joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402a1b40
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, 0xffffffff
xor edi, edi
nop word [rax + rax]
xor eax, eax
lock cmpxchg dword [0x14071351c], esi
mov ebx, eax
jne 0x1402a1d08
cmp qword [0x140713588], rdi
jne 0x1402a1cfa
lea rcx, [0x140713520]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1404bf960]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140713588], rax
test rax, rax
je 0x1402a1ceb
lea rdx, str.StackWalk64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140713588]
lea rdx, [0x1404bf980]
mov qword [0x140713548], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140713588]
lea rdx, [0x1404bf990]
mov qword [0x140713550], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140713588]
lea rdx, [0x1404bf9a0]
mov qword [0x140713558], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140713588]
lea rdx, [0x1404bf9b8]
mov qword [0x140713560], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140713588]
lea rdx, [0x1404bf9c8]
mov qword [0x140713568], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140713588]
lea rdx, str.SymFunctionTableAccess64
mov qword [0x140713570], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140713588]
lea rdx, str.SymGetModuleBase64
mov qword [0x140713578], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140713548], rdi
mov qword [0x140713580], rax
je 0x1402a1cc8
cmp qword [0x140713550], rdi
je 0x1402a1cc8
cmp qword [0x140713558], rdi
je 0x1402a1cc8
cmp qword [0x140713560], rdi
je 0x1402a1cc8
cmp qword [0x140713568], rdi
je 0x1402a1cc8
cmp qword [0x140713570], rdi
je 0x1402a1cc8
cmp qword [0x140713578], rdi
je 0x1402a1cc8
test rax, rax
je 0x1402a1cc8
mov ebx, 1
jmp 0x1402a1d00
mov rcx, qword [0x140713588]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [0x140713520]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov qword [0x140713588], rdi
jmp 0x1402a1d00
lea rcx, [0x140713520]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x1402a1d00
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov eax, ebx
xchg dword [0x14071351c], eax
cmp ebx, esi
je 0x1402a1b60
mov rsi, qword [rsp + 0x38]
cmp ebx, 1
mov rbx, qword [rsp + 0x30]
sete al
add rsp, 0x20
pop rdi
ret
Function at 0x1402a2210
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rdi
sub rsp, 0x210
mov qword [rax + 8], rbp
mov rdi, rcx
mov qword [rax + 0x10], rsi
mov eax, edx
mov ecx, eax
lea rdx, [rsp + 0x20]
mov esi, r8d
call fcn.1402927e0
xor ebx, ebx
movsxd rbp, eax
test eax, eax
jle 0x1402a22ab
lea eax, [rsi + 1]
mov qword [rsp + 0x230], r14
movsxd r14, eax
mov esi, ebx
cmp qword [rsp + rsi*8 + 0x20], rbx
jne 0x1402a2278
lea r8, str.ppFrames_iFrame____NULL
mov edx, 0x1ed
lea rcx, str.c:_buildslave_steam_rel_client_hotfix_win64_build_src_tier0memblockhdr.cpp
call fcn.14029bf90
test al, al
jne 0x1402a2278
int3
cmp rsi, r14
jle 0x1402a229b
movsxd rax, dword [rdi + 0xa0]
cmp eax, 0x14
jge 0x1402a229b
mov rcx, rax
mov rax, qword [rsp + rsi*8 + 0x20]
mov qword [rdi + rcx*8], rax
inc dword [rdi + 0xa0]
inc rsi
cmp rsi, rbp
jl 0x1402a2254
mov r14, qword [rsp + 0x230]
mov ecx, dword [rdi + 0xa0]
lea rax, [rdi + 0xa8]
mov rsi, qword [rsp + 0x228]
mov rbp, qword [rsp + 0x220]
mov qword [rax], rbx
test ecx, ecx
jle 0x1402a22eb
nop
lea rbx, [rbx*4]
mov qword [rax], rbx
xor rbx, qword [rdi]
lea rdi, [rdi + 8]
mov qword [rax], rbx
sub rcx, 1
jne 0x1402a22d0
mov rbx, qword [rsp + 0x238]
add rsp, 0x210
pop rdi
ret
Function at 0x1402a33b0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x830
mov r15, rcx
mov r12, r8
lea rcx, str._noassert
mov ebp, edx
call fcn.1402924a0
test al, al
jne 0x1402a35a6
lea rcx, str._nocrashdialog
call fcn.1402924a0
test al, al
jne 0x1402a35a6
call fcn.140293cb0
test al, al
jne 0x1402a3412
call fcn.14029c7c0
jmp 0x1402a35a8
lea rcx, str._debugbreak
call fcn.1402924a0
test al, al
je 0x1402a3429
mov al, 1
jmp 0x1402a35a8
cmp byte [0x1405bd720], 0
je 0x1402a35a6
mov rbx, qword [0x1407135a0]
lea r14, [0x1407135a0]
xor r13d, r13d
test rbx, rbx
je 0x1402a34ce
mov rdi, qword [rbx + 0x210]
mov rdx, rbx
mov rcx, r15
call fcn.14033d668
test eax, eax
jne 0x1402a34bf
mov ecx, dword [rbx + 0x200]
mov al, 1
cmp ecx, 0xffffffff
jne 0x1402a3480
cmp dword [rbx + 0x204], ecx
movzx eax, al
cmove eax, r13d
cmp ebp, ecx
jl 0x1402a348c
cmp ebp, dword [rbx + 0x204]
jle 0x1402a3490
test al, al
jne 0x1402a34bf
mov eax, dword [rbx + 0x208]
test eax, eax
jle 0x1402a35a6
sub eax, 1
mov dword [rbx + 0x208], eax
jne 0x1402a35a6
mov edx, 0x218
mov qword [r14], rdi
mov rcx, rbx
call fcn.14031dc44
jmp 0x1402a34c6
lea r14, [rbx + 0x210]
mov rbx, rdi
test rdi, rdi
jne 0x1402a3450
mov qword [0x1407135a8], r15
mov dword [0x1407135b0], ebp
mov qword [0x1407135b8], r12
mov byte [0x140713592], r13b
mov qword [0x1407135c0], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [0x1402a3350]
call qword [sym.imp.USER32.dll_EnumWindows]
mov r8, qword [0x1407135c0]
test r8, r8
jne 0x1402a357f
mov qword [rsp + 0x28], r12
lea r8, str.File:__s_nLine:__d_n_Ts_n_nClick_Abort_to_break_in_the_debugger__Retry_to_continue_or_Ignore_to_disable_assert_dialogs_for_this_process.
mov r9, r15
mov dword [rsp + 0x20], ebp
mov edx, 0x800
lea rcx, [rsp + 0x30]
call fcn.14014feb0
mov r9d, 0x12002
mov byte [rsp + 0x82f], r13b
lea r8, str.Assert_Dialog
xor ecx, ecx
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 3
jne 0x1402a356a
mov byte [0x140713592], 1
movzx eax, byte [0x140713592]
jmp 0x1402a35a8
cmp eax, 5
jne 0x1402a359d
movzx eax, byte [0x140713592]
mov byte [0x1405bd720], r13b
jmp 0x1402a35a8
mov rcx, qword [0x140713598]
lea r9, [0x1402a2f60]
mov edx, 0x65
mov qword [rsp + 0x20], r13
call qword [sym.imp.USER32.dll_DialogBoxParamA]
movzx eax, byte [0x140713592]
jmp 0x1402a35a8
xor al, al
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1402a5310
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov ebx, edx
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1402a5336
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
xor edi, edi
mov qword [rsi], rdi
cmp ebx, 4
jne 0x1402a53e6
cmp byte [0x1407135c8], dil
jne 0x1402a5379
lea rcx, [0x14049e2b8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetLogicalProcessorInformationEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1407135d0], rax
nop
mov byte [0x1407135c8], 1
cmp qword [0x1407135d0], rdi
jne 0x1402a552b
call fcn.1402a4830
test rax, rax
jne 0x1402a5427
call fcn.1402a4a00
test al, al
jne 0x1402a53fd
mov ecx, reloc.WS2_32.dll_recv
call fcn.14031dc78
mov rbx, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x1402a5552
lea rax, vtable.ICpuTopology.0
mov qword [rbx], rax
lea rax, vtable.DefaultImpl.0
mov qword [rbx], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x70]
mov dword [rbx + 8], eax
jmp 0x1402a5555
test ebx, ebx
je 0x1402a539d
sub ebx, 1
je 0x1402a552b
sub ebx, 1
je 0x1402a5427
cmp ebx, 1
jne 0x1402a539d
mov ecx, 0x58
call fcn.14031dc78
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x1402a541f
mov rcx, rax
call fcn.1402a37a0
mov rdi, rax
mov qword [rsi], rdi
jmp 0x1402a5558
mov ecx, 0x20
call fcn.14031dc78
mov rbx, rax
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x1402a5526
lea rax, vtable.ICpuTopology.0
mov qword [rbx], rax
lea rax, vtable.GlpiImpl.0
mov qword [rbx], rax
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], edi
call fcn.1402a4830
test rax, rax
jne 0x1402a5487
lea r8, str.IsSupported__
mov edx, 0x28a
lea rcx, str.c:_buildslave_steam_rel_client_hotfix_win64_build_src_tier0CPUTopology.cpp
call fcn.14029bf90
test al, al
jne 0x1402a5487
int3
call fcn.1402a4830
mov rbp, rax
test rax, rax
jne 0x1402a54b1
lea r8, str.pGlpi
mov edx, 0x28d
lea rcx, str.c:_buildslave_steam_rel_client_hotfix_win64_build_src_tier0CPUTopology.cpp
call fcn.14029bf90
test al, al
jne 0x1402a54b1
int3
mov dword [rsp + 0xa8], edi
lea rdx, [rsp + 0xa8]
xor ecx, ecx
call rbp
mov ecx, dword [rsp + 0xa8]
call fcn.14032bef4
mov qword [rbx + 8], rax
lea rdx, [rsp + 0xa8]
mov rcx, rax
call rbp
mov ecx, dword [rsp + 0xa8]
shr ecx, 5
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0x18], edi
test ecx, ecx
je 0x1402a5512
mov rax, qword [rbx + 8]
add rax, 8
nop dword [rax]
cmp dword [rax], 0
jne 0x1402a5508
inc dword [rbx + 0x18]
add rax, 0x20
sub rcx, 1
jne 0x1402a5500
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov dword [rbx + 0x14], eax
jmp 0x1402a5529
mov rbx, rdi
jmp 0x1402a5555
mov ecx, 0x30
call fcn.14031dc78
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x1402a554d
mov rcx, rax
call fcn.1402a3d80
mov rdi, rax
mov qword [rsi], rdi
jmp 0x1402a5558
mov rbx, rdi
mov qword [rsi], rbx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402a5570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rcx], dl
mov r10, rcx
mov byte [rcx + 1], r8b
cmp r8b, dl
jbe 0x1402a5585
mov byte [rcx + 1], dl
movzx r8d, dl
movzx eax, dl
xor edx, edx
movzx ecx, r8b
div ecx
mov dl, 8
mov cl, 0x80
dec al
test al, cl
jne 0x1402a55a1
add dl, 0xff
shr cl, 1
jne 0x1402a5596
movzx r8d, byte [r10 + 1]
mov cl, 8
dec r8b
mov byte [r10 + 2], dl
mov al, 0x80
test r8b, al
jne 0x1402a55bd
add cl, 0xff
shr al, 1
jne 0x1402a55b1
mov byte [r10 + 4], cl
mov r9d, 0xff
mov r8d, r9d
mov eax, 8
sub al, cl
movzx ecx, cl
sub al, dl
movzx edx, dl
add ecx, edx
mov byte [r10 + 6], al
shl r8b, cl
mov ecx, edx
shl r9b, cl
movzx eax, r9b
mov byte [r10 + 7], r8b
xor al, r8b
not r9b
mov byte [r10 + 5], al
mov byte [r10 + 3], r9b
ret

Function at 0x1402ad7d0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov ecx, dword [0x140756750]
mov edx, 0x480
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140713628], eax
jg 0x1402ad911
mov rsi, qword [0x140713620]
test rsi, rsi
je 0x1402ad903
cmp byte [rsi + 0x30], 0
jne 0x1402ad903
lea rcx, [rsp + 0x30]
call fcn.1402925e0
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x1402ad8f1
test rax, rax
je 0x1402ad8f1
cmp qword [rax], 0
je 0x1402ad8f1
mov r9, qword [rsi]
mov r8, rax
mov rcx, rsi
mov qword [rsp + 0x38], rbp
call qword [r9]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbp, rax
test rax, rax
jne 0x1402ad88a
lea rcx, [rsi + 8]
lea rdx, [0x1404830ad]
call fcn.14027b5e0
mov rax, qword [0x140713620]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r9d, 4
mov qword [rsp + 0x40], rdi
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.1402abbf0
movsxd rbx, eax
mov rcx, rbx
call fcn.14031dcb4
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call fcn.1402abbf0
lea rcx, [rsi + 8]
mov rdx, rdi
call fcn.14027b5e0
mov rcx, rdi
call fcn.14031dc44
mov rax, qword [0x140713620]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rax, qword [0x140713620]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x48]
mov rax, rsi
add rsp, 0x20
pop rsi
ret
lea rcx, [0x140713628]
call fcn.14031e094
cmp dword [0x140713628], 0xffffffff
jne 0x1402ad801
xor r9d, r9d
lea rcx, [0x1405bd7f0]
xor r8d, r8d
lea edx, [r9 + 8]
call fcn.14027a2c0
xor ebx, ebx
lea rcx, [0x1405bd818]
xor r9d, r9d
mov dword [0x1405bd808], ebx
xor r8d, r8d
lea edx, [rbx + 0x18]
call fcn.14027a2c0
mov rax, qword [0x1405bd820]
lea rcx, [0x140480aa0]
mov qword [0x1405bd848], rax
lea rax, vtable.CCommandLine.0
mov qword [0x140713620], rax
mov qword [0x1405bd830], 0xffffffffffffffff
mov dword [0x1405bd838], 0xffffffff
mov qword [0x1405bd83c], rbx
mov word [0x1405bd810], bx
call fcn.14031def4
lea rcx, [0x140713628]
call fcn.14031e034
jmp 0x1402ad801
Function at 0x1402b0d20
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x1402b0d53
call fcn.1402b5b70
cmp byte [rbx + 0x58], 0
je 0x1402b0d4c
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x1402b0de5
mov rax, qword [rbx + 0x238]
cmp byte [rax + 0x20], 0
je 0x1402b0dcc
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1402b0d7e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x238]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1402b0dc4
cmp eax, 2
je 0x1402b0dcc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1402b0d70
dec eax
test eax, 0xfffffffd
jne 0x1402b0d70
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x1402b0d70
mov ecx, dword [rbx + 0x188]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x1402b0d70
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x1402b0e20
cmp eax, 0xcc
je 0x1402b0e07
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x15
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1402b0e20
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp dword [rcx + 0x24], 0xcc
je 0x1402b0e4e
mov rax, qword [rcx + 0x218]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x218]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x1402b0efd
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x1402b0ecd
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1402b0e9f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rax, qword [rbx + 0x220]
lea r8, [rbx + 0x98]
mov edi, dword [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + VariantCopy]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x1402b0f25
cmp eax, dword [rbx + 0x78]
jb 0x1402b0e80
mov rax, qword [rbx + 0x218]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rax, qword [rbx + 0x218]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x218]
cmp byte [rax + 0x10], bpl
jne 0x1402b0e70
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x1402b0f10
Function at 0x1402b0e20
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x1402b0d53
call fcn.1402b5b70
cmp byte [rbx + 0x58], 0
je 0x1402b0d4c
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x1402b0de5
mov rax, qword [rbx + 0x238]
cmp byte [rax + 0x20], 0
je 0x1402b0dcc
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1402b0d7e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x238]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1402b0dc4
cmp eax, 2
je 0x1402b0dcc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1402b0d70
dec eax
test eax, 0xfffffffd
jne 0x1402b0d70
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x1402b0d70
mov ecx, dword [rbx + 0x188]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x1402b0d70
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x1402b0e20
cmp eax, 0xcc
je 0x1402b0e07
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x15
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1402b0e20
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp dword [rcx + 0x24], 0xcc
je 0x1402b0e4e
mov rax, qword [rcx + 0x218]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x218]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x1402b0efd
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x1402b0ecd
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1402b0e9f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov rax, qword [rbx + 0x220]
lea r8, [rbx + 0x98]
mov edi, dword [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + VariantCopy]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x1402b0f25
cmp eax, dword [rbx + 0x78]
jb 0x1402b0e80
mov rax, qword [rbx + 0x218]
mov rcx, rbx
call qword [rax + VariantCopy]
mov rax, qword [rbx + 0x218]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x218]
cmp byte [rax + 0x10], bpl
jne 0x1402b0e70
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x1402b0f10
Function at 0x1402c4bb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x20
cmp dword [rcx + 0x64], 1
mov rdi, rcx
mov r13, qword [rcx + 0x268]
jne 0x1402c4bd7
mov esi, 0x1fe
mov byte [r13 + 0x38], 1
jmp 0x1402c4bdd
xor esi, esi
mov byte [r13 + 0x38], sil
mov rax, qword [rcx + 8]
lea r8d, [rsi + 0x100]
mov r9d, dword [rcx + 0x7c]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_recv]
mov ebp, dword [r13 + 0x28]
xor ebx, ebx
mov qword [r13 + 0x30], rax
cmp dword [rdi + 0x7c], ebx
jle 0x1402c4d1d
mov qword [rsp + 0x58], r12
lea r12, [r13 + 0x3c]
mov qword [rsp + 0x60], r14
movsxd rcx, esi
mov qword [rsp + 0x68], r15
xor r15d, r15d
mov qword [rsp + 0x50], rcx
nop word [rax + rax]
mov r9d, dword [r12]
mov eax, ebp
cdq
idiv r9d
mov ebp, eax
test rcx, rcx
je 0x1402c4c4d
mov rax, qword [r13 + 0x30]
add qword [rax + r15], 0xff
mov rax, qword [r13 + 0x30]
xor r10d, r10d
dec r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rdi
mov r14, qword [r15 + rax]
call fcn.1402c5050
xor r11d, r11d
mov r8d, eax
xor esi, esi
cmp r11d, r8d
jle 0x1402c4c98
nop word [rax + rax]
inc r10d
mov edx, ebx
mov r8d, r10d
mov rcx, rdi
call fcn.1402c5050
mov r8d, eax
cmp r11d, eax
jg 0x1402c4c80
movzx eax, r10b
inc r11d
movzx ecx, bpl
imul ecx, eax
mov byte [rsi + r14], cl
inc rsi
cmp rsi, 0xff
jle 0x1402c4c70
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1402c4cfb
mov ecx, 1
lea rdx, [r14 - 1]
nop dword [rax]
movzx eax, byte [r14]
mov byte [rdx], al
lea rdx, [rdx - 1]
movzx eax, byte [r14 + 0xff]
mov byte [r14 + rcx + 0xff], al
inc rcx
cmp rcx, 0xff
jle 0x1402c4cd0
mov rcx, qword [rsp + 0x50]
inc ebx
add r12, 4
add r15, 8
cmp ebx, dword [rdi + 0x7c]
jl 0x1402c4c30
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14032c5c4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14032c457
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14032c457
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14032c457
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14032c457
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14032c457
cmp dword [rcx + 0x84], 0xe
jbe 0x14032c457
cmp dword [rcx + 0xf8], 0
je 0x14032c457
mov ecx, ebx
call fcn.14032c4f8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14032c2e8
cmp dword [rbp + 0x20], 0
je 0x14032c4a4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14032c4ac
int3
xor r8d, r8d
xor edx, edx
jmp 0x14032c3f0

Function at 0x14033d500
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14033d520
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140336f00
or eax, 0xffffffff
jmp 0x14033d522
xor eax, eax
add rsp, 0x28
ret
Function at 0x140463320
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
jmp 0x140463330
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x140463346
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x140551100]
not ecx
cmp r10d, 8
jb 0x140463438
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x140463370
test r10d, r10d
je 0x140463460
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
add r10d, 0xffffffff
jne 0x140463440
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret