joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017adfc
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
test rcx, rcx
jne 0x14017ae1b
call fcn.1401865e0
jmp 0x14017aed0
and qword [rbp - 0x30], 0
lea rcx, [rbp - 0x50]
and qword [rbp - 0x28], 0
xor edx, edx
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov byte [rbp - 8], 0
call fcn.1401769dc
mov rax, qword [rbp - 0x48]
mov r9d, 0xfde9
cmp dword [rax + 0xc], r9d
jne 0x14017ae66
cmp byte [rbp - 0x38], 0
je 0x14017ae9b
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14017ae9b
call fcn.140181fcc
test eax, eax
jne 0x14017ae87
cmp byte [rbp - 0x38], al
je 0x14017ae7f
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14017ae9b
cmp byte [rbp - 0x38], 0
je 0x14017ae98
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
xor r9d, r9d
lea r8, [rbp + 0x10]
mov rcx, rbx
lea rdx, [rbp - 0x30]
call fcn.14017ac80
test eax, eax
je 0x14017aeb4
or ebx, 0xffffffff
jmp 0x14017aebf
mov rcx, qword [rbp - 0x20]
call fcn.1401865e0
mov ebx, eax
cmp byte [rbp - 8], 0
je 0x14017aece
mov rcx, qword [rbp - 0x20]
call fcn.140181d7c
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret

Function at 0x14017e4f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14016b170
sub rsp, rax
mov rax, qword [0x140250f68]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14017db58
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14017e53f
mov rax, rbp
jmp 0x14017e647
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x254230]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140187a70
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x254230]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14017e643
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14017e643
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140187a70
test rax, rax
js 0x14017e643
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14017e643
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14017e635
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14017e635
cmp byte [rcx], 0xd
jne 0x14017e61b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14017e62a
cmp byte [rcx + 1], 0xa
jne 0x14017e62a
inc rcx
jmp 0x14017e62a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x2512a0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14017e5fd
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14017e647
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14016ae50
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14017f30c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x140250f68]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x140230188]
mov rbp, rcx
call fcn.140188030
xor edi, edi
test rax, rax
je 0x14017f3f2
mov ebx, edi
call fcn.14017eaa0
mov r14d, dword [rax]
call fcn.14017eaa0
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.140187f7c
mov rsi, rax
test rax, rax
je 0x14017f383
call fcn.14017eaa0
mov dword [rax], r14d
jmp 0x14017f3ad
call fcn.14017eaa0
cmp dword [rax], 0x22
jne 0x14017f3ea
call fcn.14017eaa0
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140187f7c
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x14017f3ea
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x14017f3b1
cmp rax, 3
je 0x14017f3cc
mov rcx, rsi
call fcn.14017f268
test al, al
je 0x14017f3dd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x14017f3dd
mov dil, 1
mov rcx, rbx
call fcn.140174dc4
mov al, dil
jmp 0x14017f3f4
mov rcx, rbx
call fcn.140174dc4
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14016ae50
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140186a40
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140186a56
mov al, 1
jmp 0x140186ab6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140186a67
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140186ab4
mov ecx, dword [rcx + 0x18]
nop
call fcn.140185110
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140186ab4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140186ab4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140186ab4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140186ab6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140186ca8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140254230]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140186cff
cmp word [rdx], r13w
jne 0x140186cff
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140186d04
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140186e29
mov r11d, recv
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140186e4a
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140186d3d
mov rdx, r9
mov word [rbx], cx
jmp 0x140186d64
cmp r9, r8
jae 0x140186d74
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140186d1e
jmp 0x140186e29
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140186e1e
cmp dword [rsp + 0x80], esi
je 0x140186e1e
lea r8, [0x140254230]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140186df6
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140186dc6
mov word [rbx], r13w
jmp 0x140186e26
mov ecx, recv
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140186dd3
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140186e26
cmp word [rsp + 0x70], r13w
jne 0x140186e03
cmp rbx, r14
je 0x140186dc0
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140187a78
cmp word [rsp + 0x70], r13w
je 0x140186e29
mov ecx, recv
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140254230]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140186e23
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140186e29
Function at 0x140189fcc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140189ffc
xor eax, eax
jmp 0x14018a0bf
mov rbp, rbx
cmp word [rax], si
je 0x14018a021
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14018a008
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14018a004
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140189eec
movsxd r14, eax
test eax, eax
jne 0x14018a05f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140189ff5
mov rcx, r14
call fcn.1401826ac
mov rdi, rax
test rax, rax
jne 0x14018a078
xor ecx, ecx
call fcn.140181d7c
jmp 0x14018a054
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140189eec
test eax, eax
jne 0x14018a0a9
mov rcx, rdi
call fcn.140181d7c
jmp 0x14018a0b3
xor ecx, ecx
call fcn.140181d7c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14018a0dc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14018a163
mov rsi, rbx
cmp word [rax], bp
je 0x14018a122
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14018a10c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14018a108
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1401826ac
mov rdi, rax
test rax, rax
je 0x14018a150
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14016bc80
mov rbp, rdi
xor ecx, ecx
call fcn.140181d7c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14019071c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140187a78
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140187a78
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14019086c
cmp rax, 0xffffffffffffffff
je 0x14019086c
xor edi, edi
test rbp, rbp
jle 0x140190817
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140181d04
mov rbx, rax
test rax, rax
jne 0x1401907a4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14019080d
mov edx, 0x8000
mov ecx, r14d
call fcn.14017ec4c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140185b48
cmp eax, 0xffffffff
je 0x1401907ed
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1401907b4
mov edx, r15d
mov ecx, r14d
call fcn.14017ec4c
jmp 0x14019080d
cmp byte [rsi + 0x38], dil
je 0x140190804
cmp dword [rsi + 0x34], 5
jne 0x140190804
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
cmp byte [rsi + 0x30], dil
je 0x14019080d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140181d7c
jmp 0x140190880
jns 0x140190880
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140187a78
cmp rax, 0xffffffffffffffff
jne 0x140190838
cmp byte [rsi + 0x30], dil
je 0x140190880
mov edi, dword [rsi + 0x2c]
jmp 0x140190880
mov ecx, r14d
call fcn.140185110
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140190880
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], send
jmp 0x140190880
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140190879
mov eax, dword [rsi + 0x2c]
jmp 0x14019087e
mov eax, reloc.WS2_32.dll_shutdown
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140187a78
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140050790
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400507da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400507da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400507da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400507da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400507da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400507dc
xor al, al
add rsp, 0x28
ret

Function at 0x140051ae0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140051c28

Function at 0x140051c28
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140051c28
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140051c97
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140051c97
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140051c97
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140051c97
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140051c97
cmp dword [rcx + 0x84], 0xe
jbe 0x140051c97
cmp dword [rcx + 0xf8], 0
je 0x140051c97
mov ecx, ebx
call fcn.140051b60
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140051dbc
nop
cmp dword [rbp + 0x20], 0
je 0x140051ce5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140051bf4
int3

Function at 0x140053220
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140053248
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140053248
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140058d4c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140058d7c
xor eax, eax
jmp 0x140058e3f
mov rbp, rbx
cmp word [rax], si
je 0x140058da1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140058d88
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140058d84
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140058c6c
movsxd r14, eax
test eax, eax
jne 0x140058ddf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140058d75
mov rcx, r14
call fcn.14005780c
mov rdi, rax
test rax, rax
jne 0x140058df8
xor ecx, ecx
call fcn.1400567e0
jmp 0x140058dd4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140058c6c
test eax, eax
jne 0x140058e29
mov rcx, rdi
call fcn.1400567e0
jmp 0x140058e33
xor ecx, ecx
call fcn.1400567e0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400a7010
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400a701d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400a702d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400a7015
lea eax, [rcx + 1]
jmp 0x1400a703b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400a704e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400a7034
sub eax, 3
jb 0x1400a706e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400a70bd
sar eax, 1
movsxd rbp, eax
jb 0x1400a70a4
jmp 0x1400a707c
add ebx, ebx
jne 0x1400a707a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400a70a4
inc ecx
add ebx, ebx
jne 0x1400a708a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400a70a4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400a709d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400a708c
add ecx, 2
jmp 0x1400a70a9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400a6fd2
jmp 0x1400a701d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x71800
mov dl, 0x13
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400a710d
cmp rsi, rcx
jae 0x1400a7115
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400a70f4
cmp al, 0x8f
ja 0x1400a70f4
cmp byte [rsi - 2], 0xf
je 0x1400a70fa
sub al, 0xe8
cmp al, 1
ja 0x1400a70de
cmp rsi, rcx
jae 0x1400a7115
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400a70e4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400a7115
lodsb al, byte [rsi]
jmp 0x1400a70f4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xa2000]
mov eax, dword [rdi]
or eax, eax
je 0x1400a717e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa71dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400a7122
jns 0x1400a7157
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1400a7161
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400a7178
mov qword [rbx], rax
add rbx, 8
jmp 0x1400a7142
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400a71b8
cmp al, 0xef
ja 0x1400a71aa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400a718a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400a7199
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x257]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400a720c
sub rsp, 0xffffffffffffff80
jmp 0x140067ee0
Function at 0x1400014b4
Capabilities:
Find process by pid

Disassembly:
sub rsp, 0x28
lea rdx, [0x1400040a0]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x1400014d0
mov eax, 0xc0000001
jmp 0x1400014df
mov rcx, qword [0x1400040a0]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor eax, eax
add rsp, 0x28
ret

Function at 0x1410ae058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1410ae1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1410ae089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410ae06f
add dl, dl
jne 0x1410ae096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410ae0f6
xor eax, eax
add dl, dl
jne 0x1410ae0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410ae1ad
add dl, dl
jne 0x1410ae0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410ae0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410ae0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410ae0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410ae0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1410ae07e
mov eax, 1
add dl, dl
jne 0x1410ae106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410ae113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410ae0fb
sub eax, ebx
mov ebx, 1
jne 0x1410ae14c
mov ecx, 1
add dl, dl
jne 0x1410ae12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410ae13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410ae123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410ae07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1410ae168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1410ae175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410ae15d
cmp eax, 0x7d00
jae 0x1410ae19b
cmp eax, 0x500
jb 0x1410ae196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410ae07e
cmp eax, 0x7f
ja 0x1410ae19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1410ae07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410ae1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1410ae07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20