joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035540
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
mov r8, rcx
je 0x1400356b1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14003567f
movdqa xmm2, xmmword [0x14011e170]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14011e6c0]
sub r9, rcx
movdqa xmm5, xmmword [0x14011e1e0]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140035593
cmp rax, 0x11
jae 0x1400356ac
movabs r9, 0x49edfd3f89812fa5
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x11
jb 0x140035690
mov byte [r8 + 0x11], 0
ret

Function at 0x1400356c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
mov r8, rcx
je 0x1400357f1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400357bd
movzx eax, word [rcx]
movdqa xmm4, xmmword [0x14011e6c0]
movdqa xmm2, xmmword [0x14011e1e0]
movdqa xmm3, xmmword [0x14011e170]
movdqa xmm0, xmm3
psllq xmm3, 3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_bind]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm4, xmm3
pshufb xmm1, xmm2
mov word [rcx + 6], ax
movzx eax, word [rcx + 8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 8], ax
mov byte [rcx + 0xa], 0
ret
movabs r9, 0x49edfd3f89812fa5
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xa
jb 0x1400357d0
mov byte [r8 + 0xa], 0
ret
Function at 0x140035800
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
mov r8, rcx
je 0x140035971
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14003593f
movdqa xmm2, xmmword [0x14011e170]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14011ec80]
sub r9, rcx
movdqa xmm5, xmmword [0x14011e1e0]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140035853
cmp rax, 0x13
jae 0x14003596c
movabs r9, 0xe7bf2d95a54b2d63
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x13
jb 0x140035950
mov byte [r8 + 0x13], 0
ret

Function at 0x140035980
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
mov r8, rcx
je 0x140035ab1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140035a7d
movzx eax, word [rcx]
movdqa xmm4, xmmword [0x14011ec80]
movdqa xmm2, xmmword [0x14011e1e0]
movdqa xmm3, xmmword [0x14011e170]
movdqa xmm0, xmm3
psllq xmm3, 3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_bind]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm4, xmm3
pshufb xmm1, xmm2
mov word [rcx + 6], ax
movzx eax, word [rcx + 8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 8], ax
mov byte [rcx + 0xa], 0
ret
movabs r9, 0xe7bf2d95a54b2d63
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xa
jb 0x140035a90
mov byte [r8 + 0xa], 0
ret
Function at 0x140035ac0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x29], 0
mov r8, rcx
je 0x140035c31
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140035bff
movdqa xmm2, xmmword [0x14011e170]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14011eba0]
sub r9, rcx
movdqa xmm5, xmmword [0x14011e1e0]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x140035b13
cmp rax, 0x29
jae 0x140035c2c
movabs r9, 0xd517ab779d7d13e5
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x29
jb 0x140035c10
mov byte [r8 + 0x29], 0
ret
Function at 0x140035c40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
mov r8, rcx
je 0x140035db1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140035d7f
movdqa xmm2, xmmword [0x14011e170]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14011e860]
sub r9, rcx
movdqa xmm5, xmmword [0x14011e1e0]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x20
jb 0x140035c93
cmp rax, 0x25
jae 0x140035dac
movabs r9, 0x810979618f4359cd
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x25
jb 0x140035d90
mov byte [r8 + 0x25], 0
ret
Function at 0x140035dc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
mov r8, rcx
je 0x140035f31
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x140035eff
movdqa xmm2, xmmword [0x14011e170]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14011ec50]
sub r9, rcx
movdqa xmm5, xmmword [0x14011e1e0]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140035e13
cmp rax, 0x1a
jae 0x140035f2c
movabs r9, 0xe3912dfd25097b7b
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x1a
jb 0x140035f10
mov byte [r8 + 0x1a], 0
ret
Function at 0x140035f40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
mov r8, rcx
je 0x1400360b1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x14003607f
movdqa xmm2, xmmword [0x14011e170]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [reloc.WS2_32.dll_getsockopt]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x14011ecd0]
sub r9, rcx
movdqa xmm5, xmmword [0x14011e1e0]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140035f93
cmp rax, 0x19
jae 0x1400360ac
movabs r9, 0xf14339ed95ff2fcf
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jb 0x140036090
mov byte [r8 + 0x19], 0
ret

Function at 0x1400360c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
mov r8, rcx
je 0x1400361f1
xor eax, eax
cmp dword [reloc.WS2_32.dll_accept], 5
jl 0x1400361bd
movzx eax, word [rcx]
movdqa xmm4, xmmword [0x14011ecd0]
movdqa xmm2, xmmword [0x14011e1e0]
movdqa xmm3, xmmword [0x14011e170]
movdqa xmm0, xmm3
psllq xmm3, 3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_bind]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
mov word [rcx], ax
movzx eax, word [rcx + 2]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_connect]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
mov word [rcx + 2], ax
movzx eax, word [rcx + 4]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmmword [reloc.WS2_32.dll_getsockname]
movd eax, xmm1
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
mov word [rcx + 4], ax
movzx eax, word [rcx + 6]
pshufb xmm1, xmm2
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
vpsrlvq xmm1, xmm4, xmm3
pshufb xmm1, xmm2
mov word [rcx + 6], ax
movzx eax, word [rcx + 8]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 8], ax
mov byte [rcx + 0xa], 0
ret
movabs r9, 0xf14339ed95ff2fcf
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0xa
jb 0x1400361d0
mov byte [r8 + 0xa], 0
ret
Function at 0x1400485c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2d8]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.140037820
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x140048616
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x14004866d
mov ebp, 0x4b0000
jmp 0x14004867b
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.140039c60
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x140048691
mov eax, r12d
jmp 0x14004869a
mov edx, edi
mov ecx, ebp
call fcn.140039c60
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x1400486b6
shl esi, 0x10
mov ecx, esi
jmp 0x1400487a5
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x140048714
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.140037820
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x140048704
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.140039a50
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.140037820
add ebx, eax
jmp 0x1400487ae
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x140048721
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x140048760
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.140037820
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x140048765
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.140039a50
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.140037820
add ebx, eax
jmp 0x1400487ae
cmp eax, r12d
jge 0x14004879e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.140037820
sub ebp, eax
sub r15d, esi
je 0x14004879e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.140039a50
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.140037820
add ebx, eax
jmp 0x1400487ae
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.140037820
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
call fcn.140037820
mov r15, qword [rsp + 0x30]
add eax, 0x8000
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
shr eax, 0x10
cwde
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
Function at 0x140081190
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r14d, r14d
sub rax, 0x34
mov qword [rcx + 0x78], r14
mov qword [rcx + 0x28], rax
mov ebp, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r14w
mov esi, r14d
mov dword [rcx + 0x3c], r14d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r14w
cmp r14w, word [rcx + 0xb8]
jge 0x1400812db
movzx r10d, r14w
mov edi, r14d
mov rax, qword [rbx + 0xd0]
mov r9d, ebp
mov dword [rbx + 0x88], r14d
movzx edx, r10w
mov qword [rbx + 0x80], r14
mov rcx, rbx
movzx r8d, word [rdi + rax]
call fcn.140081650
test al, al
jne 0x140081376
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
movzx r10d, word [rdi + rax]
lea eax, [r8 - 1]
test edx, eax
jne 0x14008126b
cmp edx, dword [rbx + 0x60]
jl 0x14008126b
cmp edx, dword [rbx + 0x64]
jg 0x14008126b
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14008126b
mov rax, qword [rbx + 0x70]
movzx ecx, byte [rcx + 0x18]
xor cl, byte [rax + 0x18]
test cl, 8
jne 0x14008126b
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x14008128e
test byte [r9 + 0x18], 8
je 0x14008128e
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x14008129f
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.140082010
test al, al
jne 0x140081376
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x1400812c2
mov qword [r9 + 0x28], rax
movsx eax, word [rbx + 0xb8]
inc esi
add rdi, 2
inc r10w
cmp esi, eax
jl 0x1400811f4
movzx edi, word [rbx + 0x68]
mov rdx, qword [rbx + 0x78]
cmp di, 1
jbe 0x14008137a
test rdx, rdx
je 0x14008137a
mov ebp, 0xffff
nop dword [rax + rax]
lea rsi, [rdx + 8]
cmp di, 1
jbe 0x140081318
movsxd rcx, dword [rdx + 0x1c]
mov rax, qword [rdx + 0x10]
lea r10, [rax + rcx*4]
jmp 0x14008131b
mov r10, r14
mov qword [rsi], r10
test byte [rdx + 0x18], 8
mov r11d, dword [rdx + 0x20]
mov r8d, r11d
mov eax, dword [rdx + 0x1c]
je 0x140081336
dec r11d
add r11d, eax
jmp 0x14008134d
sub r8d, eax
inc r8d
dec eax
mov dword [rdx + 0x20], r8d
movsxd rcx, eax
shl rcx, 2
add qword [rdx + 0x10], rcx
mov edx, r8d
mov rcx, rbx
call fcn.1400822d0
test al, al
jne 0x140081376
lea edx, [r11 + 1]
mov rcx, rbx
call fcn.1400822d0
test al, al
jne 0x140081376
mov rdx, qword [rsi]
add di, bp
jne 0x140081300
jmp 0x14008137e
mov al, 1
jmp 0x140081389
mov qword [rbx + 0x78], r14
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14009c360
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x1400ae540
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1400ae59e
mov dl, 1
call fcn.14009e660
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.14009e660
mov eax, ebx
jmp 0x1400ae5e2
cmp ebx, 2
ja 0x1400ae5e0
mov r9, qword [rdi + 0x668]
lea rdx, [0x14010d078]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400ae600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x140135080]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x1400ae643
cmp qword [rcx + 0x678], 0
je 0x1400ae720
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.14009c760
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400ae671
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x1400ae6b8
cmp byte [rdi + 0x1597], 0
jne 0x1400ae6b8
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400ae6a0
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x1400ae718
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x1400ae773
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x1400ae739
mov dl, 1
mov rcx, rdi
call fcn.14009e660
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.14009e660
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e6df0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x14010d078]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400ae718
call fcn.1400e7494
int3