joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001078
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, r9
mov rdi, rcx
mov r9, qword [rcx]
mov rbx, rdx
mov rcx, rax
call fcn.140005650
cmp rax, rbx
jae 0x1400010bf
mov rcx, qword [rdi]
call fcn.140005398
test eax, eax
je 0x1400010ae
mov edx, 3
jmp 0x1400010c1
mov rcx, qword [rdi]
call fcn.1400053c4
neg eax
sbb edx, edx
and edx, 4
jmp 0x1400010c1
xor edx, edx
mov rbx, qword [rsp + 0x30]
mov eax, edx
mov dword [0x140029cd0], edx
add rsp, 0x20
pop rdi
ret

Function at 0x1400010d4
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx]
mov rax, rdx
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 3]
call fcn.140005650
cmp rax, 4
sbb eax, eax
and eax, 4
mov dword [0x140029cd0], eax
add rsp, 0x28
ret

Function at 0x140001104
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx]
mov rax, rdx
mov edx, 1
mov rcx, rax
mov r8d, edx
call fcn.140005650
cmp rax, 1
sbb eax, eax
and eax, 4
mov dword [0x140029cd0], eax
add rsp, 0x28
ret

Function at 0x1400018d4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov r14, rcx
test rdx, rdx
jne 0x14000190a
lea eax, [rdx + 8]
jmp 0x140001a16
xor r8d, r8d
lea rdx, [rbp - 0x48]
call fcn.140001018
test eax, eax
je 0x140001924
mov ebx, 2
jmp 0x1400019e4
mov ebx, 1
lea r9, [rbp - 0x10]
mov edx, ebx
lea rcx, [rbp - 0x48]
lea r8d, [rbx + 7]
call fcn.140001078
test eax, eax
je 0x140001957
lea edi, [rbx + 2]
sub eax, edi
je 0x140001a0b
cmp eax, ebx
jne 0x140001957
lea edi, [rbx + 3]
jmp 0x140001a0b
mov dword [rbp - 0x50], 0x474e5089
xor ecx, ecx
mov dword [rbp - 0x4c], 0xa1a0a0d
mov al, byte [rbp + rcx - 0x50]
cmp byte [rbp + rcx - 0x10], al
jne 0x140001a06
add rcx, rbx
cmp rcx, 8
jl 0x140001967
mov rdx, rsi
lea rcx, [rbp - 0x48]
call fcn.140001738
test eax, eax
je 0x140001995
mov ebx, 7
jmp 0x1400019e4
mov rcx, qword [rbp - 0x48]
call fcn.140007f84
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.140008914
movsxd rcx, dword [rbp - 0x2c]
call fcn.140005b48
mov rdi, rax
test rax, rax
je 0x1400019e4
movsxd rdx, dword [rbp - 0x2c]
mov r8, rbx
mov r9, qword [rbp - 0x48]
mov rcx, rax
call fcn.140005650
movsxd rcx, dword [rbp - 0x2c]
cmp rax, rcx
jae 0x1400019f1
mov rcx, rdi
call fcn.140005b34
mov ebx, 4
lea rcx, [rbp - 0x48]
call fcn.140001000
mov eax, ebx
jmp 0x140001a16
mov qword [rsi + 0x10], rcx
lea rcx, [rbp - 0x48]
mov qword [rsi + 0x18], rdi
call fcn.140001000
xor eax, eax
jmp 0x140001a16
mov edi, 7
lea rcx, [rbp - 0x48]
call fcn.140001000
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001ad0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400024b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400024fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400024fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400024fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400024fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400024fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002500
xor al, al
add rsp, 0x28
ret

Function at 0x140008804
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x14001e748]
mov rbp, rcx
call fcn.140010734
xor edi, edi
test rax, rax
je 0x1400088ea
mov ebx, edi
call fcn.14000b02c
mov r14d, dword [rax]
call fcn.14000b02c
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.140010680
mov rsi, rax
test rax, rax
je 0x14000887b
call fcn.14000b02c
mov dword [rax], r14d
jmp 0x1400088a5
call fcn.14000b02c
cmp dword [rax], 0x22
jne 0x1400088e2
call fcn.14000b02c
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140010680
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1400088e2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1400088a9
cmp rax, 3
je 0x1400088c4
mov rcx, rsi
call fcn.140008760
test al, al
je 0x1400088d5
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1400088d5
mov dil, 1
mov rcx, rbx
call fcn.140005b34
mov al, dil
jmp 0x1400088ec
mov rcx, rbx
call fcn.140005b34
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001ad0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400097b4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140009823
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009823
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009823
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009823
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009823
cmp dword [rcx + 0x84], 0xe
jbe 0x140009823
cmp dword [rcx + 0xf8], 0
je 0x140009823
mov ecx, ebx
call fcn.1400098d4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400096b0
nop
cmp dword [rbp + 0x20], 0
je 0x140009871
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000987c
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400097b4

Function at 0x1400099b8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400097b4
Function at 0x14000c278
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14002a7d0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14000c2cf
cmp word [rdx], r13w
jne 0x14000c2cf
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14000c2d4
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14000c3f9
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14000c41a
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14000c30d
mov rdx, r9
mov word [rbx], cx
jmp 0x14000c334
cmp r9, r8
jae 0x14000c344
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14000c2ee
jmp 0x14000c3f9
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000c3ee
cmp dword [rsp + 0x80], esi
je 0x14000c3ee
lea r8, [0x14002a7d0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14000c3c6
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14000c396
mov word [rbx], r13w
jmp 0x14000c3f6
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14000c3a3
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14000c3f6
cmp word [rsp + 0x70], r13w
jne 0x14000c3d3
cmp rbx, r14
je 0x14000c390
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140010198
cmp word [rsp + 0x70], r13w
je 0x14000c3f9
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14002a7d0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14000c3f3
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14000c3f9
Function at 0x14000db98
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14000dbae
mov al, 1
jmp 0x14000dc0e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14000dbbf
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14000dc0c
mov ecx, dword [rcx + 0x18]
nop
call fcn.140010e60
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000dc0c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14000dc0c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14000dc0c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14000dc0e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140012954
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140012984
xor eax, eax
jmp 0x140012a47
mov rbp, rbx
cmp word [rax], si
je 0x1400129a9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140012990
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001298c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140012874
movsxd r14, eax
test eax, eax
jne 0x1400129e7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14001297d
mov rcx, r14
call fcn.14000deac
mov rdi, rax
test rax, rax
jne 0x140012a00
xor ecx, ecx
call fcn.14000b50c
jmp 0x1400129dc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140012874
test eax, eax
jne 0x140012a31
mov rcx, rdi
call fcn.14000b50c
jmp 0x140012a3b
xor ecx, ecx
call fcn.14000b50c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140012a64
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140012aeb
mov rsi, rbx
cmp word [rax], bp
je 0x140012aaa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140012a94
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140012a90
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000deac
mov rdi, rax
test rax, rax
je 0x140012ad8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001be80
mov rbp, rdi
xor ecx, ecx
call fcn.14000b50c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140017058
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400170a2
call fcn.14000b00c
mov dword [rax], 0xf
call fcn.14000b02c
mov dword [rax], 0xd
call fcn.14000aef0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140001ad0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1400170ad
lea eax, [rbx + 1]
jmp 0x14001708f
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x14001708d
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x14001708f

Function at 0x140018f20
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140008528
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140018faa
cmp byte [rbp - 0x21], r15b
je 0x140018fa5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140018fe0
call fcn.14000e120
test eax, eax
jne 0x140018fcc
cmp byte [rbp - 0x21], r15b
je 0x140018fc4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140018fe0
cmp byte [rbp - 0x21], r15b
je 0x140018fdd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140008010
test eax, eax
jne 0x140019080
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140008528
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001901f
cmp byte [rbp - 0x21], r15b
je 0x140019054
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140019054
call fcn.14000e120
test eax, eax
jne 0x140019040
cmp byte [rbp - 0x21], r15b
je 0x140019039
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140019054
cmp byte [rbp - 0x21], r15b
je 0x140019051
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140008010
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140019080
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140019083
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140019091
mov rcx, rdi
call fcn.14000b50c
cmp byte [rbp + 0x3f], r15b
je 0x1400190a0
mov rcx, qword [rbp + 0x27]
call fcn.14000b50c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140019218
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140010198
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140010198
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140019368
cmp rax, 0xffffffffffffffff
je 0x140019368
xor edi, edi
test rbp, rbp
jle 0x140019313
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14000de34
mov rbx, rax
test rax, rax
jne 0x1400192a0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140019309
mov edx, 0x8000
mov ecx, r14d
call fcn.140009a34
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14000d798
cmp eax, 0xffffffff
je 0x1400192e9
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400192b0
mov edx, r15d
mov ecx, r14d
call fcn.140009a34
jmp 0x140019309
cmp byte [rsi + 0x38], dil
je 0x140019300
cmp dword [rsi + 0x34], 5
jne 0x140019300
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140019309
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14000b50c
jmp 0x14001937c
jns 0x14001937c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140010198
cmp rax, 0xffffffffffffffff
jne 0x140019334
cmp byte [rsi + 0x30], dil
je 0x14001937c
mov edi, dword [rsi + 0x2c]
jmp 0x14001937c
mov ecx, r14d
call fcn.140010e60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14001937c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14001937c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140019375
mov eax, dword [rsi + 0x2c]
jmp 0x14001937a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140010198
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14001b500
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001b528
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001b528
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001510
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [section..textshe]
test rdi, rdi
je 0x1400015da
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1400015da
mov r9d, edi
mov r8d, 0xb4edc
mov rdx, rax
lea rcx, [0x140362008]
call sym.ConsoleApplication1.exe_LZ4_decompress_safe
test eax, eax
jns 0x14000156b
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
jmp 0x1400015da
movsxd rsi, eax
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140001560
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop
call rdi
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400015df
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140002120
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000216a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000216a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000216a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000216a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000216a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000216c
xor al, al
add rsp, 0x28
ret
Function at 0x140007290
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400072f1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400072b0
mov ecx, dword [r9]
jmp 0x1400073d8
cmp ecx, 0x4e0
jb 0x1400073d8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140007310
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140007360
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140018e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp + 8], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x73], rdi
mov byte [rsp + 0x7b], dil
mov dword [rsp + 0x68], 0x646e6977
mov dword [rsp + 0x6c], 0x2073776f
mov word [rsp + 0x70], 0x3131
mov byte [rsp + 0x72], dil
mov qword [rbp - 0x75], rdi
mov byte [rbp - 0x6d], dil
mov dword [rbp - 0x80], 0x646e6977
mov dword [rbp - 0x7c], 0x2073776f
mov word [rbp - 0x78], 0x3031
mov byte [rbp - 0x76], dil
mov qword [rbp - 0x5c], rdi
mov dword [rbp - 0x68], 0x646e6977
mov dword [rbp - 0x64], 0x2073776f
mov dword [rbp - 0x60], 0x312e38
mov qword [rbp - 0x45], rdi
mov byte [rbp - 0x3d], dil
mov dword [rbp - 0x50], 0x646e6977
mov dword [rbp - 0x4c], 0x2073776f
mov word [rbp - 0x48], 0x3031
mov byte [rbp - 0x46], dil
mov qword [rbp - 0x2e], rdi
mov word [rbp - 0x26], di
mov dword [rbp - 0x38], 0x646e6977
mov dword [rbp - 0x34], 0x2073776f
mov word [rbp - 0x30], 0x37
mov dword [rsp + 0x5e], edi
mov word [rsp + 0x62], di
mov dword [rsp + 0x50], 0x646e6977
mov dword [rsp + 0x54], 0x2073776f
mov dword [rsp + 0x58], 0x74736956
mov word [rsp + 0x5c], 0x61
mov qword [rbp], 0x6e6f69
movdqa xmm0, xmmword [0x140023d20]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140023dc0]
movdqu xmmword [rbp - 0x10], xmm1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
xor r8d, r8d
lea rdx, [0x1400238b0]
call fcn.140003cc0
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x4b], edi
mov dword [rsp + 0x40], 0x56746547
mov dword [rsp + 0x44], 0x69737265
mov word [rsp + 0x48], 0x6e6f
mov byte [rsp + 0x4a], dil
mov word [rsp + 0x3d], di
mov dword [rsp + 0x30], 0x6e72654b
mov dword [rsp + 0x34], 0x32336c65
mov dword [rsp + 0x38], 0x6c6c642e
mov byte [rsp + 0x3c], dil
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028c28], rax
call rax
mov ecx, eax
shr ecx, 0x10
cmp eax, 0x80000000
cmovae ecx, edi
cmp ecx, 0x4e20
jb 0x140018ffd
lea rdx, [rsp + 0x68]
jmp 0x140019050
cmp ecx, 0x2710
jb 0x14001900b
lea rdx, [rbp - 0x80]
jmp 0x140019050
cmp ecx, 0x2580
jb 0x140019019
lea rdx, [rbp - 0x68]
jmp 0x140019050
cmp ecx, 0x23f0
jb 0x140019027
lea rdx, [rbp - 0x50]
jmp 0x140019050
cmp ecx, 0x1b58
jb 0x140019035
lea rdx, [rbp - 0x38]
jmp 0x140019050
cmp ecx, 0x1770
jb 0x140019044
lea rdx, [rsp + 0x50]
jmp 0x140019050
cmp ecx, 0x7d0
jb 0x140019058
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140006ed0
mov rax, rbx
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.14001df90
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret