joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
mov r15, rcx
mov r14d, 0x104
lea rcx, [rsp + 0x70]
mov r8d, r14d
xor edx, edx
call fcn.140093c00
xor esi, esi
mov dword [rsp + 0x58], 0xffffffff
lea r12, [0x1401583a0]
mov qword [rsp + 0x60], rsi
mov rcx, r12
mov qword [rsp + 0x50], rsi
xor edx, edx
mov dword [rsp + 0x5c], 0x1ff
mov r8d, 0x1ff
call fcn.140093c00
test rdi, rdi
je 0x140057173
mov rax, 0xffffffffffffffff
mov rbx, rax
inc rbx
cmp byte [rdi + rbx], sil
jne 0x140057013
test rbx, rbx
je 0x14005702d
cmp byte [rdi + rbx], 0x5c
je 0x14005705e
sub rbx, 1
jne 0x140057021
lea rax, [rsp + 0x60]
mov r9d, 0x2001d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400570c6
mov qword [rsp + 0x60], rsi
jmp 0x14005715f
cmp rbx, r14
jae 0x140057173
inc rax
cmp byte [rdi + rax], sil
jne 0x140057067
inc rax
lea rcx, [rsp + 0x70]
cmp rax, r14
mov rdx, rdi
cmovb r14, rax
mov r8, r14
call fcn.140093550
lea rax, [rsp + 0x50]
mov byte [rsp + r14 + 0x6f], sil
mov byte [rsp + rbx + 0x70], sil
lea rdx, [rsp + 0x70]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, r15
inc rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14005710e
mov qword [rsp + 0x50], rsi
jmp 0x14005714f
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rdx, str.Alex313031R3dusb
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14005710e
mov qword [rsp + 0x50], rsi
jmp 0x14005714f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + rbx]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14005714a
test eax, eax
jne 0x14005714f
cmp dword [rsp + 0x58], 1
jne 0x14005714f
cmp dword [rsp + 0x5c], esi
jbe 0x14005714f
mov esi, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14005715f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14005716f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140057175
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140092060
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140058230
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x140106438]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.140093c00
xor eax, eax
cmp dword [0x1401429e0], 0x62
mov qword [0x14015b42e], rax
jb 0x1400582a7
mov ebx, 1
mov ecx, ebx
call fcn.140053d50
test al, 4
je 0x1400582a7
cmp byte [0x14015b40f], 0
jne 0x1400582fb
mov rcx, qword [0x1401128d8]
xor edx, edx
call fcn.140055fb0
test rax, rax
jne 0x1400582c2
lea rcx, str.Could_not_mount_Windows_ISO_for_build_number_detection
call fcn.140041aa0
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140092060
add rsp, 0x1d0
pop rbx
ret
lea rcx, [0x14015b142]
mov edx, 0x80
mov qword [rsp + 0x28], rcx
lea r9, [0x1400e4578]
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
call fcn.1400034e0
mov byte [rsp + 0x1bf], 0
mov qword [rsp + 0x1e0], rsi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x1e8], rdi
call fcn.1400277f0
test eax, eax
je 0x140058320
cmp byte [rsp + 0x30], 0
jne 0x140058349
mov eax, dword [0x1400f2638]
movsd xmm0, qword [str..RufVXml.tmp]
mov dword [rsp + 0x38], eax
movzx eax, word [0x1400f263c]
mov word [rsp + 0x3c], ax
mov byte [rsp + 0x3d], 0
movsd qword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.140003550
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x140058374
mov rcx, rdi
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [0x14015b40f], 0
lea rcx, [rsp + 0x140]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], ebx
cmovne rcx, qword [0x1401128d8]
lea r8, str._1_.xml
xor edx, edx
call fcn.140054c90
test eax, eax
jne 0x1400583bc
lea rcx, str.Could_not_acquire_WIM_index
call fcn.140041aa0
jmp 0x1400583c8
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140058070
lea rcx, [rsp + 0x30]
call fcn.140003550
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rdi, rdi
je 0x1400583f3
mov rcx, rdi
call fcn.14009b5a0
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [0x14015b40f], 0
mov rdi, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1e0]
jne 0x140058419
call fcn.140056400
cmp word [0x14015b42e], 0
je 0x14005842d
cmp word [0x14015b432], 0
jne 0x14005842f
xor ebx, ebx
mov eax, ebx
jmp 0x1400582a9
Function at 0x14005fe90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rdx
mov eax, 0xffffffff
imul rbx, r9
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
cmp rbx, rax
jbe 0x14005fed7
lea rcx, str.read_sectors:_nSectors_x_SectorSize_is_too_big_n
call fcn.140041aa0
mov rax, 0xffffffffffffffff
jmp 0x14005ff9b
mov eax, r14d
xor r9d, r9d
imul eax, esi
xor r8d, r8d
imul rdx, rdi
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14005ff18
call fcn.140041e50
mov r8, rax
lea rcx, str.read_sectors:_Could_not_access_sector_0x_08llx____s_n
mov rdx, rdi
call fcn.140041aa0
mov rax, 0xffffffffffffffff
jmp 0x14005ff9b
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, qword [rsp + 0x70]
mov rcx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005ff46
mov ecx, dword [rsp + 0x58]
cmp rcx, rbx
je 0x14005ff99
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14005ff57
call fcn.140041e50
jmp 0x14005ff5e
lea rax, [0x1400d756a]
mov rdx, rax
lea rcx, str.read_sectors:_Read_error__s_n
call fcn.140041aa0
mov edx, dword [rsp + 0x58]
lea rcx, str.__Read:__d__Expected:__llu_n
mov r8, rbx
call fcn.140041aa0
mov r9, rsi
lea rcx, str.__StartSector:_0x_08llx__nSectors:_0x_llx__SectorSize:_0x_llx_n
mov r8, r14
mov rdx, rdi
call fcn.140041aa0
mov ecx, dword [rsp + 0x58]
mov eax, ecx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140063590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rbx, rcx
mov dword [rsp + 0x30], 0x4e204f4e
lea rcx, [rbp + 0x150]
mov dword [rsp + 0x34], 0x20454d41
mov word [rsp + 0x38], 0x2020
lea rdx, str.FAT32___1
mov byte [rsp + 0x3a], 0x20
mov eax, 7
mov dword [rsp + 0x20], 0x4d9058eb
mov dword [rsp + 0x24], 0x4e495753
mov word [rsp + 0x28], 0x2e34
mov byte [rsp + 0x2a], 0x31
nop dword [rax]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x140063600
mov eax, dword [rdx + 0x10]
movups xmm0, xmmword [rdx]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
movzx eax, word [rdx + 0x14]
mov edx, 4
mov word [rcx + 0x14], ax
lea rax, [rsp + 0x50]
lea rcx, [0x1400f6530]
mov dword [rsp + 0x4c], 0xaa550000
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x140063691
lea r9d, [rdx + 0xb]
mov rcx, rbx
lea r8, [rsp + 0x20]
call fcn.1400600b0
test eax, eax
je 0x140063784
mov r9d, 0xb
lea r8, [rsp + 0x30]
mov rcx, rbx
lea edx, [r9 + 0x3c]
call fcn.1400600b0
test eax, eax
je 0x140063784
mov r9d, 0x396
lea r8, [rbp + 0x150]
mov edx, 0x52
mov rcx, rbx
call fcn.1400600b0
test eax, eax
je 0x140063784
mov r9d, 0x10
lea r8, [rsp + 0x40]
mov edx, 0x3f0
mov rcx, rbx
call fcn.1400600b0
test eax, eax
je 0x140063784
mov r9d, 0x200
lea r8, [rsp + 0x50]
mov edx, 0x1c00
mov rcx, rbx
call fcn.1400600b0
test eax, eax
je 0x140063784
mov eax, 1
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
mov rbx, qword [rsp + 0x600]
xor eax, eax
add rsp, 0x5f0
pop rbp
ret
Function at 0x140067c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov r9d, 0x10b
mov dword [rsp + 0x20], 0xc031fcfa
lea r8, [rsp + 0x20]
mov dword [rsp + 0x24], 0xd88ed08e
xor edx, edx
mov dword [rsp + 0x28], 0x8d7c00bd
mov rbx, rcx
mov dword [rsp + 0x2c], 0xb8fbe066
mov dword [rsp + 0x30], 0xc08e1fe0
mov dword [rsp + 0x34], 0xef89ee89
mov dword [rsp + 0x38], 0xf30100b9
mov dword [rsp + 0x3c], 0x7c22eaa5
mov dword [rsp + 0x40], 0xd88e1fe0
mov dword [rsp + 0x44], 0xc031d08e
mov dword [rsp + 0x48], 0xbe8dc08e
mov dword [rsp + 0x4c], 0x5f601be
mov dword [rsp + 0x50], 0x836d7580
mov dword [rsp + 0x54], 0xff8110c7
mov dword [rsp + 0x58], 0xf2727dfe
mov dword [rsp + 0x5c], 0x6e00c4e8
mov dword [rsp + 0x60], 0x6361206f
mov dword [rsp + 0x64], 0x65766974
mov dword [rsp + 0x68], 0x72617020
mov dword [rsp + 0x6c], 0x69746974
mov dword [rsp + 0x70], 0x66206e6f
mov dword [rsp + 0x74], 0x646e756f
mov dword [rsp + 0x78], 0xe8feeb00
mov dword [rsp + 0x7c], 0x657200a5
mov dword [rbp - 0x80], 0x65206461
mov dword [rbp - 0x7c], 0x726f7272
mov dword [rbp - 0x78], 0x69687720
mov dword [rbp - 0x74], 0x7220656c
mov dword [rbp - 0x70], 0x69646165
mov dword [rbp - 0x6c], 0x6420676e
mov dword [rbp - 0x68], 0x65766972
mov dword [rbp - 0x64], 0xe8daeb00
mov dword [rbp - 0x60], 0x61700081
mov dword [rbp - 0x5c], 0x74697472
mov dword [rbp - 0x58], 0x206e6f69
mov dword [rbp - 0x54], 0x6e676973
mov dword [rbp - 0x50], 0x72757461
mov dword [rbp - 0x4c], 0x3d212065
mov dword [rbp - 0x48], 0x41353520
mov dword [rbp - 0x44], 0xb9eb0041
mov dword [rbp - 0x40], 0x720010e8
mov dword [rbp - 0x3c], 0x3e8126b6
mov dword [rbp - 0x38], 0xaa557dfe
mov dword [rbp - 0x34], 0xead175
mov dword [rbp - 0x30], 0xbb00007c
mov dword [rbp - 0x2c], 0x41b455aa
mov dword [rbp - 0x28], 0x327213cd
mov dword [rbp - 0x24], 0xaa55fb81
mov dword [rbp - 0x20], 0xc1f62c75
mov dword [rbp - 0x1c], 0xeb277401
mov dword [rbp - 0x18], 0x4001010
mov qword [rbp - 0x14], 0x7c0000
mov dword [rbp - 0xc], 0
mov dword [rbp - 8], 0x8458b00
mov dword [rbp - 4], 0x8b7cd1a3
mov dword [rbp], 0xd3a30a45
mov dword [rbp + 4], 0x4200b87c
mov dword [rbp + 8], 0xcd7cc9be
mov dword [rbp + 0xc], 0x4b8c313
mov dword [rbp + 0x10], 0x7c00bb02
mov dword [rbp + 0x14], 0x8a024d8b
mov dword [rbp + 0x18], 0x13cd0175
mov dword [rbp + 0x1c], 0xb4db31c3
mov dword [rbp + 0x20], 0x5e10cd0e
mov dword [rbp + 0x24], 0x3c56ac
mov word [rbp + 0x28], 0xf375
mov byte [rbp + 0x2a], 0xc3
call fcn.1400600b0
test eax, eax
je 0x140067e57
mov rcx, rbx
call fcn.140067080
test eax, eax
je 0x140067e57
mov eax, 1
mov rbx, qword [rsp + 0x140]
add rsp, 0x130
pop rbp
ret
mov rbx, qword [rsp + 0x140]
xor eax, eax
add rsp, 0x130
pop rbp
ret
Function at 0x14006e400
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x20
mov edi, r8d
mov r9, rdx
test ecx, ecx
jns 0x14006e426
call fcn.1400a7b18
mov dword [rax], 9
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
test r9, r9
jne 0x14006e441
call fcn.1400a7b18
mov dword [rax], 0xe
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
cmp edi, dword [section..data]
jbe 0x14006e45f
call fcn.1400a7b18
mov dword [rax], 7
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1401586d0]
test rax, rax
je 0x14006e486
cmp dword [rax], 0
je 0x14006e486
call fcn.1400a7b18
mov dword [rax], 4
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
cmp ecx, dword [0x140106004]
jne 0x14006e4d3
mov rcx, qword [0x140110260]
mov rdx, qword [0x140110258]
mov qword [rsp + 0x30], rbx
lea rax, [rcx + rdi]
cmp rax, rdx
jbe 0x14006e4ae
mov edi, edx
sub edi, ecx
mov rdx, qword [0x140110250]
add rdx, rcx
mov r8d, edi
mov rcx, r9
mov ebx, edi
call fcn.140093550
add qword [0x140110260], rbx
mov rbx, qword [rsp + 0x30]
jmp 0x14006e4ed
mov rax, qword [0x140110280]
mov r8d, edi
test rax, rax
je 0x14006e4e6
call rax
jmp 0x14006e4eb
call fcn.1400a9730
mov edi, eax
test edi, edi
jle 0x14006e513
mov rcx, qword [0x1401586c8]
movsxd rax, edi
add rcx, rax
mov rax, qword [0x140110270]
mov qword [0x1401586c8], rcx
test rax, rax
je 0x14006e513
call rax
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x14006fb20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15d, r9d
mov r14, r8
mov ebp, edx
mov rsi, rcx
cmp dword [r8], r9d
jae 0x14006fc8d
nop dword [rax]
mov r10d, dword [rsi + 0x40]
cmp r10d, dword [rsi + 0x44]
jb 0x14006fc67
mov edx, dword [section..data]
mov rcx, qword [rsi + 0x38]
lea ebx, [rdx - 4]
test rcx, rcx
js 0x14006fb78
mov eax, ebx
cmp rcx, rax
cmovl ebx, ecx
mov rcx, qword [rsi + 0x30]
mov eax, dword [rsi + 0xc]
add rcx, 4
test eax, eax
js 0x14006fccf
test rcx, rcx
je 0x14006fcc2
cmp ebx, edx
ja 0x14006fcb5
mov rdx, qword [0x1401586d0]
test rdx, rdx
je 0x14006fbb1
cmp dword [rdx], 0
jne 0x14006fca8
cmp eax, dword [0x140106004]
jne 0x14006fbf0
mov rdx, qword [0x140110260]
mov r8, qword [0x140110258]
mov eax, ebx
add rax, rdx
cmp rax, r8
jbe 0x14006fbd6
mov ebx, r8d
sub ebx, edx
add rdx, qword [0x140110250]
mov r8d, ebx
mov edi, ebx
call fcn.140093550
add qword [0x140110260], rdi
jmp 0x14006fc10
mov r9, qword [0x140110280]
mov rdx, rcx
mov r8d, ebx
mov ecx, eax
test r9, r9
je 0x14006fc09
call r9
jmp 0x14006fc0e
call fcn.1400a9730
mov ebx, eax
test ebx, ebx
jle 0x14006fc36
mov rcx, qword [0x1401586c8]
movsxd rax, ebx
add rcx, rax
mov rax, qword [0x140110270]
mov qword [0x1401586c8], rcx
test rax, rax
je 0x14006fc36
call rax
mov dword [rsi + 0x44], ebx
cmp ebx, 1
jl 0x14006fce1
mov rcx, qword [rsi + 0x38]
test rcx, rcx
js 0x14006fc54
mov eax, ebx
sub rcx, rax
mov qword [rsi + 0x38], rcx
add ebx, 4
mov dword [rsi + 0x40], 4
mov dword [rsi + 0x44], ebx
mov r10d, 4
mov rax, qword [rsi + 0x30]
mov ecx, r10d
movzx edx, byte [rax + rcx]
lea eax, [r10 + 1]
mov ecx, dword [r14]
shl edx, cl
mov dword [rsi + 0x40], eax
or ebp, edx
add dword [r14], 8
cmp dword [r14], r15d
jb 0x14006fb50
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
call fcn.1400a7b18
mov dword [rax], 4
jmp 0x14006fcda
call fcn.1400a7b18
mov dword [rax], 7
jmp 0x14006fcda
call fcn.1400a7b18
mov dword [rax], 0xe
jmp 0x14006fcda
call fcn.1400a7b18
mov dword [rax], 9
mov dword [rsi + 0x44], 0xffffffff
lea rax, str.unexpected_end_of_file
mov rcx, rsi
mov qword [rsi + 0x98], rax
call fcn.14006f990
int3
Function at 0x140070c00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x84]
mov rsi, rcx
test eax, eax
je 0x140070ded
mov ebp, dword [rcx + 0x88]
nop dword [rax + rax]
dec eax
mov dword [rsi + 0x84], eax
cmp dword [rsi + 0x8c], 8
jae 0x140070d99
mov r9d, dword [rsi + 0x40]
nop dword [rax]
cmp r9d, dword [rsi + 0x44]
jb 0x140070d66
mov edx, dword [section..data]
mov rcx, qword [rsi + 0x38]
lea ebx, [rdx - 4]
test rcx, rcx
js 0x140070c74
mov eax, ebx
cmp rcx, rax
cmovl ebx, ecx
mov rcx, qword [rsi + 0x30]
mov r9d, dword [rsi + 0xc]
add rcx, 4
test r9d, r9d
js 0x140070e61
test rcx, rcx
je 0x140070e54
cmp ebx, edx
ja 0x140070e47
mov rax, qword [0x1401586d0]
test rax, rax
je 0x140070caf
cmp dword [rax], 0
jne 0x140070e3a
cmp r9d, dword [0x140106004]
jne 0x140070cef
mov rdx, qword [0x140110260]
mov r8, qword [0x140110258]
mov eax, ebx
add rax, rdx
cmp rax, r8
jbe 0x140070cd5
mov ebx, r8d
sub ebx, edx
add rdx, qword [0x140110250]
mov r8d, ebx
mov edi, ebx
call fcn.140093550
add qword [0x140110260], rdi
jmp 0x140070d0f
mov rax, qword [0x140110280]
mov rdx, rcx
mov r8d, ebx
mov ecx, r9d
test rax, rax
je 0x140070d08
call rax
jmp 0x140070d0d
call fcn.1400a9730
mov ebx, eax
test ebx, ebx
jle 0x140070d35
mov rcx, qword [0x1401586c8]
movsxd rax, ebx
add rcx, rax
mov rax, qword [0x140110270]
mov qword [0x1401586c8], rcx
test rax, rax
je 0x140070d35
call rax
mov dword [rsi + 0x44], ebx
cmp ebx, 1
jl 0x140070e73
mov rcx, qword [rsi + 0x38]
test rcx, rcx
js 0x140070d53
mov eax, ebx
sub rcx, rax
mov qword [rsi + 0x38], rcx
add ebx, 4
mov dword [rsi + 0x40], 4
mov dword [rsi + 0x44], ebx
mov r9d, 4
mov r8d, dword [rsi + 0x8c]
mov rax, qword [rsi + 0x30]
mov ecx, r9d
movzx edx, byte [rax + rcx]
lea eax, [r8 + 8]
mov ecx, r8d
shl edx, cl
or ebp, edx
inc r9d
mov dword [rsi + 0x40], r9d
mov dword [rsi + 0x8c], eax
cmp eax, 8
jb 0x140070c50
mov ecx, dword [rsi + 0x90]
mov rax, qword [rsi + 0x18]
mov dword [rsi + 0x88], ebp
mov byte [rcx + rax], bpl
mov ebp, dword [rsi + 0x88]
mov ecx, dword [rsi + 0x8c]
inc dword [rsi + 0x90]
sub ecx, 8
mov eax, dword [rsi + 0x90]
shr ebp, 8
cmp eax, dword [section..data]
mov dword [rsi + 0x88], ebp
mov dword [rsi + 0x8c], ecx
je 0x140070e28
mov eax, dword [rsi + 0x84]
test eax, eax
jne 0x140070c30
dec eax
mov dword [rsi + 0x84], eax
mov eax, dword [rsi + 0x90]
mov dword [rsi + 0x10], eax
mov eax, dword [rsi + 0x88]
mov dword [rsi + 0x28], eax
movzx eax, byte [rsi + 0x8c]
mov byte [rsi + 0x2c], al
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov dword [rsi + 0x10], eax
xor eax, eax
mov dword [rsi + 0x90], eax
mov eax, 1
jmp 0x140070e13
call fcn.1400a7b18
mov dword [rax], 4
jmp 0x140070e6c
call fcn.1400a7b18
mov dword [rax], 7
jmp 0x140070e6c
call fcn.1400a7b18
mov dword [rax], 0xe
jmp 0x140070e6c
call fcn.1400a7b18
mov dword [rax], 9
mov dword [rsi + 0x44], 0xffffffff
lea rax, str.unexpected_end_of_file
mov rcx, rsi
mov qword [rsi + 0x98], rax
call fcn.14006f990
int3
Function at 0x140071460
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, dword [rcx]
xor r13d, r13d
mov r15d, edx
mov rsi, rcx
mov r14d, r13d
lea r12d, [r13 + 1]
cmp ebp, edx
jge 0x1400715c2
mov r9d, dword [rcx + 0x14]
nop word [rax + rax]
cmp r9d, dword [rsi + 0x10]
jne 0x140071577
mov ecx, dword [rsi + 8]
mov ebx, dword [section..data]
mov r9, qword [rsi + 0x18]
test ecx, ecx
js 0x140071614
test r9, r9
je 0x140071607
mov rax, qword [0x1401586d0]
test rax, rax
je 0x1400714dd
cmp dword [rax], r13d
jne 0x1400715fa
cmp ecx, dword [0x140106004]
jne 0x14007151d
mov rdx, qword [0x140110260]
mov rcx, qword [0x140110258]
lea rax, [rdx + rbx]
cmp rax, rcx
jbe 0x140071500
mov ebx, ecx
sub ebx, edx
add rdx, qword [0x140110250]
mov rcx, r9
mov r8d, ebx
mov edi, ebx
call fcn.140093550
add qword [0x140110260], rdi
jmp 0x14007153a
mov rax, qword [0x140110280]
mov r8d, ebx
mov rdx, r9
test rax, rax
je 0x140071533
call rax
jmp 0x140071538
call fcn.1400a9730
mov ebx, eax
test ebx, ebx
jle 0x140071565
mov rcx, qword [0x1401586c8]
movsxd rax, ebx
add rcx, rax
mov rax, qword [0x140110270]
mov qword [0x1401586c8], rcx
test rax, rax
je 0x140071565
call rax
mov dword [rsi + 0x10], ebx
jmp 0x140071570
mov dword [rsi + 0x10], ebx
test ebx, ebx
jle 0x140071626
mov dword [rsi + 0x14], r13d
mov r9d, r13d
mov r8d, dword [rsi + 4]
cmp ebp, 0x18
jl 0x14007159a
mov ecx, ebp
sub r15d, ebp
mov r14d, r12d
mov ebp, r13d
shl r14d, cl
mov ecx, r15d
dec r14d
and r14d, r8d
shl r14d, cl
mov rax, qword [rsi + 0x18]
add ebp, 8
shl r8d, 8
movsxd rcx, r9d
movzx edx, byte [rax + rcx]
or edx, r8d
inc r9d
mov dword [rsi + 4], edx
mov dword [rsi + 0x14], r9d
cmp ebp, r15d
jl 0x1400714a0
mov eax, dword [rsi + 4]
sub ebp, r15d
mov rbx, qword [rsp + 0x50]
mov ecx, ebp
shr eax, cl
mov ecx, r15d
shl r12d, cl
dec r12d
mov dword [rsi], ebp
mov rbp, qword [rsp + 0x58]
and eax, r12d
mov rsi, qword [rsp + 0x60]
or eax, r14d
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400a7b18
mov dword [rax], 4
jmp 0x14007161f
call fcn.1400a7b18
mov dword [rax], 0xe
jmp 0x14007161f
call fcn.1400a7b18
mov dword [rax], 9
mov dword [rsi + 0x10], 0xffffffff
mov rcx, qword [rsi + 0x50]
mov edx, 0xfffffffd
call fcn.1400934f0
int3
Function at 0x140072f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r14
push r15
mov r9d, dword [rcx + 0x10]
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov rbx, 0xffffffffffffffff
cmp r8, 4
ja 0x140072fa1
xor eax, eax
mov rbx, qword [rsp + 0x38]
pop r15
pop r14
pop rdi
ret
mov qword [rsp + 0x20], rbp
mov ebp, 0
mov r8d, ebp
sub r14, 4
je 0x140073117
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r12
lea r12, [0x140000000]
nop dword [rax]
movzx eax, byte [r8 + rdi]
and al, 0xfe
cmp al, 0xe8
jne 0x140073101
mov rax, r8
sub rax, rbx
cmp rax, 3
jbe 0x14007300a
mov r9d, ebp
movzx ecx, byte [r8 + rdi + 4]
mov rbx, r8
lea eax, [rcx - 1]
cmp al, 0xfd
ja 0x14007304c
add r9d, r9d
or r9d, 1
jmp 0x140073101
lea ecx, [rax + 0xff]
shl r9d, cl
and r9d, 7
je 0x140072fee
cmp byte [r9 + r12 + 0xc12b8], bpl
je 0x14007303d
movzx eax, byte [r9 + r12 + 0xc12c0]
mov rcx, r8
sub rcx, rax
movzx eax, byte [rcx + rdi + 4]
inc al
test al, 0xfe
jne 0x140072fee
add r9d, r9d
mov rbx, r8
or r9d, 1
jmp 0x140073101
mov esi, dword [r15 + 0xc]
mov eax, ecx
movzx ecx, byte [r8 + rdi + 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [r8 + rdi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [r8 + rdi + 1]
shl eax, 8
or eax, ecx
sub eax, r8d
sub eax, esi
sub eax, 5
test r9d, r9d
je 0x1400730cb
mov ecx, r9d
mov r10d, 0x18
movzx r11d, byte [rcx + r12 + 0xc12c0]
shl r11d, 3
sub r10d, r11d
nop dword [rax]
mov edx, eax
mov ecx, r10d
shr edx, cl
inc dl
test dl, 0xfe
jne 0x1400730cb
mov ecx, 0x20
mov edx, 1
sub ecx, r11d
shl edx, cl
dec edx
xor eax, edx
sub eax, r8d
sub eax, esi
sub eax, 5
jmp 0x1400730a0
and eax, 0x1ffffff
mov ecx, eax
and ecx, 0x1000000
neg ecx
or eax, ecx
mov byte [r8 + rdi + 1], al
mov ecx, eax
shr ecx, 8
mov byte [r8 + rdi + 2], cl
mov ecx, eax
shr ecx, 0x10
shr eax, 0x18
mov byte [r8 + rdi + 3], cl
mov byte [r8 + rdi + 4], al
add r8, 4
inc r8
cmp r8, r14
jb 0x140072fd0
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov rcx, r8
sub rcx, rbx
cmp rcx, 3
ja 0x14007312c
add cl, 0xff
shl r9d, cl
mov ebp, r9d
mov rbx, qword [rsp + 0x38]
mov rax, r8
mov dword [r15 + 0x10], ebp
mov rbp, qword [rsp + 0x20]
pop r15
pop r14
pop rdi
ret