joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020ce50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x180
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x140418a10]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r14d, r9d
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
lea rax, vtable.Core::FileStream.0
mov qword [rcx], rax
mov ebp, 0x80
cmp r9d, 2
jne 0x14020ceb3
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
cmovne ebp, eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, dword [rsp + 0x1d0]
mov edx, esi
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x14020cf42
mov word [rbx + 8], 0
mov byte [rbx + 0xa], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rdx, [0x1404101d8]
lea rcx, [rsp + 0x40]
call fcn.1402c1558
int3
test esi, 0x80000000
setne al
mov byte [rbx + 8], al
mov edx, esi
shr edx, 0x1e
and dl, 1
mov byte [rbx + 9], dl
test esi, esi
setne dl
mov byte [rbx + 0xa], dl
cmp dword [rdi + 8], 0
jle 0x14020cf6f
mov rcx, qword [rdi]
call fcn.1402b9c20
mov rax, rbx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1402b9610
add rsp, 0x180
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14020d080
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
jne 0x14020d095
or eax, ecx
add rsp, 0x28
ret
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [rsp + 0x30]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14020d100
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x14020d132
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x14020d11f
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14020d11f
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14020d180
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x14020d1a4
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x14020d197
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov r8d, 1
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x14020d1db
cmp dword [rsp + 0x40], 0
je 0x14020d197
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14020d270
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov rbx, rcx
je 0x14020d2a2
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x60]
test al, al
je 0x14020d2a2
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14020d2b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x14020d2e2
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rcx]
call qword [rax + 0x10]
test al, al
jne 0x14020d2fe
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x10]
xor eax, eax
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x14020f150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rdx
mov rbx, rcx
mov eax, 0x204e
cmp word [rdx + 0x10], ax
jne 0x14020f1f3
mov rcx, qword [rdx + 8]
mov eax, dword [rcx + 0x10]
cmp eax, 0xfffffffe
jne 0x14020f1a1
lea rax, vtable.Core::EventArgs.0
mov qword [rsp + 0x58], rax
mov rax, qword [rbx]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [rax + 0x120]
nop
jmp 0x14020f1f3
cmp eax, 0xffffff9b
jne 0x14020f1f3
mov r8d, dword [rcx + 0x18]
cmp r8d, 0xffffffff
je 0x14020f1f3
mov r9, qword [rcx + 0x38]
mov eax, dword [rcx + 0x24]
shr eax, 1
and al, 1
mov edx, dword [rcx + 0x20]
shr edx, 1
and dl, 1
cmp al, dl
je 0x14020f1f3
lea rax, vtable.Core::Windows::Forms::ListViewItemSelectionChangedEventArgs.0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x38], r8d
mov byte [rsp + 0x3c], dl
mov rax, qword [rbx]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x128]
nop
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.1401fc460
Function at 0x14021c020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, edx
mov edi, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova edi, ecx
cmp edi, dword [rbx]
jne 0x14021c054
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x14042be00]
test rax, rax
je 0x14021c062
call rax
shl edi, 4
mov ecx, edi
call fcn.140217e70
mov rcx, qword [0x14042be08]
mov rdi, rax
test rcx, rcx
je 0x14021c07d
call rcx
test rdi, rdi
je 0x14021c047
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.1402181b0
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x14041c150]
xor edx, edx
mov rcx, rdi
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rbx], esi
shl r8, 4
call fcn.1402c22a0
mov rcx, qword [rbx + 8]
xor r11d, r11d
mov qword [rbx + 8], r11
test rcx, rcx
je 0x14021c197
mov qword [rsp + 0x30], rbp
lea rbp, [0x14032c1e0]
nop word [rax + rax]
mov r9d, dword [rcx + 0x20]
mov r10, qword [rcx + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x14021c112
movzx edx, byte [r10]
dec r9d
lea r10, [r10 + 1]
movzx r8d, byte [rdx + rbp]
lea edx, [rax*8]
xor r8d, edx
xor eax, r8d
test r9d, r9d
jg 0x14021c0f0
mov r9, qword [rcx]
xor edx, edx
div esi
mov r8d, edx
shl r8, 4
add r8, rdi
je 0x14021c16a
mov eax, dword [r8]
test eax, eax
je 0x14021c132
mov rdx, qword [r8 + 8]
jmp 0x14021c135
mov rdx, r11
inc eax
mov qword [r8 + 8], rcx
mov dword [r8], eax
test rdx, rdx
je 0x14021c16a
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x14021c160
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x14021c186
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x14021c186
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x14021c17e
mov qword [rax + 8], rcx
mov qword [rcx + 8], r11
mov qword [rbx + 8], rcx
mov rcx, r9
test r9, r9
jne 0x14021c0e0
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x14021c310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x20
mov rbp, r9
mov r9d, dword [rcx]
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
lea r12, [0x14032c1e0]
test r9d, r9d
je 0x14021c37a
xor eax, eax
mov r10, rdx
test r8d, r8d
jle 0x14021c370
nop dword [rax]
movzx ecx, byte [r10]
dec r8d
lea r10, [r10 + 1]
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x14021c350
xor edx, edx
div r9d
mov r15d, edx
jmp 0x14021c37d
xor r15d, r15d
mov r9d, r15d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.14021c1b0
mov rdx, rax
test rax, rax
je 0x14021c41a
mov rdi, qword [rax + 0x10]
test rbp, rbp
jne 0x14021c40a
mov rax, qword [rax + 8]
test rax, rax
je 0x14021c3b4
mov rcx, qword [rdx]
mov qword [rax], rcx
jmp 0x14021c3bb
mov rax, qword [rdx]
mov qword [rbx + 8], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x14021c3cb
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14021c3ed
mov ecx, r15d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], rdx
jne 0x14021c3eb
mov rax, qword [rdx]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, rdx
call fcn.1402181b0
dec dword [rbx + 4]
jne 0x14021c412
mov rcx, rbx
call fcn.14021bec0
mov rax, rdi
jmp 0x14021c4eb
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, rdi
jmp 0x14021c4eb
test rbp, rbp
jne 0x14021c426
xor eax, eax
jmp 0x14021c4eb
mov ecx, 0x28
mov qword [rsp + 0x40], r14
call fcn.140217e70
mov r14, rax
test rax, rax
jne 0x14021c445
mov rax, rbp
jmp 0x14021c4e6
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], edi
mov qword [rax + 0x10], rbp
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x14021c4a4
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x14021c4a4
add edx, edx
mov rcx, rbx
call fcn.14021c020
test eax, eax
je 0x14021c4a4
xor eax, eax
test edi, edi
jle 0x14021c49d
nop word [rax + rax]
movzx ecx, byte [rsi]
dec edi
lea rsi, [rsi + 1]
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test edi, edi
jg 0x14021c480
xor edx, edx
div dword [rbx]
mov r15d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14021c4c4
mov edx, r15d
mov r8, r14
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.14021bfb0
jmp 0x14021c4e4
mov rax, qword [rbx + 8]
mov qword [r14], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x14021c4d8
mov qword [rax + 8], r14
mov qword [r14 + 8], 0
mov qword [rbx + 8], r14
xor eax, eax
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x1402357b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r15, rcx
mov r14d, edx
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r12d, r9d
mov r8d, dword [r11 + 0x30]
mov r10, qword [rax + 8]
mov r13, qword [r11]
movsxd rax, dword [r10 + 0x30]
mov ecx, r8d
mov dword [rsp + 0x78], r8d
cmp eax, r8d
mov qword [rsp + 0x28], rax
cmovl ecx, eax
xor ebx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, rax
imul r14, rax
cmp eax, r8d
je 0x140235818
cmp byte [r13 + 0x12], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r14
sub rdi, rcx
test ebx, ebx
jne 0x14023593e
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x30], rsi
cmp rdi, r14
jge 0x140235920
mov rax, rdi
movsxd rbp, r8d
mov qword [rsp + 0x20], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x14041a154]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x140235915
lea r8, [rsp + 0x20]
xor r9d, r9d
mov edx, r10d
mov rcx, r13
call fcn.140226010
mov ebx, eax
test eax, eax
jne 0x140235901
mov rcx, qword [rsp + 0x20]
call fcn.1402267f0
mov ebx, eax
test eax, eax
jne 0x140235901
mov rax, qword [rsp + 0x20]
movsxd r8, dword [rsp + 0x70]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x28]
add rdx, qword [rsp + 0x80]
call fcn.1402b9d30
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x140235901
test r12d, r12d
jne 0x140235901
mov rax, qword [r15 + 0x28]
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0x3c]
mov eax, edx
mov byte [rsi + 0x1f], dl
shr eax, 0x18
mov byte [rsi + 0x1c], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0x1d], al
mov eax, edx
shr eax, 8
mov byte [rsi + 0x1e], al
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140235910
call fcn.140226380
mov r8d, dword [rsp + 0x78]
add rdi, rbp
test ebx, ebx
je 0x140235833
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x30]
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x14024b240
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r14
sub rsp, 0x30
mov r12d, r8d
mov r14, rdx
mov rbp, rcx
test rdx, rdx
jne 0x14024b264
xor eax, eax
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
mov edx, 0x10
mov qword [rsp + 0x58], rsi
call fcn.140218530
mov rsi, rax
test rax, rax
jne 0x14024b28a
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov dword [rax + 4], r15d
mov eax, dword [r14]
mov dword [rsi], eax
test r12b, 1
jne 0x14024b2b6
mov ecx, dword [r14]
mov eax, 1
cmp ecx, eax
jle 0x14024b2b6
nop dword [rax]
add eax, eax
cmp eax, ecx
jl 0x14024b2b0
lea edx, [rax + rax*4]
mov rcx, rbp
shl edx, 3
call fcn.140218530
mov qword [rsi + 8], rax
test rax, rax
jne 0x14024b2df
mov rdx, rsi
mov rcx, rbp
call fcn.140218260
xor eax, eax
jmp 0x14024b385
mov qword [rsp + 0x50], rbx
mov rbx, qword [r14 + 8]
cmp dword [r14], r15d
jle 0x14024b37d
mov qword [rsp + 0x60], rdi
lea rdi, [rax + 0x1c]
sub rax, rbx
mov qword [rsp + 0x28], r13
lea r13, [rax - 0x10]
nop word [rax + rax]
mov rdx, qword [rbx]
xor r9d, r9d
mov r8d, r12d
mov rcx, rbp
call fcn.14024aec0
mov rcx, rbp
mov qword [r13 + rbx + 0x10], rax
mov rdx, qword [rbx + 8]
call fcn.1402186a0
mov rcx, rbp
mov qword [rdi - 0x14], rax
mov rdx, qword [rbx + 0x10]
call fcn.1402186a0
inc r15d
lea rdi, [rdi + 0x28]
mov qword [rdi - 0x34], rax
movzx eax, byte [rbx + 0x18]
and dword [rdi - 0x28], 0xfffffffe
mov byte [rdi - 0x2c], al
mov ecx, dword [rbx + 0x1c]
lea rbx, [rbx + 0x28]
xor ecx, dword [rdi - 0x28]
and ecx, 2
xor dword [rdi - 0x28], ecx
mov eax, dword [rbx - 8]
mov dword [rdi - 0x24], eax
cmp r15d, dword [r14]
jl 0x14024b310
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
Function at 0x14024d270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
mov ebx, r9d
mov esi, r8d
mov r11, rdx
mov rdi, rcx
xor r10d, r10d
lea rax, [rcx + 0x88]
nop
cmp dword [rax + 0xc], 0
jle 0x14024d2b3
cmp dword [rax], ebx
jne 0x14024d2b3
movsx edx, word [rax + 4]
cmp edx, r8d
je 0x14024d301
inc r10d
add rax, 0x14
cmp r10d, 0xa
jl 0x14024d2a0
mov r9d, r8d
mov qword [rsp + 0x40], rbp
mov ebp, dword [rsp + 0x60]
mov r8d, ebx
mov rdx, r11
mov rcx, r14
mov dword [rsp + 0x20], ebp
call fcn.14024d190
movzx r8d, byte [rsp + 0x68]
test r8b, r8b
je 0x14024d31a
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x14024d32a
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r8b
jmp 0x14024d32a
mov ecx, dword [rcx + 0x78]
mov dword [rax + 0x10], ecx
inc dword [rdi + 0x78]
mov edx, dword [rax + 0xc]
mov rcx, rdi
call fcn.14024d0f0
mov eax, dword [rax + 0xc]
jmp 0x14024d331
mov r9d, ebp
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call fcn.14024cec0
mov eax, ebp
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14024f700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14024f889
test rdx, rdx
je 0x14024f889
mov r9d, dword [rdx + 4]
mov r11d, dword [rcx + 4]
mov qword [rsp + 0x30], rsi
mov esi, r9d
or esi, r11d
bt esi, 0xa
jae 0x14024f774
and r9d, r11d
bt r9d, 0xa
jae 0x14024f87f
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x14024f87f
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x14024f7bc
cmp r8b, 0x5f
jne 0x14024f794
mov rcx, qword [rcx + 0x10]
mov r8d, ebp
call fcn.14024f700
cmp eax, 2
jl 0x14024f7b5
cmp byte [rbx], 0x5f
jne 0x14024f87f
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, rdi
call fcn.14024f700
cmp eax, 2
jge 0x14024f87f
mov eax, 1
jmp 0x14024f75f
lea eax, [r8 + 0x66]
test al, 0xfd
je 0x14024f7fc
mov rax, qword [rcx + 8]
test rax, rax
je 0x14024f7fc
mov r10, qword [rdx + 8]
sub r10, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x14024f7e7
inc rax
test ecx, ecx
jne 0x14024f7d4
test edx, edx
je 0x14024f7fc
xor ecx, ecx
cmp r8b, 0x5f
setne cl
lea eax, [rcx + 1]
jmp 0x14024f75f
xor r9d, r11d
test r9b, 0x10
jne 0x14024f87f
bt esi, 0xe
jb 0x14024f75d
bt esi, 0xb
jb 0x14024f87f
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
mov r8d, ebp
call fcn.14024f700
test eax, eax
jne 0x14024f87f
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
mov r8d, ebp
call fcn.14024f700
test eax, eax
jne 0x14024f87f
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
mov r8d, ebp
call fcn.14024f8b0
test eax, eax
jne 0x14024f87f
bt esi, 0xd
jb 0x14024f75d
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x14024f87f
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x14024f75d
cmp ecx, ebp
jne 0x14024f87f
test eax, eax
js 0x14024f75d
mov eax, 2
jmp 0x14024f75f
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
xor ecx, ecx
cmp rdx, rdi
mov eax, 2
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140254640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r10d, r10d
mov rsi, r8
mov rbp, rdx
mov r15, rcx
mov rdi, rdx
test rdx, rdx
jne 0x140254671
mov edi, r10d
jmp 0x140254686
cmp byte [rdx], r10b
je 0x14025467e
inc rdi
cmp byte [rdi], r10b
jne 0x140254676
sub edi, edx
and edi, 0x3fffffff
mov r14d, dword [rcx + 0x28]
mov ebx, r10d
test r14d, r14d
jle 0x140254758
mov qword [rsp + 0x40], r12
lea r12, [0x14032c1e0]
mov r9d, ebx
cmp ebx, 2
jge 0x1402546ae
xor r9d, 1
test rsi, rsi
je 0x140254705
mov rcx, qword [r15 + 0x20]
movsxd rdx, r9d
mov rax, rsi
shl rdx, 5
mov r8, qword [rdx + rcx]
movzx edx, byte [rsi]
test dl, dl
je 0x1402546f0
nop dword [rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r12]
cmp byte [rdx + r12], cl
jne 0x1402546f0
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x1402546d0
movzx ecx, byte [r8]
movzx edx, byte [rcx + r12]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r12]
cmp eax, edx
jne 0x14025472c
mov rax, qword [r15 + 0x20]
movsxd rcx, r9d
mov r8d, edi
shl rcx, 5
mov rdx, rbp
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.14021c280
mov r10, rax
test rax, rax
jne 0x14025473a
inc ebx
cmp ebx, r14d
jl 0x1402546a2
mov rax, r10
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov rax, r10
jmp 0x14025473f

Function at 0x1402548b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r9d, r9d
mov rsi, r8
mov rbp, rdx
mov rdi, rdx
test rdx, rdx
jne 0x1402548d8
mov edi, r9d
jmp 0x1402548f0
cmp byte [rdx], r9b
je 0x1402548e8
nop dword [rax]
inc rdi
cmp byte [rdi], r9b
jne 0x1402548e0
sub edi, edx
and edi, 0x3fffffff
mov r14d, dword [rcx + 0x28]
mov ebx, r9d
test r14d, r14d
jle 0x1402549b3
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r15
mov r15, qword [rcx + 0x20]
lea r12, [0x14032c1e0]
mov eax, ebx
cmp ebx, 2
jge 0x14025491f
xor eax, 1
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r15 + 0x18]
test rsi, rsi
je 0x140254975
movzx edx, byte [rsi]
mov r8, qword [r8 + r15]
mov rax, rsi
test dl, dl
je 0x140254960
nop
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r12]
cmp byte [rdx + r12], cl
jne 0x140254960
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x140254940
movzx ecx, byte [r8]
movzx edx, byte [rcx + r12]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r12]
cmp eax, edx
jne 0x14025498c
lea rcx, [r10 + 0x20]
mov r8d, edi
mov rdx, rbp
call fcn.14021c280
mov r9, rax
test rax, rax
jne 0x140254996
inc ebx
cmp ebx, r14d
jl 0x140254915
mov rax, r9
mov r12, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x1402549a0
Function at 0x14025d760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rdi, qword [rsp + 0xa8]
mov rax, qword [rdx + 0x18]
mov r14, qword [rcx + 0x10]
mov r12d, r9d
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x88], rax
test rdi, rdi
je 0x14025d7d9
cmp qword [rdx + 0x48], 0
je 0x14025d7d3
mov rcx, r14
call fcn.140237f30
mov r9d, 8
mov rcx, rbx
mov dword [rdi], eax
mov dword [rbx + 0x70], esi
mov r8d, dword [rdi]
mov rdx, qword [rbp + 0x48]
call fcn.14024f2a0
jmp 0x14025d7d9
mov dword [rdi], 0
cmp dword [rsp + 0xa0], 0
je 0x14025d7f0
test byte [rbp + 0x64], 8
je 0x14025d7f0
movzx r13d, word [rbp + 0x5e]
jmp 0x14025d7f5
movzx r13d, word [rbp + 0x60]
mov ecx, dword [rbx + 0x48]
mov esi, dword [rbx + 0x4c]
mov dword [rsp + 0xa0], esi
cmp r13d, ecx
jg 0x14025d816
lea eax, [rsi + r13]
sub ecx, r13d
mov dword [rbx + 0x4c], eax
mov dword [rbx + 0x48], ecx
jmp 0x14025d829
mov eax, dword [rbx + 0x58]
lea esi, [rax + 1]
add eax, r13d
mov dword [rsp + 0xa0], esi
mov dword [rbx + 0x58], eax
mov r15, qword [rsp + 0xb0]
test r15, r15
je 0x14025d849
cmp esi, dword [rsp + 0xb8]
jne 0x14025d846
cmp qword [r15 + 0x48], 0
je 0x14025d849
xor r15d, r15d
xor edi, edi
movsxd rax, r13d
test r13d, r13d
jle 0x14025d8ef
mov ebx, dword [rsp + 0x90]
mov r12d, esi
mov rsi, qword [rsp + 0x88]
nop dword [rax]
test r15, r15
je 0x14025d887
mov rax, qword [rbp + 8]
mov rdx, qword [r15 + 8]
movzx ecx, word [rax + rdi*2]
cmp word [rdx + rdi*2], cx
je 0x14025d8ca
mov rax, qword [rbp + 8]
mov r8d, ebx
mov rdx, rsi
movsx r9d, word [rax + rdi*2]
mov rcx, r14
mov dword [rsp + 0x20], r12d
call fcn.14024d190
movsxd rcx, dword [r14 + 0x3c]
mov rax, qword [r14 + 0x30]
lea edx, [rcx - 1]
cmp edx, dword [rax + 0x68]
jle 0x14025d8ca
mov rax, qword [r14 + 8]
lea rcx, [rcx + rcx*2]
cmp byte [rax + rcx*8 - 0x18], 0x27
jne 0x14025d8ca
mov rcx, r14
call fcn.140238460
inc rdi
movsxd rax, r13d
inc r12d
cmp rdi, rax
jl 0x14025d870
mov rbx, qword [rsp + 0x80]
mov esi, dword [rsp + 0xa0]
mov r12d, dword [rsp + 0x98]
test r12d, r12d
je 0x14025d90c
mov r9d, r13d
mov r8d, esi
mov edx, 0x30
mov rcx, r14
mov dword [rsp + 0x20], r12d
call fcn.140237cb0
lea r9d, [r13 - 1]
lea rcx, [rbx + 0x94]
mov r8d, 0xa
add r9d, esi
xor r10d, r10d
mov edx, dword [rcx]
cmp edx, esi
jl 0x14025d94d
cmp edx, r9d
jg 0x14025d94d
cmp byte [rcx - 6], r10b
je 0x14025d94a
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x14025d946
movzx eax, al
mov dword [rbx + rax*4 + 0x28], edx
inc byte [rbx + 0x1f]
mov byte [rcx - 6], r10b
mov dword [rcx], r10d
add rcx, 0x14
dec r8
jne 0x14025d923
mov eax, esi
cmp r13d, dword [rbx + 0x48]
jle 0x14025d965
mov dword [rbx + 0x48], r13d
mov dword [rbx + 0x4c], esi
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140262740
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x14026275f
cmp byte [rdx], 0
je 0x140262758
inc rax
cmp byte [rax], 0
jne 0x140262750
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x70]
mov r8d, eax
add rcx, 0x50
jmp fcn.14021c280