joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fade0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4faf28
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x72e2eb02223469f3
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb120d872e2eb0222
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x48745aec21ed3d6f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20e2c113f370bb73
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xfe1b053e4761651f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1e10140a0f17040e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x19181221171f05
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1404190700191812
mov qword [rsp + 0x48], rdx
movabs rdx, 0x21f001b06120a02
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf191e0f060c0d0f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x22160804200f1903
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x4faec0
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0x14
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2c
jge 0x4faef1
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x4faf1b
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0x14
add r8d, edx
cmp rsi, 0x23
jb 0x4faea2
jmp 0x4faf0f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x23
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x23
call fcn.00453360
mov eax, edi
mov ecx, 0x23
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.004fade0
Function at 0x501560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x501688
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x6092666f20c1879c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x65c4df64d9376f6c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x67f9d6e2c0383474
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4bde697463fee3c2
mov qword [rsp + 0x34], rdx
movabs rdx, 0x7151517150b1107
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1e161107151517
mov qword [rsp + 0x40], rdx
movabs rdx, 0x19061a191f0d0615
mov qword [rsp + 0x48], rdx
movabs rdx, 0x180214120a1e0212
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe130a1e0d011417
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x501620
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0x6f
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x24
jge 0x501651
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x50167b
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0x6f
add r8d, edx
cmp rsi, 0x20
jb 0x501603
jmp 0x50166f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x20
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x20
call fcn.00453360
mov eax, edi
mov ecx, 0x20
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00501560

Function at 0x5018a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x501972
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x24c832de90762523
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x2bca611c
movabs rdx, 0x50a060408000a04
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4070b010403050a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50190e
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x57]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x57]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x50193b
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x501965
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x5018f1
jmp 0x501956
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441820
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop dword [rax]
call fcn.00453360
mov eax, edi
mov ecx, 0xc
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.005018a0
Function at 0x50e000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e112
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x5f777e75156e8589
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9d10786c726f6f82
mov qword [rsp + 0x25], rdx
movabs rdx, 0xac6e6e6e7d9d1078
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6e86656c75989220
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd18041006030e0c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x7091004001b0f07
mov qword [rsp + 0x42], rdx
movabs rdx, 0x816141b12100709
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b0117090e0d0305
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x50e0b1
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x12]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x12]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x50e0de
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x50e105
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x50e094
jmp 0x50e0f9
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.00441820
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00453360
mov eax, edi
mov ecx, 0x1d
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0050e000

Function at 0x50f3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f496
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x1936351236321f30
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x381936351236321f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x47661e644d5d4f1f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x60306070b100606
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x404040606030607
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6010c0a0e040903
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x50f430
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0xfffffffe
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x14
jge 0x50f462
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x50f489
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0xfffffffe
add r8d, edx
cmp rsi, 0x11
jb 0x50f416
nop
jmp 0x50f47d
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00441820
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00453360
mov eax, edi
mov ecx, 0x11
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.0050f3a0
Function at 0x50fa40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50fb36
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x373715edb26ebe70
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x38373715edb26ebe
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3711df6463dee139
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa01100101060004
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10020e040b05050f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0b10030b030a06
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x50fad0
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0x3f
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x50fb02
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x50fb29
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0x3f
add r8d, edx
cmp rsi, 0x11
jb 0x50fab6
nop
jmp 0x50fb1d
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00441820
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x11
call fcn.00453360
mov eax, edi
mov ecx, 0x11
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.0050fa40

Function at 0x50fb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50fc56
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x3736095ee4734730
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1d3736095ee47347
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2e2c25646362f80a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x105100903010a01
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1010090801051009
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40f01051002080e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x50fbf3
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x14
jge 0x50fc22
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x50fc49
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x11
jb 0x50fbd6
nop
jmp 0x50fc3d
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00441820
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00453360
mov eax, edi
mov ecx, 0x11
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.0050fb60
Function at 0x512c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x512d72
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x2a2f6fb7c6e38b30
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x654f2a2f6fb7c6e3
mov qword [rsp + 0x20], rdx
movabs rdx, 0xda4e6183c52102d6
mov qword [rsp + 0x28], rdx
movabs rdx, 0x72ab662d75c9dd64
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8a616c2fd17763be
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1404031d001a0816
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9211a0e100b211e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1e21070c1c1a0c07
mov qword [rsp + 0x50], rdx
movabs rdx, 0x80d1b0201131c11
mov qword [rsp + 0x58], rdx
movabs rdx, 0x216100b021e0a18
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x512d0f
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x3f]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x3f]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x28
jge 0x512d3c
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x512d65
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x22
jb 0x512cf2
jmp 0x512d57
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
call fcn.00441820
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x22
nop
call fcn.00453360
mov eax, edi
mov ecx, 0x22
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00512c40

Function at 0x512e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x512f36
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xebef8200653878ed
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xde646ae465ebef82
mov qword [rsp + 0x22], rdx
movabs rdx, 0x726fc63d6520676e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x90c0a0002110111
mov qword [rsp + 0x32], rdx
movabs rdx, 0x110605060412090c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x501000705000000
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x512ed3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x70]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x70]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x512f02
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x512f29
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x512eb6
nop
jmp 0x512f1d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441820
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00453360
mov eax, edi
mov ecx, 0x15
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.00512e40
Function at 0x515e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515f6b
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x2d6569f8473b1154
mov qword [rsp + 0x19], rdx
movabs rdx, 0x744a5752612d6569
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30a0007040a010b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x802030a0007040a
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb030303080a030b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x515f04
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x12
jge 0x515f37
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xd
jae 0x515f5e
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xd
jb 0x515ee7
jmp 0x515f52
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
call fcn.00441820
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00453360
mov eax, edi
mov ecx, 0xd
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00515e80

Function at 0x519160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5192a8
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x65653de82059454a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6e7669686165653d
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6b7c72236dc85b66
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7c5957755dfa7d72
mov qword [rsp + 0x32], rdx
movabs rdx, 0x2a796c3875403e20
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x715050b1e131816
mov qword [rsp + 0x42], rdx
movabs rdx, 0x10d13041c1b141f
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x121404091d1b010d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x13240f1b091b0e02
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd171211161c1b0d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x21090b0012001a11
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x519240
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0xffffffe8
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x519271
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x51929b
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0xffffffe8
add r8d, edx
cmp rsi, 0x25
jb 0x519222
jmp 0x51928f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x25
call fcn.00453360
mov eax, edi
mov ecx, 0x25
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00519160
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
push r9
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
pop rsi
add rax, rdx
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1400034d0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
push rdi
lea rbp, [rax - 0x418]
sub rsp, 0x500
mov rax, qword [0x14000d268]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor edi, edi
lea r9, [rbp + 0x428]
mov r8, rcx
mov word [rbp - 0x20], di
mov ebx, 0x207
mov word [rbp + 0x3ee], di
mov edx, ebx
lea rcx, [rbp - 0x20]
call qword [sym.imp.msvcrt.dll__vsnwprintf]
nop dword [rax + rax]
test eax, eax
js 0x14000362f
cdqe
cmp rax, rbx
ja 0x14000362f
jne 0x14000354f
mov word [rbp + 0x3ee], di
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8d, ebx
xor edx, edx
call sub.msvcrt.dll_memset
lea eax, [rbx - 0x62]
mov dword [rsp + 0x70], ebx
mov word [rbp - 0x50], ax
lea rdx, [rbp - 0x20]
lea rax, [rsp + 0x58]
mov dword [rbp - 0x54], 0x81
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
nop dword [rax + rax]
test eax, eax
je 0x140003611
mov rcx, qword [rsp + 0x58]
or edx, 0xffffffff
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov eax, dword [rsp + 0x50]
jmp 0x14000361d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, ecx
jmp 0x140003634
mov eax, 0x8007007a
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.140006d20
add rsp, 0x500
pop rdi
pop rbx
pop rbp
ret

Function at 0x140003d3c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
mov edx, 0x7f0ea553
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
Function at 0x140005168
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x440
mov rax, qword [0x14000d268]
xor rax, rsp
mov qword [rsp + 0x430], rax
cmp byte [0x14000f574], 0
mov rbx, rcx
mov edi, 0x200
mov esi, 0x8007007a
je 0x140005243
lea rcx, [0x14000f668]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx]
movabs r10, 0xe0401e0934d32270
mov rax, qword [rax + 0x10]
lea rdx, [rsp + 0x30]
mov r8d, edi
mov rcx, rbx
call qword [0x140008958]
cmp eax, esi
jne 0x140005208
mov rax, qword [rbx]
movabs r10, 0xf6098f1452d26970
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [0x140008958]
test eax, eax
js 0x140005230
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
nop dword [rax + rax]
lea rcx, [0x14000a51c]
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringW]
nop dword [rax + rax]
lea rcx, [0x14000f668]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rdx, rbx
call fcn.1400055bc
mov rcx, rbx
call fcn.140006674
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx]
movabs r10, 0xe0401e0934d32270
mov rax, qword [rax + 0x10]
lea rdx, [rsp + 0x30]
mov r8, rdi
mov rcx, rbx
call qword [0x140008958]
cmp eax, esi
jne 0x1400052a2
mov rax, qword [rbx]
movabs r10, 0xf6098f1452d26970
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [0x140008958]
test eax, eax
js 0x1400052ef
mov ecx, dword [0x14000f708]
mov rdi, qword [rsp + 0x20]
mov sil, byte [rbx + 0x20]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400052ef
movabs r10, 0xfc611ecf365f1170
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rax, qword [rbx]
mov dl, sil
call qword [0x140008958]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400052c9
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140006d20
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140006cf0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax
mov r12, qword [r14 + 0x30]
cmp r12, 0
cmp esp, 0
je 0x140006d4a
mov r15, qword [r14 + 0x60]
mov rax, qword [r15]
and eax, 0xdf00df
mov r15, qword [r15 + 0xb]
add r15d, eax
shr r15d, 2
sub r15d, 0xc914cd2
cmp r15, 0
je 0x140006d52
mov r14, qword [r14]
jmp 0x140006d1b
invalid
mov r14d, dword [r12 + 0x3c]
add r14, r12
add r14, 0x10
mov r15d, dword [r14 + 0x78]
add r15, r12
push r10
mov eax, dword [r15 + 0x20]
add rax, r12
mov r10d, dword [rax]
add r10, r12
mov r14d, dword [r10 + 0xb]
sub r14d, 0x746365
cmp r14d, 0
jne 0x140006d87
jmp 0x140006d95
inc rax
inc rax
inc rax
inc rax
jmp 0x140006d6e
mov r14d, dword [r15 + 0x20]
sub rax, r14
sub rax, r12
shr eax, 1
mov r14d, dword [r15 + 0x24]
add r14, rax
add r14, r12
mov eax, dword [r14]
mov r14d, dword [r15 + 0x1c]
shl eax, 0x10
shr eax, 0xe
add r14, r12
add r14, rax
mov eax, dword [r14]
add rax, r12
mov r14d, 0x8f000
add r14, r11
push r12
push r11
push r14
push r10
push r10
push rax
mov rcx, r14
mov r9, rsp
mov r8d, 0x40
mov edx, 0xb7000
call rax
pop r15
pop r10
pop r10
pop r14
pop r11
mov r12d, 0x479c
push rax
movabs r15, 0x3ae00
mov eax, 9
imul r12, rax
movabs rax, 0x3195
add rax, r11
add r12, rax
call fcn.140006e4c
mov r12d, 0x67411
movabs r14, 0xcf000
add r12, r11
mov r15d, 0x3b30
add r14, r11
call fcn.140006e4c
pop rax
jmp 0x140006e72
add byte es:[rax], al
invalid
mov r12d, 0x8000000
mov r15d, 0xb6
movabs r14, 0x8f000
mov eax, 0x16
imul r15d, eax
add r15d, 0x5c
pop rsp
add byte [rax], al
add byte [rdi + 3], cl
sub r14, r15
mov r15, r14
sub r15, r12
mov r12d, 0x6c011
add r12, r11
invalid
invalid
invalid

Function at 0x140006f60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140006f88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140006f88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret