joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c430
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c47a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c47a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c47a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c47a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c47a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c47c
xor al, al
add rsp, 0x28
ret

Function at 0x140010208
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140010073
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010073
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010073
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010073
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010073
cmp dword [rcx + 0x84], 0xe
jbe 0x140010073
cmp dword [rcx + 0xf8], 0
je 0x140010073
mov ecx, ebx
call fcn.140010124
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000ff00
nop
cmp dword [rbp + 0x20], 0
je 0x1400100c1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400100cc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140010004
Function at 0x1400197f4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001987b
mov rsi, rbx
cmp word [rax], bp
je 0x14001983a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140019824
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140019820
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140017024
mov rdi, rax
test rax, rax
je 0x140019868
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140020a60
mov rbp, rdi
xor ecx, ecx
call fcn.140016048
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001be44
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001be5a
mov al, 1
jmp 0x14001beba
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001be6b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001beb8
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019f98
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001beb8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001beb8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001beb8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001beba
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400202d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400202f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400202f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001c30
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x1800fb080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x180001c5e
test rbx, rbx
je 0x180001c9a
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x180001ccc
test rdi, rdi
je 0x180001c8a
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
test rbx, rbx
je 0x180001c9a
mov ecx, dword [rsp + 0x28]
call fcn.1800010e0
mov dword [rbx], eax
test rsi, rsi
je 0x180001cc8
lea rdx, [rsp + 0x24]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne 0x180001cc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180001ccc
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
xor eax, eax
jmp 0x180001cd1
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800c0500
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180025350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r15
sub rsp, 0x68
mov r15, rdx
mov rdi, rcx
movzx edx, byte [rdx]
movzx eax, dl
cmp dl, 0xb0
jne 0x18002536e
movzx eax, byte [r15 + 2]
cmp al, 0xb1
jne 0x180025378
mov rcx, qword [r15 + 0x20]
jmp 0x180025388
cmp al, 0x8a
jne 0x180025508
mov rax, qword [r15 + 0x20]
mov rcx, qword [rax + 0x20]
movsxd rcx, dword [rcx]
cmp ecx, 1
je 0x180025508
mov dword [r8], 0
cmp dl, 0x8a
jne 0x1800253b2
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.180023110
mov eax, dword [rdi + 0x38]
mov qword [rsp + 0x60], r12
mov r12, rcx
mov qword [rsp + 0x58], r13
lea r13d, [rax + 1]
add eax, ecx
mov dword [rsp + 0x88], r13d
mov dword [rdi + 0x38], eax
test ecx, ecx
jle 0x1800254f3
mov qword [rsp + 0x80], rbx
lea rcx, [0x1800213c0]
mov qword [rsp + 0x90], rbp
mov edx, 2
mov qword [rsp + 0x50], r14
mov ebp, r13d
xor r14d, r14d
mov qword [rsp + 0x98], rsi
lea r13, [fcn.180021570]
cmp byte [rdi + 0x23], 0
mov rax, qword [r15 + 0x20]
mov rbx, qword [r14 + rax + 8]
je 0x180025461
mov word [rsp + 0x44], dx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x180025451
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180084c60
cmp word [rsp + 0x44], 0
je 0x180025461
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.180027480
jmp 0x1800254a1
mov rsi, qword [rdi]
test rbx, rbx
je 0x18002547d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.18001fe70
mov rbx, rax
cmp byte [rsi + 0x67], 0
jne 0x180025491
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call fcn.1800277c0
test rbx, rbx
je 0x1800254a1
mov rdx, rbx
mov rcx, rsi
call fcn.18001fb40
inc ebp
lea rcx, [0x1800213c0]
add r14, 0x20
mov edx, 2
sub r12, 1
jne 0x180025411
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
mov eax, dword [rsp + 0x88]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov r12, qword [rsp + 0x60]
mov eax, r13d
mov r13, qword [rsp + 0x58]
add rsp, 0x68
pop r15
pop rdi
ret
mov rdx, r15
mov rcx, rdi
add rsp, 0x68
pop r15
pop rdi
jmp fcn.180027690
Function at 0x1800302a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x1800302cf
lea r8d, [rdx + 1]
nop dword [rax]
mov ecx, dword [rax + 0xc0]
mov edx, r8d
xor edx, ecx
and edx, 3
xor edx, ecx
mov dword [rax + 0xc0], edx
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1800302b0
ret

Function at 0x180033e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
xor r11d, r11d
mov rdi, r8
mov ebx, r11d
mov r14, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x180033f29
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
lea r12, str.main
mov qword [rsp + 0x20], r15
lea r15, [0x1800e5a20]
nop
mov rax, qword [rsi + 0x20]
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
movsxd rcx, r10d
shl rcx, 5
mov rbp, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x180033ea1
mov r8, qword [rcx + rax]
mov r9, rdi
sub r9, r8
nop dword [rax]
movzx ecx, byte [r8]
movzx eax, byte [r9 + r8]
cmp ecx, eax
jne 0x180033edc
test ecx, ecx
jne 0x180033eea
lea rcx, [rbp + 0x20]
xor r8d, r8d
mov rdx, r14
call fcn.180055940
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x180033ec0
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x180033e60
mov r12, qword [rsp + 0x60]
mov rax, r11
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
movzx edx, byte [rax + r15]
movzx ecx, byte [rcx + r15]
cmp ecx, edx
jne 0x180033eef
inc r8
jmp 0x180033e90
test r10d, r10d
jne 0x180033eb9
mov r9, rdi
mov rax, r12
sub r9, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x180033f15
test edx, edx
je 0x180033ea1
inc rax
jmp 0x180033f00
movzx r8d, byte [rcx + r15]
movzx edx, byte [rdx + r15]
cmp edx, r8d
jne 0x180033eb9
inc rax
jmp 0x180033f00
mov rax, r11
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180085c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0xa0]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x180085e14
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x60], rbp
nop dword [rax + rax]
movsxd r14, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r15d, dword [rsi + 0x14]
shl r14, 5
add r14, qword [r12 + 0x20]
test al, al
jne 0x180085c81
inc dword [rbx + 0x38]
mov ebp, dword [rbx + 0x38]
jmp 0x180085c90
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0xe4]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r15 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x180085cbd
mov r9d, edx
mov dword [rsp + 0x20], r15d
mov edx, 0x37
mov rcx, rdi
call fcn.180029bc0
jmp 0x180085ceb
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r15d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [r14 + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x71
mov r9, qword [r9 + 0x68]
call fcn.180085020
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x180085d2a
mov rcx, rdi
call fcn.180029a70
test eax, eax
jne 0x180085e00
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r13d
lea rax, [rax + rcx*8]
mov ecx, dword [rdi + 0x90]
mov dword [rax + 0xc], r13d
add ecx, 2
mov dword [rax + 8], ecx
mov byte [rax + 1], r13b
mov qword [rax + 0x10], r13
mov word [rax + 2], r13w
mov qword [rax + 0x18], 0x7f
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], 0x61
mov qword [rax + 0x38], 2
mov qword [rax + 0x40], r13
mov qword [rax + 0x48], 0x80
mov qword [rax + 0x50], r13
mov qword [rax + 0x58], r13
mov qword [rax + 0x60], 0x7a
mov qword [rax + 0x68], r13
mov qword [rax + 0x70], r13
add dword [rdi + 0x90], 5
test rax, rax
je 0x180085e00
mov dword [rax + 0x3c], ebp
lea edx, [r15 + 1]
mov dword [rax + 4], edx
lea ecx, [r15 - 1]
mov dword [rax + 0x20], edx
mov dword [rax + 0x34], ecx
mov dword [rax + 0x54], edx
mov dword [rax + 0x50], ebp
mov word [rax + 0x4a], 8
test ebp, ebp
je 0x180085df4
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x180085df4
mov dword [rbx + rax*4 + 0xe4], ebp
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180085c60
mov rbp, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x18008f050
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.1800333a0
test ebx, ebx
jne 0x18008f0b9
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.1800333a0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800c8b68
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1800c8bd7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800c8bd7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800c8bd7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800c8bd7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800c8bd7
cmp dword [rcx + 0x84], 0xe
jbe 0x1800c8bd7
cmp dword [rcx + 0xf8], 0
je 0x1800c8bd7
mov ecx, ebx
call fcn.1800c8c88
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800c8a64
nop
cmp dword [rbp + 0x20], 0
je 0x1800c8c25
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800c8c30
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1800c8b68
Function at 0x1800cf468
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800cf498
xor eax, eax
jmp 0x1800cf55b
mov rbp, rbx
cmp word [rax], si
je 0x1800cf4bd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800cf4a4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800cf4a0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800ccf70
movsxd r14, eax
test eax, eax
jne 0x1800cf4fb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800cf491
mov rcx, r14
call fcn.1800c9838
mov rdi, rax
test rax, rax
jne 0x1800cf514
xor ecx, ecx
call fcn.1800c97fc
jmp 0x1800cf4f0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800ccf70
test eax, eax
jne 0x1800cf545
mov rcx, rdi
call fcn.1800c97fc
jmp 0x1800cf54f
xor ecx, ecx
call fcn.1800c97fc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800d2c08
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1800ca524
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1800d2ca9
cmp ebx, dword [rsp + 0x30]
je 0x1800d2ca2
test esi, esi
je 0x1800d2ca2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1800d2c7d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1800d2c8a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1800d2c67
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1800d2c8e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1800d2cab
mov eax, 1
jmp 0x1800d2cab
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800d63d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800d63f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800d63f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140011398
Capabilities:
Terminate process

Disassembly:
jmp 0x140019190
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001149c
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001a4e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001a500
xor al, al
jmp 0x14001a581
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001a513
xor al, al
jmp 0x14001a581
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001a53d
xor al, al
jmp 0x14001a581
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001a551
xor al, al
jmp 0x14001a581
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001a563
xor al, al
jmp 0x14001a581
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001a57f
xor al, al
jmp 0x14001a581
mov al, 1
add rsp, 0x38
ret
Function at 0x1400182d0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400116fe
movzx eax, al
test eax, eax
jne 0x1400182f0
mov ecx, 7
call fcn.1400115a0
nop
mov byte [rsp + 0x20], 0
call fcn.1400115dc
mov byte [rsp + 0x21], al
cmp dword [0x140025b78], 1
jne 0x140018314
mov ecx, 7
call fcn.1400115a0
nop
jmp 0x14001836c
cmp dword [0x140025b78], 0
jne 0x140018367
mov dword [0x140025b78], 1
lea rdx, [0x140020660]
lea rcx, [0x140020330]
call fcn.140011316
test eax, eax
je 0x140018348
mov eax, 0xff
jmp 0x140018471
lea rdx, [0x140020220]
lea rcx, [section..rdata]
call fcn.1400115c8
mov dword [0x140025b78], 2
jmp 0x14001836c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011587
call fcn.1400114c9
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400183c9
mov rcx, qword [rsp + 0x30]
call fcn.140011276
movzx eax, al
test eax, eax
je 0x1400183c9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002c020]
nop
call fcn.140011528
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400183fd
mov rcx, qword [rsp + 0x38]
call fcn.140011276
movzx eax, al
test eax, eax
je 0x1400183fd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001168b
nop
call fcn.140018520
mov dword [rsp + 0x28], eax
call fcn.14001149c
movzx eax, al
test eax, eax
jne 0x14001841c
mov ecx, dword [rsp + 0x28]
call fcn.140011078
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001842b
call fcn.14001169a
nop
xor edx, edx
mov cl, 1
call fcn.14001124e
mov eax, dword [rsp + 0x28]
jmp 0x140018471
add rsp, 0x68
ret
Function at 0x141046058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410461df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141046089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14104606f
add dl, dl
jne 0x141046096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410460f6
xor eax, eax
add dl, dl
jne 0x1410460a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410461ad
add dl, dl
jne 0x1410460b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410460c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410460d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410460dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410460ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14104607e
mov eax, 1
add dl, dl
jne 0x141046106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141046113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410460fb
sub eax, ebx
mov ebx, 1
jne 0x14104614c
mov ecx, 1
add dl, dl
jne 0x14104612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14104613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141046123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14104607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141046168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141046175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14104615d
cmp eax, 0x7d00
jae 0x14104619b
cmp eax, 0x500
jb 0x141046196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14104607e
cmp eax, 0x7f
ja 0x14104619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14104607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410461d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14104607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180004a70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
mov r8, rcx
je 0x180004af8
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [rax + r9]
xor byte [rax + 7], dl
lea ecx, [rdx - 9]
xor byte [rax - 2], cl
lea rax, [rax + 0xe]
lea ecx, [rdx - 8]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 7]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 6]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 5]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 4]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 3]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 2]
xor byte [rax - 9], cl
lea ecx, [rdx - 1]
xor byte [rax - 8], cl
lea ecx, [rdx + 1]
xor byte [rax - 6], cl
lea ecx, [rdx + 2]
xor byte [rax - 5], cl
lea ecx, [rdx + 3]
xor byte [rax - 4], cl
add dl, 4
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x46
jb 0x180004a90
mov byte [r8 + 0x47], 0
mov rax, r8
ret

Function at 0x180004ea0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x180004ec8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x180004eb0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x180015070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 4
jb 0x18001507d
mov rax, rdx
ret