax, byte [rbp - 2]
add eax, 1
mov byte [rbp - 2], al
jmp 0x403749
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rbp - 2]
movsxd rcx, ecx
shl rcx, 2
add rax, rcx
movzx ecx, byte [rbp - 1]
movsxd rcx, ecx
add rax, rcx
mov rcx, qword [rbp + 0x10]
movzx edx, byte [rbp - 2]
movsxd rdx, edx
shl rdx, 2
add rcx, rdx
movzx edx, byte [rbp - 1]
movsxd rdx, edx
add rcx, rdx
movzx edx, byte [rcx]
movsxd rdx, edx
lea rcx, [0x0066f6bd]
add rcx, rdx
movzx edx, byte [rcx]
mov byte [rax], dl
jmp 0x40375b
jmp 0x403735
leave
ret
Function at 0x403b1b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 0x20
jge 0x403b84
jmp 0x403b54
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403b36
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
add rcx, rax
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rdx, qword [rbp + 0x18]
add rdx, rax
movzx eax, byte [rcx]
mov qword [rbp - 0x10], rcx
movzx ecx, byte [rdx]
xor eax, ecx
mov rcx, qword [rbp - 0x10]
mov byte [rcx], al
jmp 0x403b48
leave
ret

Function at 0x403b26
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 0x20
jge 0x403b84
jmp 0x403b54
movzx eax, byte [rbp - 1]
add eax, 1
mov byte [rbp - 1], al
jmp 0x403b36
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
add rcx, rax
movzx eax, byte [rbp - 1]
movsxd rax, eax
mov rdx, qword [rbp + 0x18]
add rdx, rax
movzx eax, byte [rcx]
mov qword [rbp - 0x10], rcx
movzx ecx, byte [rdx]
xor eax, ecx
mov rcx, qword [rbp - 0x10]
mov byte [rcx], al
jmp 0x403b48
leave
ret
Function at 0x2fc4d0750
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d1830
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d1152
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f3108]
test eax, eax
je 0x2fc4d11ea
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f3110]
mov qword [rbp - 8], rax
jmp 0x2fc4d11ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d11c2
cmp qword [rbp - 0x10], 0
je 0x2fc4d11c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d1188
lea rax, [0x2fc4f30e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d11eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d12f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d1318
mov eax, 0
jmp 0x2fc4d1366
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d1341
mov eax, 0
jmp 0x2fc4d1366
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d1361
mov eax, 0
jmp 0x2fc4d1366
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d136c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d13ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d13e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d13e1
mov rax, qword [rbp - 8]
jmp 0x2fc4d13ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d13b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400020b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400020fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400020fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400020fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400020fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400020fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400020fc
xor al, al
add rsp, 0x28
ret

Function at 0x140001077
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
ret

Function at 0x140001156
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov rax, qword gs:[0x60]
test byte [rax + 0xbc], 0x70
setne al
ret

Function at 0x14000116a
Capabilities:
Check for outputdebugstring error
Print debug messages

Disassembly:
sub rsp, 0x28
mov ecx, 0x7331c0de
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.ERROR
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7331c0de
setne al
add rsp, 0x28
ret

Function at 0x1400011d6
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor eax, eax
mov r10, rcx
mov rcx, rdx
cmp word [r10], 0x5a4d
jne 0x140001250
movsxd rdx, dword [r10 + 0x3c]
add rdx, r10
cmp dword [rdx], 0x4550
jne 0x140001250
mov ebx, dword [rdx + 0x88]
xor r11d, r11d
add rbx, r10
mov esi, dword [rbx + 0x20]
mov edi, dword [rbx + 0x14]
add rsi, r10
cmp r11d, edi
jae 0x14000124e
mov edx, dword [rsi + r11*4]
add rdx, r10
call fcn.1400011b4
mov edx, eax
lea rax, [r11 + 1]
test edx, edx
jne 0x140001249
mov eax, dword [rbx + 0x24]
add r11, r11
add r11, r10
movzx edx, word [r11 + rax]
mov eax, dword [rbx + 0x1c]
lea rdx, [r10 + rdx*4]
mov eax, dword [rdx + rax]
add rax, r10
jmp 0x140001250
mov r11, rax
jmp 0x140001211
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x14000137f
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r11, qword [rax + 0x20]
mov rbx, rcx
test r11, r11
je 0x1400013c3
cmp word [r11 + 0x48], 0
je 0x1400013c0
mov rcx, qword [r11 + 0x50]
mov rdx, rbx
call fcn.14000130a
test eax, eax
jne 0x1400013bb
mov r11, qword [r11 + 0x20]
jmp 0x1400013c3
mov r11, qword [r11]
jmp 0x140001398
xor r11d, r11d
mov rax, r11
add rsp, 0x20
pop rbx
ret
Function at 0x140002630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov al, byte [rsp + 0x67]
mov r10b, al
xor r10b, 1
mov byte [rsp + 0x67], r10b
cmp r9d, 0
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x44], r9d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x30], ecx
mov byte [rsp + 0x2f], al
jne 0x140002687
mov rax, qword [rsp + 0x58]
imul rax, qword [rsp + 0x58]
mov qword [rsp + 0x58], rax
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor eax, eax
xor ecx, ecx
mov edx, ecx
mov ecx, dword [rsp + 0x44]
mov r8d, ecx
mov r9d, r8d
mov r8d, eax
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x24], eax
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x10], rdx
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x24]
mov edx, dword [rsp + 0x28]
mov r8d, 0x100
add ecx, 1
mov qword [rsp + 8], rax
mov eax, ecx
mov dword [rsp + 4], edx
cdq
idiv r8d
movsxd r9, edx
mov r10, qword [rsp + 0x30]
mov r11b, byte [r10 + r9]
movzx ecx, r11b
mov esi, dword [rsp + 4]
add esi, ecx
mov eax, esi
mov dword [rsp], edx
cdq
idiv r8d
movsxd rdi, edx
mov bl, byte [r10 + rdi]
mov bp, word [rsp + 0x56]
imul bp, word [rsp + 0x56]
mov word [rsp + 0x56], bp
mov byte [r10 + r9], bl
mov byte [r10 + rdi], r11b
movzx r8d, byte [r10 + r9]
add r8d, ecx
mov byte [rsp + 0x67], 0x9b
and r8d, 0xff
mov r11b, 0x44
mov bl, byte [rsp + 0x2f]
mov al, bl
mul r11b
mov byte [rsp + 0x67], al
mov ecx, r8d
mov r9d, ecx
mov al, byte [r10 + r9]
mov r9, qword [rsp + 0x38]
mov rdi, qword [rsp + 8]
xor al, byte [r9 + rdi]
mov r14, qword [rsp + 0x48]
mov byte [r14 + rdi], al
add rdi, 1
mov r15, qword [rsp + 0x18]
cmp rdi, r15
mov ecx, dword [rsp]
mov dword [rsp + 0x24], ecx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x10], rdi
je 0x14000266a
jmp 0x1400026ad

Function at 0x140002780
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x20
lea rax, [fcn.140002780]
mov qword [rsp + 0x18], 0x330210ae

Function at 0x140002794
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rax
jmp 0x1400027e7
mov ax, word [rsp + 0x16]
sub ax, word [rsp + 0x16]
mov rcx, qword [rsp + 0x18]
xor rcx, 0xffffffffccfde0ae
mov word [rsp + 0x16], ax
mov rdx, qword [rsp]
add rdx, rcx
and rdx, 0xfffffffffffff000
mov qword [rsp + 8], rdx
jmp 0x1400027e7
mov rax, qword [rsp]
add rsp, 0x20
ret
mov rax, qword [rsp]
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
je 0x1400027cb
jmp 0x14000279b
mov rax, qword [rsp + 8]
cmp word [rax], 0x5a4d
mov qword [rsp], rax
je 0x1400027d4
jmp 0x14000279b
Function at 0x140002b30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
xor eax, eax
xor r9d, r9d
mov r10d, r9d
mov dword [rsp + 0x58], 0x7828dad1
mov qword [rsp + 0x38], 0x55c2e32
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x2c], r8d
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x1c], eax
mov qword [rsp + 0x10], r10
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x1c]
mov edx, 0x55c2e33
mov r8d, edx
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r11b, cl
sub r8, r9
add r10, 0xfffffffffaa3d2ce
mov r9, qword [rsp + 0x20]
mov byte [r9 + rax], r11b
add ecx, 1
add rax, r8
cmp rax, r10
mov dword [rsp + 0x1c], ecx
mov qword [rsp + 0x10], rax
jne 0x140002b6d
xor eax, eax
mov ecx, eax
xor eax, eax
imul dx, word [rsp + 0x46], 0x5264
mov word [rsp + 0x46], dx
mov qword [rsp + 8], rcx
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdx
mov r8w, word [rsp + 0x46]
xor r8w, 0xffff
mov rdx, qword [rsp + 0x20]
mov r9b, byte [rdx + rcx]
movzx r10d, r9b
mov word [rsp + 0x46], r8w
mov r11d, ecx
mov dword [rsp], eax
mov eax, r11d
xor edx, edx
mov r11d, dword [rsp + 0x2c]
div r11d
mov edx, edx
mov esi, edx
invalid
invalid
Function at 0x140003530
Capabilities:
Encode data using xor

Disassembly:
add byte [rax], al
add byte [rax - 0x39], cl
and al, 0x68
add byte [rax], al
add byte [rax], al
mov dword [rsp + 0xac], r8d
mov bx, word [rsp + 0x4e]
add bx, 0x305a
mov word [rsp + 0xce], bx
jmp 0x140003413
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], 0x2a10
mov dx, word [rsp + 0x4e]
imul r8w, dx, 0xe51f
mov word [rsp + 0xce], r8w
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rax, section..data
mov ecx, dword [rsp + 0xac]
mov dl, byte [rsp + 0xbf]
xor dl, 0xff
mov byte [rsp + 0xbf], dl
mov r8, qword [rsp + 0x68]
imul r9, r8, 0x68
mov r10, rax
add r10, r9
add r10, 4
mov r11d, dword [r10]
mov si, word [rsp + 0x4e]
xor si, 0xffff
mov word [rsp + 0xce], si
imul r9, r8, 0x68
mov r10, rax
add r10, r9
add r10, 0x60
mov edi, dword [rsp + 0xc8]
or edi, dword [rsp + 0xc8]
mov rdx, qword [r10]
mov dword [rsp + 0xc8], edi
imul r9, r8, 0x68
add rax, r9
mov edi, dword [rax]
mov dword [rsp + 0xc8], 0x10242e80
xor edi, r11d
mov r11d, ecx
mov eax, r11d
mov r9, qword [rsp + 0xa0]
mov dword [rsp + 0xc8], 0x762859b
mov r11d, edi
mov r10d, r11d
add r9, rax
mov dword [rsp + 0x38], ecx
mov rcx, r9
mov qword [rsp + 0x30], r8
mov r8, r10
mov dword [rsp + 0x2c], edi
call sym.slc.dll_SLInstallSAMLicense
mov bl, byte [rsp + 0xbf]
xor bl, 0x5b
mov byte [rsp + 0xbf], bl
mov r11d, dword [rsp + 0x2c]
mov edi, dword [rsp + 0x38]
add r11d, edi
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xac], r11d
cmp rax, 0x54
jne 0x140003413
mov rax, qword [rsp + 0xa0]
mov r8d, dword [rsp + 0x60]
mov rcx, rax
mov rdx, rax
call fcn.1400014e0
mov r8d, 0x75997563
mov eax, r8d
mov eax, eax
mov dword [rsp + 0xc8], 0x479703f9
mov r9w, word [rsp + 0x4e]
add r9w, 0xb75
mov rcx, qword [rsp + 0xa0]
mov word [rsp + 0xce], r9w
mov r10b, byte [rsp + 0xbf]
sub rax, qword [rsp + 0xd0]
add rcx, 0x36da
mov rdx, qword [rsp + 0x98]
mov byte [rsp + 0xbf], r10b
mov r11, qword [rsp + 0x50]
mov qword [r11], rcx
mov qword [rsp + 0xc0], 0x36c9803f
mov qword [r11 + 8], rax
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0xc8], 0xf64d2b0
add rax, 0x592
mov qword [r11 + 0x10], rax
cmp rdx, 0x78089fad
jbe 0x1400033e4
jmp 0x140003636
call fcn.140001550
nop
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
ret