joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009a08c
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea rdx, [rax + 0x10]
mov ebp, r12d
mov rsi, rcx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
mov edi, r12d
test rax, rax
je 0x18009a15e
cmp dword [rsp + 0x58], r12d
jle 0x18009a15e
movzx ebx, r12w
lea r13, [0x1800f6d70]
cmp bx, 0x13
jae 0x18009a137
mov rcx, qword [r15]
movzx r14d, bx
shl r14, 5
mov rdx, qword [r14 + r13 + 0x10]
call fcn.1800c8ad4
test eax, eax
mov edi, r12d
sete dil
test eax, eax
jne 0x18009a130
mov rax, qword [r14 + r13]
test rax, rax
je 0x18009a121
mov ecx, dword [rsp + 0x58]
lea rdx, [r15 + 8]
dec ecx
call rax
mov ebp, eax
jmp 0x18009a130
mov ecx, dword [r14 + r13 + 8]
xor r8d, r8d
xor edx, edx
call fcn.18000a3e4
inc bx
test edi, edi
je 0x18009a0e0
test edi, edi
jne 0x18009a15e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r12w
jne 0x18009a13f
lea r8d, [rax*2 + 2]
mov rdx, rsi
mov ecx, 0x22c003
call fcn.18000a3e4
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18009bc0c
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebx, ebx
lea rax, [r11 + 0x20]
mov qword [r11 - 0x38], rax
mov r14, r8
mov qword [r11 - 0x40], rbx
lea r8, str.SupplementalCredentials
mov qword [r11 - 0x48], rbx
mov rdi, rdx
mov rbp, rcx
mov dword [r11 + 0x20], ebx
call fcn.18000e954
test eax, eax
je 0x18009bd9e
cmp dword [rsp + 0x88], 0x90
jbe 0x18009bd9e
mov edx, dword [rsp + 0x88]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18009bd9e
lea rax, [rsp + 0x88]
mov rdx, rdi
mov qword [rsp + 0x30], rax
lea r8, str.SupplementalCredentials
mov qword [rsp + 0x28], rsi
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call fcn.18000e954
test eax, eax
je 0x18009bd89
lea rcx, str._nSupplemental_Credentials:_n
call fcn.18000bdb4
mov edx, dword [rsi + 0xc]
lea ecx, [rbx + 0x40]
add edx, 0xc
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18009bd95
mov ebp, dword [rsp + 0x88]
lea r9d, [rbx + 0x18]
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x48]
add ebp, 0xffffffe0
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18009bd33
lea rcx, [rsp + 0x48]
mov r9d, ebp
mov qword [rsp + 0x30], rcx
lea rax, [rdi + 4]
mov qword [rsp + 0x28], rax
lea r8, [rsi + 0x20]
lea rax, [rsp + 0x40]
mov rcx, r14
lea rdx, [rsi + 0x10]
mov qword [rsp + 0x20], rax
call fcn.180004b88
jmp 0x18009bd49
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_crypto_genericAES128Decrypt___CryptAcquireContext__0x_08x__n
call fcn.18000bdb4
mov eax, ebx
test eax, eax
je 0x18009bd7e
mov eax, dword [rdi + 4]
cmp eax, dword [rsi + 0xc]
jne 0x18009bd73
mov rdx, qword [rsp + 0x40]
lea rcx, [rdi + 0xc]
mov r8d, eax
mov ebx, 1
call fcn.1800c4b10
mov rcx, rdi
call fcn.1800b236c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18009bd95
lea rcx, str.ERROR_kuhl_m_lsadump_getSupplementalCreds___kull_m_registry_RegQueryValueEx_data__n
call fcn.18000bdb4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1800a9ad8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8w
mov r11, r9
movzx r10d, dl
xor r9b, r9b
shl r10d, 0x10
mov rsi, rcx
or r10d, eax
movabs rax, 0x2004000000
add r10d, r10d
mov edi, r10d
xor r10b, r10b
or rdi, rax
xor r8b, r8b
movzx edx, r8b
mov rax, rdi
mov bl, r10b
inc r8b
lea ecx, [rdx + 0xd]
shr rax, cl
lea ecx, [rdx + 1]
and al, 1
xor r9b, al
mov rax, rdi
shr rax, cl
and al, 1
xor r10b, al
cmp r8b, 0xc
jb 0x1800a9b18
xor ecx, ecx
cmp al, bl
movzx eax, r9b
sete cl
and eax, 1
shl rax, 0x19
or rcx, rax
or rdi, rcx
test r11, r11
je 0x1800a9b64
mov qword [r11], rdi
mov rcx, rdi
mov dword [rsi], 0x90625062
shr rcx, 0x28
call fcn.1800a9aa0
movzx ebx, al
mov rcx, rdi
or ebx, 0x1d00
shr rcx, 0x24
shl ebx, 8
call fcn.1800a9aa0
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x20
shl ebx, 8
call fcn.1800a9aa0
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x1c
mov dword [rsi + 4], ebx
call fcn.1800a9aa0
movzx ebx, al
mov rcx, rdi
shr rcx, 0x18
shl ebx, 8
call fcn.1800a9aa0
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x14
shl ebx, 8
call fcn.1800a9aa0
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0x10
shl ebx, 8
call fcn.1800a9aa0
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 0xc
mov dword [rsi + 8], ebx
call fcn.1800a9aa0
movzx ebx, al
mov rcx, rdi
shr rcx, 8
shl ebx, 8
call fcn.1800a9aa0
movzx eax, al
mov rcx, rdi
or ebx, eax
shr rcx, 4
shl ebx, 8
call fcn.1800a9aa0
movzx eax, al
mov cl, dil
or ebx, eax
shl ebx, 8
call fcn.1800a9aa0
movzx eax, al
or ebx, eax
mov dword [rsi + 0xc], ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800a9c54
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
and dword [rax + 8], 0
mov rdi, rdx
xor r10b, r10b
mov r11, rcx
movabs r8, 0xff80000000000000
movzx esi, r10b
lea rdx, [rsp + 8]
mov ecx, 9
mov r9, rdi
sub ecx, esi
shl ecx, 2
shr r9, cl
xor cl, cl
and r9b, 0xf
xor bl, bl
mov al, r9b
shr al, cl
inc cl
and al, 1
xor byte [rdx], al
xor bl, al
inc rdx
cmp cl, 4
jb 0x1800a9c9b
imul eax, esi, 0xfffffffb
inc r10b
movzx edx, bl
lea ecx, [rax + 0x32]
shl rdx, cl
lea ecx, [rax + 0x33]
movzx eax, r9b
shl rax, cl
or rdx, rax
or r8, rdx
cmp r10b, 0xa
jb 0x1800a9c7a
movzx eax, byte [rsp + 0xa]
movzx ecx, byte [rsp + 0xb]
mov rbx, qword [rsp + 0x10]
add ecx, ecx
mov rsi, qword [rsp + 0x18]
or ecx, eax
movzx eax, byte [rsp + 9]
add ecx, ecx
mov rdi, qword [rsp + 0x20]
or ecx, eax
movzx eax, byte [rsp + 8]
add ecx, ecx
or ecx, eax
mov dword [r11], 0x148040
lea eax, [rcx + rcx]
or r8, rax
mov rax, r8
mov dword [r11 + 8], r8d
shr rax, 0x20
mov dword [r11 + 4], eax
ret
Function at 0x1800b0394
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
lea rdx, str.Microsoft_WinInet_
mov rcx, qword [rcx + 8]
call fcn.1800c3cb0
test rax, rax
je 0x1800b0443
mov edx, dword [rbx + 0x20]
cmp edx, 0x14
jb 0x1800b05b6
mov rcx, qword [rbx + 0x28]
mov rax, qword [rcx + 4]
cmp rax, qword [0x1800ecbf0]
jne 0x1800b05b6
mov rax, qword [rcx + 0xc]
cmp rax, qword [0x1800ecbf8]
jne 0x1800b05b6
lea rax, [0x1800ebcd0]
mov dword [rbp - 0x20], edx
mov qword [rbp - 8], rax
lea r8, [rbp - 0x10]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x18], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x20]
and dword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rbp - 0x10], SQLSetEnvAttr
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1800b05a2
lea rcx, str.___CredentialBlob:
jmp 0x1800b0579
mov rcx, qword [rbx + 8]
lea rdx, str.AppSense_DataNow_
call fcn.1800c3cb0
test rax, rax
je 0x1800b05b6
lea rcx, str._Ivanti_FileDirector_credential_blob__n
call fcn.18000bdb4
cmp dword [rbx + 0x20], 0x14
jb 0x1800b05b6
mov rbx, qword [rbx + 0x28]
lea rcx, str.AppN_DN_Win
mov rdx, rbx
call fcn.1800e11e0
test eax, eax
jne 0x1800b05b6
cmp dword [rbx + 0xc], eax
je 0x1800b051e
lea rcx, str.Decrypting_additional_blob_n
call fcn.18000bdb4
mov eax, dword [rbx + 0xc]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], eax
xor r9d, r9d
lea rax, [rbx + 0x14]
xor r8d, r8d
mov qword [rbp - 0x18], rax
xor edx, edx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1800b050a
lea rcx, str.___CredentialBlob:
call fcn.18000bdb4
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.1800126d8
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.18000bdb4
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800b051e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
call fcn.18000bdb4
cmp dword [rbx + 0x10], 0
je 0x1800b05b6
lea rcx, str.Decrypting_additional_blob_n
call fcn.18000bdb4
mov eax, dword [rbx + 0x10]
lea rcx, [rbx + 0x14]
mov dword [rbp - 0x20], eax
xor r9d, r9d
mov eax, dword [rbx + 0xc]
xor r8d, r8d
add rcx, rax
xor edx, edx
lea rax, [rbp - 0x30]
mov qword [rbp - 0x18], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x20]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x1800b05a2
lea rcx, str.___UnkBlob_______:
call fcn.18000bdb4
mov edx, dword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.1800126d8
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.18000bdb4
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800b05b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_vault_cred_tryEncrypted___CryptUnprotectData__0x_08x__n
call fcn.18000bdb4
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800b889c
Capabilities:
Accept command line arguments

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, rdx
mov rbp, rcx
lea rdx, [r11 + 0x10]
mov rcx, qword [rax + 8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x1800b894b
mov eax, dword [rsp + 0x38]
test eax, eax
jle 0x1800b8934
xor ebx, ebx
test eax, eax
jle 0x1800b892b
mov rsi, rdi
mov rcx, qword [rsi]
lea rdx, str._HTC:
mov r8d, 5
call fcn.1800d3760
test eax, eax
je 0x1800b8904
inc ebx
add rsi, 8
cmp ebx, dword [rsp + 0x38]
jl 0x1800b88dd
jmp 0x1800b892b
movsxd rax, ebx
xor edx, edx
mov rcx, qword [rdi + rax*8]
lea r8d, [rdx + 0xa]
add rcx, 0xa
call fcn.1800caa28
mov edx, eax
mov rcx, rbp
mov ebx, eax
call fcn.1800b8974
test rbx, rbx
jne 0x1800b8940
lea rcx, str.__No_shared_memory__no_SSO_enabled___n
jmp 0x1800b893b
lea rcx, str.ERROR_Citrix_SSO_Program_args___No_command_module_
call fcn.18000bdb4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800b895f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_args___CommandLineToArgvW__0x_08x__n
call fcn.18000bdb4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800b8974
Capabilities:
Encode data using xor
Encrypt data using dpapi
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
lea r9, [rsp + 0x60]
mov dword [rsp + 0x30], esi
mov r8, rax
mov dword [rsp + 0x28], esi
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1800b8ac9
mov rcx, qword [rsp + 0x60]
lea edx, [rsi + 4]
xor r9d, r9d
mov qword [rsp + 0x20], 0x61c
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x1800b8aa8
mov edx, 0x610
lea ecx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1800b8a9d
mov rcx, rax
lea rdx, [rdi + 0xc]
mov r8d, 0x610
call fcn.1800c4b10
mov edx, 0x610
lea r8d, [rsi + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_SystemFunction041]
test eax, eax
jne 0x1800b8a86
mov r9d, dword [rbx + 0x400]
lea r10, [rbx + 0x404]
test r9d, r9d
je 0x1800b8a5f
mov rdx, r10
mov r8d, r9d
mov cl, byte [rdx]
mov al, cl
xor al, sil
mov sil, cl
xor al, 0x43
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x1800b8a41
mov r9d, dword [rbx + 0x400]
mov eax, dword [rbx + 0x604]
lea r8, [rbx + 0x200]
mov dword [rsp + 0x28], eax
lea rcx, str._Username__:__s_n_Domain____:__s_n_Password__:__.s_n_flags_type:_0x_08x_n
mov rdx, rbx
mov qword [rsp + 0x20], r10
call fcn.18000bdb4
jmp 0x1800b8a94
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___RtlDecryptMemory:_0x_08x_n
call fcn.18000bdb4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x1800b8abc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___MapViewOfFile__0x_08x__n
call fcn.18000bdb4
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800b8add
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_Citrix_SSO_Program_FileMapping___DuplicateHandle__0x_08x__n
call fcn.18000bdb4
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1800bf35c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x40
xor ebp, ebp
xor r9d, r9d
and qword [rax - 0x38], rbp
mov edx, 0x80000000
and dword [rax - 0x40], ebp
lea r8d, [rbp + 3]
mov dword [rax - 0x48], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1800bf4a0
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800bf481
mov r12d, 0x10000000
lea ecx, [rbp + 0x40]
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1800bf495
mov rax, qword [rsp + 0x80]
xor ecx, ecx
test rax, rax
jle 0x1800bf476
lea r14, [rcx + 0x10000000]
mov rbx, rax
sub rbx, rcx
mov rdx, rcx
cmp r14, rax
mov rcx, rsi
cmovl rbx, r12
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800bf44e
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800bf43f
mov edx, dword [rsp + 0x78]
mov rcx, rdi
call fcn.1800bf254
add ebp, eax
jmp 0x1800bf462
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___ReadFile__0x_08x__n
jmp 0x1800bf45b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___SetFilePointerEx__0x_08x__n
mov edx, eax
call fcn.18000bdb4
mov rax, qword [rsp + 0x80]
mov rcx, r14
cmp r14, rax
jl 0x1800bf3e7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800bf495
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___GetFileSizeEx__0x_08x__n
call fcn.18000bdb4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800bf4b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_sekurlsa_sk_search_file___CreateFile__0x_08x__n
call fcn.18000bdb4
mov rbx, qword [rsp + 0x70]
mov eax, ebp
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001680
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r12, rdx
mov r14, qword [rdx + 0x10]
lea rax, [r14 + 2]
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
mov rdi, rdx
mov r15, rcx
add rdi, rdx
and rdi, 0xfffffffffffffffc
mov qword [rcx], 0
movaps xmm0, xmmword [0x1400ae070]
movups xmmword [rcx + 0x10], xmm0
mov byte [rcx], 0
cmp rdi, 0xf
jbe 0x1400016dd
mov rcx, r15
mov rdx, rdi
xor r9d, r9d
call fcn.140006bb0
jmp 0x1400016f3
mov qword [r15 + 0x10], rdi
mov rcx, r15
xor edx, edx
mov r8, rdi
call fcn.140080c40
mov byte [r15 + rdi], 0
cmp qword [r15 + 0x18], 0xf
mov rax, r15
jbe 0x140001700
mov rax, qword [r15]
xor ecx, ecx
cmp r14, 3
jb 0x1400017dc
mov r8, r14
add r8, 0xfffffffffffffffe
je 0x1400017dc
xor ecx, ecx
lea rdx, [0x1400af070]
jmp 0x140001750
movzx ebx, byte [rbx + rcx + 2]
and ebx, 0x3f
movzx ebx, byte [rbx + rdx]
mov byte [rax + 3], bl
add rax, 4
add rcx, 3
cmp rcx, r8
jae 0x1400017dc
cmp qword [r12 + 0x18], 0xf
mov rsi, r12
jbe 0x14000175f
mov rsi, qword [r12]
movzx ebx, byte [rsi + rcx]
shr rbx, 2
movzx ebx, byte [rbx + rdx]
mov byte [rax], bl
cmp qword [r12 + 0x18], 0xf
mov rdi, r12
jbe 0x14000177c
mov rdi, qword [r12]
movzx ebx, byte [rdi + rcx]
shl ebx, 4
and ebx, 0x30
movzx edi, byte [rdi + rcx + 1]
shr rdi, 4
or rdi, rbx
movzx ebx, byte [rdx + rdi]
mov byte [rax + 1], bl
cmp qword [r12 + 0x18], 0xf
mov rbx, r12
jbe 0x1400017a8
mov rbx, qword [r12]
movzx edi, byte [rbx + rcx + 1]
and edi, 0xf
movzx ebx, byte [rbx + rcx + 2]
shr rbx, 6
lea rbx, [rbx + rdi*4]
movzx ebx, byte [rdx + rbx]
mov byte [rax + 2], bl
cmp qword [r12 + 0x18], 0xf
mov rbx, r12
jbe 0x140001730
mov rbx, qword [r12]
jmp 0x140001730
cmp rcx, r14
jae 0x14000186c
cmp qword [r12 + 0x18], 0xf
mov rdx, r12
jbe 0x1400017f4
mov rdx, qword [r12]
movzx edx, byte [rdx + rcx]
shr rdx, 2
lea r8, [0x1400af070]
mov dl, byte [rdx + r8]
mov byte [rax], dl
add r14, 0xffffffffffffffff
cmp qword [r12 + 0x18], 0xf
mov rdi, r12
jbe 0x14000181c
mov rdi, qword [r12]
movzx edx, byte [rdi + rcx]
shl edx, 4
and edx, 0x30
cmp rcx, r14
jne 0x140001836
mov cl, byte [rdx + r8]
mov byte [rax + 1], cl
mov cl, 0x3d
jmp 0x140001865
movzx ebx, byte [rdi + rcx + 1]
shr rbx, 4
movzx edx, dl
or rdx, rbx
mov dl, byte [rdx + r8]
mov byte [rax + 1], dl
cmp qword [r12 + 0x18], 0xf
jbe 0x140001858
mov r12, qword [r12]
movzx ecx, byte [r12 + rcx + 1]
and ecx, 0xf
mov cl, byte [r8 + rcx*4]
mov byte [rax + 2], cl
mov byte [rax + 3], 0x3d
mov rax, r15
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14000dbc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
mov rsi, r8
sub rsi, rdx
je 0x14000dbf8
movabs r11, 0xcbf29ce484222325
movabs r9, 0x100000001b3
mov rcx, rdx
not rcx
add rcx, r8
mov r8d, esi
and r8d, 3
cmp rcx, 3
jae 0x14000dbff
xor r10d, r10d
jmp 0x14000dc4c
mov eax, 0x84222325
jmp 0x14000dc77
and rsi, 0xfffffffffffffffc
xor r10d, r10d
nop word cs:[rax + rax]
movzx ecx, byte [rdx + r10]
xor rcx, r11
imul rcx, r9
movzx eax, byte [rdx + r10 + 1]
xor rax, rcx
imul rax, r9
movzx ecx, byte [rdx + r10 + 2]
xor rcx, rax
imul rcx, r9
movzx r11d, byte [rdx + r10 + 3]
xor r11, rcx
imul r11, r9
add r10, 4
cmp rsi, r10
jne 0x14000dc10
mov rax, r11
test r8, r8
je 0x14000dc77
add rdx, r10
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor rax, r11
imul rax, r9
add rcx, 1
mov r11, rax
cmp r8, rcx
jne 0x14000dc60
pop rsi
ret

Function at 0x140013d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov r12, rcx
mov r13, qword [rcx]
mov r15b, byte [r13]
test byte [rcx + 0xb9], 1
je 0x140013d62
mov rax, qword [r12 + 0xd0]
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
mov edx, r15d
call qword [rax + 0x20]
mov r15d, eax
mov r13, qword [r12]
mov r9, qword [r14 + 0x20]
test r9, r9
je 0x140013e05
mov r8, qword [r12 + 0xa0]
jmp 0x140013d89
mov r9, qword [r9 + 0x18]
test r9, r9
je 0x140013e05
mov edx, dword [r9 + 0xc]
test edx, edx
je 0x140013d80
mov ebx, dword [r9]
xor ebp, ebp
nop word cs:[rax + rax]
mov ebp, ebp
mov rsi, r13
test ebx, ebx
je 0x140013dda
mov rax, qword [r9 + 0x10]
add rax, rbp
xor edi, edi
nop word cs:[rax + rax]
nop dword [rax]
lea rsi, [rdi + 1]
cmp rsi, rbx
jae 0x140013dd7
movzx ecx, byte [rax + rdi]
cmp byte [r13 + rdi], cl
mov rdi, rsi
je 0x140013dc0
add rsi, r13
cmp rsi, r8
je 0x140013de7
add ebp, ebx
cmp ebp, edx
jb 0x140013da0
jmp 0x140013d80
cmp r8, r13
je 0x140013e05
test byte [r14 + 0xc], 1
mov r13, r8
jne 0x140013e8e
mov qword [r12], r13
mov al, 1
jmp 0x140013e90
add r13, 1
mov rbx, qword [r14 + 0x38]
test rbx, rbx
je 0x140013e5b
test byte [r12 + 0xb9], 8
mov eax, r15d
je 0x140013e30
mov rcx, qword [r12 + 0xd0]
mov edx, r15d
call fcn.140010cc0
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x140013e5b
mov rdx, qword [rbx + 8]
xor ebp, ebp
jmp 0x140013e47
add ebp, 2
cmp ebp, ecx
jae 0x140013e5b
mov ebx, ebp
cmp byte [rdx + rbx], al
ja 0x140013e40
lea ebx, [rbp + 1]
cmp byte [rdx + rbx], al
jb 0x140013e40
mov r8, r13
jmp 0x140013dec
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x140013ea1
movzx ecx, r15b
shr rcx, 3
movzx eax, byte [rax + rcx]
and r15b, 7
movzx ecx, r15b
bt eax, ecx
setb al
test byte [r14 + 0xc], 1
sete cl
xor cl, al
je 0x140013dfa
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test byte [r14 + 0xc], 1
je 0x140013e8e
jmp 0x140013dfa
Function at 0x14001fa00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rbx
mov rax, qword [0x1400e6fb0]
test rax, rax
jne 0x14001fabb
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov r11, qword [r8 + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov r10d, dword [r11 + rax + 0x88]
test r10, r10
je 0x14001fa23
mov edx, dword [r11 + r10 + 0x18]
lea r9, [r11 + 1]
jmp 0x14001fa5c
mov eax, 0x10d9ca2d
cmp eax, 0xf818c1fd
je 0x14001fa98
sub rdx, 1
jb 0x14001fa23
mov eax, dword [r11 + r10 + 0x20]
add rax, r11
mov ecx, dword [rax + rdx*4]
mov bl, byte [r11 + rcx]
test bl, bl
je 0x14001fa50
add rcx, r9
mov eax, 0x10d9ca2d
nop dword [rax]
movsx esi, bl
xor esi, eax
imul eax, esi, 0x1000193
movzx ebx, byte [rcx]
add rcx, 1
test bl, bl
jne 0x14001fa80
jmp 0x14001fa55
mov eax, dword [r11 + r10 + 0x1c]
mov ecx, dword [r11 + r10 + 0x24]
add rax, r11
add rcx, r11
mov edx, edx
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
add rax, r11
mov qword [0x1400e6fb0], rax
pop rbx
pop rsi
jmp rax