joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003aa4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003aee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003aee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003aee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003aee
cmp dword [rcx + 0x84], 0xe
jbe 0x140003aee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003af0
xor al, al
add rsp, 0x28
ret

Function at 0x14000cfc0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000ce2b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ce2b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ce2b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ce2b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ce2b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ce2b
cmp dword [rcx + 0xf8], 0
je 0x14000ce2b
mov ecx, ebx
call fcn.14000cedc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000ccb8
nop
cmp dword [rbp + 0x20], 0
je 0x14000ce79
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ce84
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000cdbc
Function at 0x140012ab4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140012b3b
mov rsi, rbx
cmp word [rax], bp
je 0x140012afa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140012ae4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140012ae0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000f464
mov rdi, rax
test rax, rax
je 0x140012b28
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001a2c0
mov rbp, rdi
xor ecx, ecx
call fcn.14000e830
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016df8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140016e0e
mov al, 1
jmp 0x140016e6e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140016e1f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140016e6c
mov ecx, dword [rcx + 0x18]
nop
call fcn.140013258
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140016e6c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140016e6c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140016e6c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140016e6e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140019a80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140019aa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140019aa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000dce8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov dl, byte [rcx + 0x91]
mov rbp, rcx
mov r15b, byte [rcx + 0x92]
mov al, dl
and al, 0xc
mov r8d, 4
neg al
mov al, dl
sbb bl, bl
sar al, 7
and al, 0x44
lea r11d, [r8 - 3]
and bl, r8b
or bl, al
mov eax, dword [rcx + 0x3c4]
neg eax
mov al, byte [rbp + 0x380]
sbb cl, cl
and al, r11b
and cl, 0x25
shl al, 4
or bl, cl
and dl, 3
or bl, al
or bl, dl
cmp r15b, bl
je 0x14000df70
mov al, bl
mov byte [rbp + 0x92], bl
and al, 0x30
lea rsi, [rbp + 0xf80]
lea r14, section..text
cmp al, 0x10
jne 0x14000ddb3
movzx eax, word [0x1400a25fe]
movzx ecx, word [0x1400a2604]
add rax, r14
movzx edx, word [0x1400a25ec]
add rcx, r14
movzx edi, word [0x1400a260a]
add rdx, r14
movzx r9d, word [0x1400a2612]
add rdi, r14
movzx r10d, word [0x1400a2618]
jmp 0x14000dddf
mov rax, qword [rsi + 0x750]
lea rdx, [0x140002529]
mov rcx, qword [rsi + 0x768]
mov rdi, qword [rsi + 0x780]
movzx r9d, word [0x1400a2614]
movzx r10d, word [0x1400a261a]
lea r13, [r9 + r14]
mov qword [rsi + 0x748], rax
lea r12, [r10 + r14]
mov qword [rsi + 0x760], rcx
mov r14b, bl
mov qword [rsi + 0x700], rdx
mov r9b, bl
mov qword [rsi + 0x778], rdi
xor r14b, r15b
and r9b, r8b
test r14b, 0x64
je 0x14000de92
test r9b, r9b
jne 0x14000de60
lea rdx, [rsi + 0x4d0]
mov r8d, 0x2c8
mov rcx, rsi
call fcn.14005ddf0
mov r11d, 1
test bl, 2
je 0x14000deea
lea rax, [0x1400049f4]
movq xmm0, rax
movlhps xmm0, xmm0
movups xmmword [rsi + 0x248], xmm0
movups xmmword [rsi + 0x258], xmm0
jmp 0x14000deea
test bl, 0x20
lea rdx, [0x1400049d9]
mov cl, bl
lea rax, [0x140004a01]
cmovne rax, rdx
mov rdi, rsi
and cl, 0x40
lea rdx, [0x140004b95]
mov ecx, 0x59
cmovne rax, rdx
rep stosq qword [rdi], rax
jmp 0x14000deea
test r9b, r9b
jne 0x14000deea
mov qword [rsi + 0x290], rcx
lea rcx, [rsi + 0x248]
mov qword [rsi + 0x278], rax
mov qword [rsi + 0x230], rdx
mov qword [rsi + 0x2a8], rdi
test bl, 2
je 0x14000ded7
lea rax, [0x1400049f4]
movq xmm0, rax
movlhps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
jmp 0x14000deea
mov rax, qword [rcx + 0x4d0]
mov qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, r11
jne 0x14000ded7
test r11b, r14b
je 0x14000df32
lea rdi, [rsi + 0x2c8]
mov ecx, 0x41
test r11b, bl
jne 0x14000df26
lea rdx, [0x1400a2612]
lea r8, section..text
movzx eax, word [rdx]
lea rdx, [rdx + 2]
add rax, r8
mov qword [rdi], rax
lea rdi, [rdi + 8]
sub rcx, r11
jne 0x14000df0e
jmp 0x14000df37
lea rax, [0x140004a97]
rep stosq qword [rdi], rax
jmp 0x14000df45
test r11b, bl
jne 0x14000df45
mov qword [rsi + 0x2c8], r13
mov qword [rsi + 0x2e0], r12
test bl, 0x10
je 0x14000df70
test r15b, 0x10
jne 0x14000df70
movzx eax, word [rbp + 0x950]
lea rdi, [rbp + 0xf00]
add ax, ax
mov ecx, 0x40
sub ax, r11w
movzx eax, ax
rep stosw word [rdi], ax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400100d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rdx
mov r14, r9
sub rdx, rcx
mov esi, r8d
sub rdx, 0x68
mov rbx, rcx
sar rdx, 2
call fcn.14000f4c8
test rax, rax
jne 0x14001018f
lea rbp, [rbx + 0x68]
lea r15d, [rax + 1]
sub rdi, 4
cmp rdi, rbp
jbe 0x140010157
mov r8d, dword [rdi]
mov eax, r8d
movzx ecx, r8b
shr eax, 8
movzx r9d, al
lea rax, [0x1400a2420]
movzx eax, word [rax + rcx*2]
and ax, 7
cmp ax, 2
jne 0x14001015b
cmp esi, r9d
jb 0x140010115
cmp ecx, 0x2c
jne 0x140010157
shr r8d, 0x10
cmp esi, r8d
ja 0x140010115
xor eax, eax
jmp 0x140010199
cmp ax, r15w
jne 0x140010115
cmp r9d, esi
jne 0x140010115
cmp ecx, 0x12
jne 0x1400101b2
mov esi, r8d
mov rdx, rdi
sub rdx, rbx
shr esi, 0x10
sub rdx, 0x68
mov r8d, esi
sar rdx, 2
mov rcx, rbx
call fcn.14000f4c8
test rax, rax
je 0x140010115
mov qword [r14], rax
lea rax, str.local
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
cmp ecx, 0x2d
je 0x140010243
cmp ecx, 0x36
je 0x14001021e
cmp ecx, 0x39
jne 0x140010157
mov eax, r8d
shr rax, 0x10
movzx ecx, al
mov rax, qword [rbx + 0x20]
not rcx
mov rdx, qword [rax + rcx*8]
add rdx, 0x18
mov qword [r14], rdx
cmp byte [rdi - 4], 0x12
jne 0x140010212
mov eax, dword [rdi - 4]
shr eax, 8
movzx ecx, al
lea eax, [r9 + 2]
cmp ecx, eax
jne 0x140010212
shr r8d, 8
xor r8d, dword [rdi - 4]
test r8d, 0xffff0000
jne 0x140010212
lea rax, str.method
jmp 0x140010199
lea rax, str.field
jmp 0x140010199
mov rax, qword [rbx + 0x20]
mov rcx, r8
shr rcx, 0x10
not rcx
mov rcx, qword [rax + rcx*8]
lea rax, str.global
add rcx, 0x18
mov qword [r14], rcx
jmp 0x140010199
mov rcx, qword [rbx + 0x58]
shr r8d, 0x10
test rcx, rcx
jne 0x140010259
lea rcx, [0x1400a17f6]
jmp 0x14001026d
test r8d, r8d
je 0x14001026d
mov al, byte [rcx]
add rcx, r15
test al, al
jne 0x14001025e
add r8d, 0xffffffff
jne 0x14001025e
mov qword [r14], rcx
lea rax, str.upvalue
jmp 0x140010199

Function at 0x140011d3c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ebp, r9d
shr rcx, 0x20
mov rsi, r8
xor ecx, edx
mov edi, edx
rol ecx, 4
call fcn.14007b028
mov r10d, eax
cmp ebp, 0xc
jbe 0x140011dd0
lea r8, [rsi - 0xc]
add r8, rbp
mov rdx, r8
add r10d, dword [rdx + 4]
add edi, dword [rdx + 8]
mov ecx, r10d
add ebx, dword [rdx]
xor edi, r10d
rol ecx, 0xe
mov rdx, rsi
sub edi, ecx
add rsi, 0xc
xor ebx, edi
mov eax, edi
rol eax, 0xb
sub ebx, eax
xor r10d, ebx
mov ecx, ebx
ror ecx, 7
sub r10d, ecx
cmp rdx, r8
jb 0x140011d7b
mov eax, r10d
mov ecx, r10d
rol eax, 0x10
xor ecx, edi
sub ecx, eax
xor ebx, ecx
mov eax, ecx
rol eax, 4
sub ebx, eax
mov eax, ebx
xor r10d, ebx
rol eax, 0xe
sub r10d, eax
mov rbx, qword [rsp + 0x30]
mov eax, r10d
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400173d4
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1400bee78]
mov rbx, rcx
test rax, rax
jne 0x140017420
xor r8d, r8d
lea rcx, str.advapi32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
je 0x14001748b
lea rdx, str.SystemFunction036
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400bee78], rax
test rax, rax
je 0x14001748b
mov edx, 0x20
mov rcx, rbx
call rax
test al, al
je 0x14001748b
mov rax, qword [rbx]
cmp rax, 2
jae 0x14001743e
add rax, 2
mov qword [rbx], rax
mov rax, qword [rbx + 8]
cmp rax, 0x40
jae 0x140017450
add rax, 0x40
mov qword [rbx + 8], rax
mov rax, qword [rbx + 0x10]
cmp rax, 0x200
jae 0x140017466
add rax, 0x200
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x18]
cmp rax, 0x20000
jae 0x14001747c
add rax, 0x20000
mov qword [rbx + 0x18], rax
mov rcx, rbx
call fcn.140017494
mov eax, 1
jmp 0x14001748d
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14001ac24
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x48], 0
mov rbx, rcx
jne 0x14001ac8b
xor r8d, r8d
lea rcx, str.winmm.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x14001ac8b
lea rdx, str.timeBeginPeriod
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x48]
lea rdx, str.timeEndPeriod
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbx + 0x50], 0
mov qword [rbx + 0x58], rax
je 0x14001ac84
test rax, rax
jne 0x14001ac8b
and qword [rbx + 0x48], 0
jmp 0x14001acc2
lea rcx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
and qword [rsp + 0x28], 0
lea r8, [0x14001ab5c]
and dword [rsp + 0x20], 0
mov r9, rbx
and dword [rbx + 0x90], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x88], rax
add rsp, 0x30
pop rbx
ret

Function at 0x140027240
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov ebx, 0x200
mov edx, ebx
mov rdi, rcx
call fcn.1400231d8
mov r9, r14
mov r8d, ebx
mov edx, 1
mov rcx, rax
mov rbp, rax
call fcn.14007ab20
mov rsi, rax
cmp eax, ebx
jne 0x1400272b8
lea ecx, [rbx + rbx]
mov ebx, ecx
mov edx, ecx
mov rcx, rdi
call fcn.1400231d8
mov r8d, ebx
mov ecx, esi
sub r8d, esi
add rcx, rax
mov r9, r14
mov edx, 1
mov rbp, rax
call fcn.14007ab20
add esi, eax
cmp esi, ebx
je 0x140027288
mov rbx, qword [rdi + 0x28]
mov rdx, rbp
mov r8d, esi
mov rcx, rdi
lea rax, [rbx + 8]
mov qword [rdi + 0x28], rax
call fcn.140012198
movabs rcx, 0xfffd800000000000
or rax, rcx
mov qword [rbx], rax
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx + 0x18]
cmp qword [rcx + 0x10], rax
jb 0x1400272f8
mov rcx, rdi
call fcn.140011958
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140027314
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor esi, esi
mov ebx, r8d
mov r14, rdx
mov rbp, rcx
test r8d, r8d
je 0x1400273a0
mov edx, ebx
call fcn.1400231d8
mov r8d, ebx
lea edx, [rsi + 1]
mov r9, r14
mov rcx, rax
mov rdi, rax
call fcn.14007ab20
mov rbx, qword [rbp + 0x28]
mov rdx, rdi
mov r8d, eax
mov r14, rax
lea rcx, [rbx + 8]
mov qword [rbp + 0x28], rcx
mov rcx, rbp
call fcn.140012198
movabs r8, 0xfffd800000000000
or rax, r8
mov qword [rbx], rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx + 0x18]
cmp qword [rcx + 0x10], rax
jb 0x14002739b
mov rcx, rbp
call fcn.140011958
test r14d, r14d
jmp 0x1400273db
mov rcx, r14
call fcn.140082a24
mov rdx, r14
mov ecx, eax
mov ebx, eax
call fcn.140083b04
mov rdx, qword [rbp + 0x28]
movabs r8, 0xfffd800000000000
lea rcx, [rdx + 8]
mov qword [rbp + 0x28], rcx
mov rcx, qword [rbp + 0x10]
add rcx, 0x78
or rcx, r8
mov qword [rdx], rcx
cmp ebx, 0xffffffff
mov rbx, qword [rsp + 0x30]
setne sil
mov rbp, qword [rsp + 0x38]
mov eax, esi
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002f700
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
or r12d, 0xffffffff
mov r11d, edx
xor r10d, r10d
mov ebx, r8d
mov rdi, rcx
mov r8d, r12d
test edx, edx
jne 0x14002f750
mov eax, dword [rcx]
test eax, eax
jne 0x14002f73b
xor eax, eax
jmp 0x14002f8cd
bsf ecx, eax
cmp ecx, ebx
jb 0x14002f74a
mov ecx, ebx
shr eax, cl
mov dword [rdi], eax
jmp 0x14002f734
shr eax, cl
mov dword [rdi], eax
sub ebx, ecx
cmp ebx, 0x12
jbe 0x14002f7de
mov edx, r9d
and r9b, 0x30
shr edx, 0x18
lea esi, [rdx - 1]
cmp r9b, 0x20
jne 0x14002f787
mov eax, 0x38e38e39
mov r14d, 0x3f
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
sub r14d, edx
jmp 0x14002f7ea
bsr ecx, dword [rdi + r11*4]
imul eax, r11d, 0x1d
mov r8d, r11d
sub eax, ebx
add eax, ecx
mov ecx, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x1400a4460]
cvttsd2si eax, xmm0
sub ecx, eax
mov eax, 0x38e38e39
sub ecx, edx
imul ecx
mov eax, esi
sar edx, 1
mov r14d, edx
add edx, 0x3e
shr r14d, 0x1f
add r14d, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
sub r8d, eax
add r8d, 0x3d
jmp 0x14002f7ea
mov r14d, r12d
cmp ebx, 9
jb 0x14002f872
mov ecx, dword [rdi + r11*4]
mov r9d, r11d
mov eax, ecx
and ecx, 0x1ff
shr eax, 9
imul ebp, ecx, 0x1dcd65
mov dword [rdi + r11*4], eax
cmp r11d, r10d
je 0x14002f832
dec r9d
and r9d, 0x3f
mov edx, dword [rdi + r9*4]
mov eax, edx
shr eax, 9
and edx, 0x1ff
add eax, ebp
imul ebp, edx, 0x1dcd65
mov dword [rdi + r9*4], eax
cmp r9d, r10d
jne 0x14002f80b
cmp r10d, r14d
je 0x14002f854
cmp r10d, r8d
je 0x14002f854
test ebp, ebp
je 0x14002f84b
dec r10d
and r10d, 0x3f
mov dword [rdi + r10*4], ebp
cmp dword [rdi + r11*4], 0
jne 0x14002f86a
jmp 0x14002f860
cmp dword [rdi + r11*4], 0
jne 0x14002f86a
cmp r11d, r10d
je 0x14002f8ca
dec r11d
and r11d, 0x3f
add r8d, r12d
add ebx, 0xfffffff7
jmp 0x14002f7e1
test ebx, ebx
je 0x14002f8ca
mov r9d, dword [rdi + r11*4]
mov ecx, ebx
mov esi, 1
mov ebp, 0x3b9aca00
shl esi, cl
mov eax, r9d
dec esi
sar ebp, cl
shr eax, cl
jmp 0x14002f8aa
dec r11d
mov ecx, ebx
and r11d, 0x3f
mov edx, dword [rdi + r11*4]
mov eax, edx
shr eax, cl
add eax, r9d
mov r9d, edx
and r9d, esi
mov dword [rdi + r11*4], eax
imul r9d, ebp
cmp r11d, r10d
jne 0x14002f893
test r9d, r9d
je 0x14002f8ca
dec r10d
and r10d, 0x3f
mov dword [rdi + r10*4], r9d
mov eax, r10d
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r14
pop r12
ret
Function at 0x14003197c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xa8]
mov rbx, rcx
mov ecx, 0x10f0000
and eax, ecx
cmp eax, ecx
jne 0x140031aaa
xor esi, esi
cmp word [rbx + 0x234], si
jne 0x1400319cd
cmp word [rbx + 0x236], si
jne 0x1400319cd
cmp word [rbx + 0x238], si
jne 0x1400319cd
cmp word [rbx + 0x23a], si
je 0x140031aaa
cmp dword [rbx + 0x158], esi
jne 0x140031a1a
movzx eax, word [rbx + 0xa]
mov rdx, qword [rbx + 0x30]
lea r8, [rax + rax*2]
mov rax, qword [rbx + 0x38]
mov ecx, dword [rdx + r8*4 - 0xc]
lea r9, [rax + rcx*4]
movzx eax, byte [rdx + r8*4 - 2]
test al, al
je 0x140031a1a
mov edx, eax
movzx eax, word [r9]
cmp eax, 0x8000
jb 0x140031a10
mov ecx, eax
mov rax, qword [rbx + 0x20]
or byte [rax + rcx*8 + 4], 0x20
add r9, 4
sub rdx, 1
jne 0x1400319fa
mov rcx, rbx
call fcn.140031b98
cmp dword [rbx + 0x158], esi
je 0x140031aa2
mov ecx, dword [rbx + 0xc]
mov r9d, esi
mov rax, qword [rbx + 0x20]
dec ecx
lea rdx, [rax + rcx*8]
cmp byte [rdx + 5], 0x13
jne 0x140031aa2
mov r8, qword [rbx + 0x20]
movzx r11d, word [rdx]
movzx ecx, word [rdx + 2]
movzx r10d, byte [r8 + r11*8 + 4]
movzx edi, byte [r8 + rcx*8 + 4]
mov al, r10b
xor al, dil
test al, 0x20
jne 0x140031a70
movzx eax, word [r8 + rcx*8 + 6]
cmp word [r8 + r11*8 + 6], ax
je 0x140031a93
mov ecx, r10d
or r10b, 0x20
and ecx, edi
mov byte [r8 + r11*8 + 4], r10b
mov rax, qword [rbx + 0x20]
not ecx
and ecx, 0x20
or r9d, ecx
movzx ecx, word [rdx + 2]
or byte [rax + rcx*8 + 4], 0x20
sub rdx, 8
cmp byte [rdx + 5], 0x13
je 0x140031a40
test r9d, r9d
jne 0x140031a2a
mov rcx, rbx
call fcn.140031dd4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400428fc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rdx
mov rdi, rcx
test r8d, r8d
je 0x14003208e
cmp qword [rcx + 0xbe8], rdx
jne 0x14003206e
mov edx, 0x20
call fcn.14003228c
jmp 0x14003208a
mov rdx, qword [rdx + 8]
lea r9, [rsp + 0x40]
mov r8d, 0x20
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400320ee
xor eax, eax
jmp 0x1400320b6
mov rbx, qword [rcx + 0xbe8]
cmp r10, rbx
jb 0x1400320c1
mov rdx, qword [rcx + 0xc00]
add rdx, rbx
cmp r10, rdx
jae 0x1400320c1
mov edx, 4
call fcn.14003228c
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rbx]
cmp r10, rbx
jb 0x1400320c1
mov rdx, qword [rbx + 8]
lea rax, [rdx + rbx]
cmp r10, rax
jae 0x1400320c1
lea r9, [rsp + 0x40]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400320b3
mov rcx, rdi
call fcn.1400322e0
int3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rdx + 0x58]
mov rbp, rdx
mov ebx, r8d
mov rdx, rdi
xor r8d, r8d
mov r14, r9
mov r12, rcx
call 0x140032044
mov r8d, dword [rbp + 0x54]
mov ecx, ebx
and ebx, 0x1f
shr rcx, 5
shl ebx, 2
xor esi, esi
mov r15d, ebx
mov r13, rax
add r15, 0xfffffffffffffffa
lea rbx, [rdi - 6]
mov rcx, qword [r12 + rcx*8 + 0x6a0]
add rbx, r8
add r15, rcx
cmp r8d, 5
jbe 0x140042992
lea eax, [r8 - 5]
cmp byte [rax + rdi], 0xe9
jne 0x140042992
movsxd rax, dword [r8 + rdi - 4]
add rax, 0xfffffffffffffffa
add rax, r8
add rax, rdi
cmp rax, r15
jne 0x140042992
mov eax, r14d
sub eax, edi
sub eax, r8d
mov dword [r8 + rdi - 4], eax
cmp rdi, rbx
jae 0x140042a30
mov al, byte [rdi]
mov rcx, rsi
and al, 0xf0
cmp al, 0x40
sete cl
cmp dword [rcx + rdi + 2], 0xfffff138
jne 0x1400429b7
cmp byte [rcx + rdi], 0xc7
je 0x140042a2b
mov rcx, rdi
call fcn.1400419e8
mov eax, eax
add rdi, rax
cmp rdi, rbx
jb 0x14004299b
jmp 0x140042a2b
movzx eax, word [rdi]
mov ecx, 0xf0ff
and ax, cx
mov ecx, 0x800f
cmp ax, cx
jne 0x1400429fe
movsxd rax, dword [rdi + 2]
add rax, rdi
cmp rax, r15
jne 0x1400429fe
cmp rdi, rsi
je 0x1400429fe
mov eax, r14d
sub eax, edi
sub eax, 6
mov dword [rdi + 2], eax
jmp 0x140042a1e
cmp byte [rdi], 0xe8
jne 0x140042a1e
movsxd rcx, dword [rdi + 1]
lea rax, [0x140011a6c]
add rcx, 5
add rcx, rdi
cmp rcx, rax
jne 0x140042a1e
lea rsi, [rdi + 7]
mov rcx, rdi
call fcn.1400419e8
mov eax, eax
add rdi, rax
cmp rdi, rbx
jb 0x1400429cb
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x54]
add rdx, rcx
call sym.luajit.exe_luaJIT_version_2_1_ROLLING
mov r8d, 1
mov rdx, r13
mov rcx, r12
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp 0x140032044
Function at 0x140047234
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x4500
shr r8, 2
or dx, ax
mov word [rcx + 0xba], r8w
mov eax, 0x7fff
mov word [rcx + 0xbc], dx
mov word [rcx + 0xb8], ax
jmp fcn.14004f50c