joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402b2cb0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov ebx, r8d
mov qword [rbp - 0x40], rdx
mov rsi, rdx
test rcx, rcx
je 0x1402b2cea
add rcx, 0xc
mov rdi, rcx
jmp 0x1402b2cec
xor edi, edi
mov qword [rbp - 0x48], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x54], rcx
mov rdx, rsi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
lea rcx, [rbp - 0x88]
call fcn.140009740
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.140009790
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
call fcn.1400044ac
mov dword [rax + 0xf0], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1402b3fd0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xor eax, eax
mov qword [rbp - 0x78], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov edi, edx
mov rbx, r8
mov rsi, r9
mov r14, qword [rbp + 0x30]
mov r15, qword [rbp + 0x38]
mov r13, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14028b380
nop
lea rcx, [r12 + 0x10]
xor edx, edx
test r12, r12
cmove rcx, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [r13 + 0x10]
xor r8d, r8d
test r13, r13
cmove rdx, r8
mov qword [rbp - 0x58], rdx
lea r8, [r15 + 0x10]
xor r9d, r9d
test r15, r15
cmove r8, r9
mov qword [rbp - 0x60], r8
lea r9, [r14 + 0x10]
xor eax, eax
test r14, r14
cmove r9, rax
mov qword [rbp - 0x68], r9
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x78], rbx
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax + 8]
mov qword [rbp - 0x84], rcx
mov edx, edi
mov dword [rbp - 0x7c], edx
mov r8, rbx
mov qword [rbp - 0x8c], r8
mov r9, rsi
mov qword [rbp - 0x94], r9
lea rcx, [rbp - 0xc0]
call fcn.140009740
mov rcx, qword [rbp - 0x84]
mov edx, dword [rbp - 0x7c]
mov r8, qword [rbp - 0x8c]
mov r9, qword [rbp - 0x94]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov ebx, eax
lea rcx, [rbp - 0xc0]
call fcn.140009790
nop
xor ecx, ecx
mov qword [rbp - 0x78], rcx
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1402b412d
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.14028b3c0
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1402b4270
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov edi, edx
mov rbx, r8
mov rsi, r9
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14028b380
nop
lea rcx, [r13 + 0x10]
xor edx, edx
test r13, r13
cmove rcx, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [r15 + 0x10]
xor r8d, r8d
test r15, r15
cmove rdx, r8
mov qword [rbp - 0x58], rdx
lea r8, [r14 + 0x10]
xor r9d, r9d
test r14, r14
cmove r8, r9
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x68], rsi
mov r9, rsi
lea rax, [rbx + 0x10]
xor r10d, r10d
test rbx, rbx
cmove rax, r10
mov qword [rbp - 0x70], rax
mov r10, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [r10 + 8]
mov qword [rbp - 0x7c], rcx
mov edx, edi
mov dword [rbp - 0x74], edx
mov r8, rax
mov qword [rbp - 0x84], r8
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0xb8]
call fcn.140009740
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x84]
mov r9, qword [rbp - 0x8c]
call sub.ADVAPI32.dll_RegEnumValueW
mov ebx, eax
lea rcx, [rbp - 0xb8]
call fcn.140009790
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1402b43b9
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.14028b3c0
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1402b4680
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14028b380
nop
test rbx, rbx
je 0x1402b46d6
add rbx, 0xc
mov rdx, rbx
jmp 0x1402b46d8
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140009740
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.140009790
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1402b4755
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.14028b3c0
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1404a68a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x1404a693d
xor eax, eax
cmp r8d, 4
jl 0x1404a68f1
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x1404a6938
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x1404a6931
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x1404a6929
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x1404a6921
add rax, 4
test r8d, r8d
jle 0x1404a6b1a
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x1404a6938
inc rax
test r8d, r8d
jg 0x1404a6900
jmp 0x1404a6b1a
add eax, 3
jmp 0x1404a6b15
add eax, 2
jmp 0x1404a6b15
inc eax
jmp 0x1404a6b15
jmp 0x1404a6b15
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x1404a6a56
add rax, 0x10
cmp rax, r10
jbe 0x1404a6960
mov eax, r8d
test al, 7
je 0x1404a6b1a
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1404a6b1a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x1404a6b0c
mov ecx, 0x20
jmp 0x1404a6b0f
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x1404a6afd
mov r8d, 0x20
jmp 0x1404a6b01
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x1404a6b15
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1404b2440
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x1404b2491
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x1404b26bb
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x1404b2485
inc edx
cmp edx, r9d
jl 0x1404b2465
jmp 0x1404b26bb
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [case.0x14049ff71.104]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x1404b25fb
add rax, 0x10
cmp rax, r8
jb 0x1404b24d8
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1404b26bb
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400055d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140039008]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
xor r14d, r14d
mov esi, r14d
mov qword [rbp - 0x61], r14
mov dword [rbp - 0x59], r14d
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x71], r14
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.CLSID
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005769
mov dword [rbp - 0x59], r14d
mov rsi, qword [rbp - 0x71]
mov qword [rbp - 0x61], rsi
mov dword [rbp - 0x59], r14d
mov edi, r14d
mov qword [rbp - 0x49], r14
mov dword [rbp - 0x41], r14d
mov qword [rbp - 0x39], r14
lea rdx, [rbx + 8]
cmp qword [rdx + 0x18], 8
jb 0x140005674
mov rdx, qword [rdx]
mov qword [rbp - 0x71], r14
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005745
mov dword [rbp - 0x41], r14d
mov rdi, qword [rbp - 0x71]
mov qword [rbp - 0x49], rdi
mov dword [rbp - 0x41], r14d
mov dword [rbp - 0x79], 0xa4
lea rax, [rbp - 0x79]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x71]
xor r8d, r8d
lea rdx, str.AppID
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400056e3
jg 0x140005747
jmp 0x14000574f
mov eax, dword [rbp - 0x71]
dec eax
cmp eax, 1
ja 0x140005703
mov eax, dword [rbp - 0x79]
test eax, eax
je 0x14000570a
test al, 1
jne 0x140005703
shr rax, 1
cmp word [rbp + rax*2 - 0x2b], 0
je 0x14000570f
mov eax, 0xd
jmp 0x140005747
mov word [rbp - 0x29], r14w
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x71]
call fcn.1400052b0
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x38], xmm0
mov rax, qword [rbx + 0x38]
cmp rax, qword [0x14002aa20]
jne 0x140005751
mov rax, qword [rbx + 0x40]
cmp rax, qword [0x14002aa28]
jne 0x140005751
mov dword [rbx], 0x80070057
jmp 0x140005751
jle 0x14000574f
movzx eax, ax
or eax, 0x80070000
mov dword [rbx], eax
test rdi, rdi
je 0x140005763
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x49], r14
mov dword [rbp - 0x41], r14d
jmp 0x140005775
jle 0x140005773
movzx eax, ax
or eax, 0x80070000
mov dword [rbx], eax
test rsi, rsi
je 0x140005787
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x61], r14
mov dword [rbp - 0x59], r14d
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140007080
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14000a504
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000a36c
Function at 0x14001124e
Capabilities:
Terminate process

Disassembly:
jmp 0x140013920
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112e9
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014c70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014c90
xor al, al
jmp 0x140014d11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014ca3
xor al, al
jmp 0x140014d11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014ccd
xor al, al
jmp 0x140014d11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014ce1
xor al, al
jmp 0x140014d11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014cf3
xor al, al
jmp 0x140014d11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014d0f
xor al, al
jmp 0x140014d11
mov al, 1
add rsp, 0x38
ret
Function at 0x1400129c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001141f
movzx eax, al
test eax, eax
jne 0x1400129e0
mov ecx, 7
call fcn.140011393
nop
mov byte [rsp + 0x20], 0
call fcn.1400113a7
mov byte [rsp + 0x21], al
cmp dword [0x14001d868], 1
jne 0x140012a04
mov ecx, 7
call fcn.140011393
nop
jmp 0x140012a5c
cmp dword [0x14001d868], 0
jne 0x140012a57
mov dword [0x14001d868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111f4
test eax, eax
je 0x140012a38
mov eax, 0xff
jmp 0x140012b61
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.14001139d
mov dword [0x14001d868], 2
jmp 0x140012a5c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001137f
call fcn.140011311
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012ab9
mov rcx, qword [rsp + 0x30]
call fcn.1400111a4
movzx eax, al
test eax, eax
je 0x140012ab9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.140011343
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012aed
mov rcx, qword [rsp + 0x38]
call fcn.1400111a4
movzx eax, al
test eax, eax
je 0x140012aed
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113de
nop
call fcn.140012c10
mov dword [rsp + 0x28], eax
call fcn.1400112e9
movzx eax, al
test eax, eax
jne 0x140012b0c
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012b1b
call fcn.1400113e8
nop
xor edx, edx
mov cl, 1
call fcn.140011190
mov eax, dword [rsp + 0x28]
jmp 0x140012b61
add rsp, 0x68
ret
Function at 0x1425eb058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1425eb1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1425eb089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1425eb06f
add dl, dl
jne 0x1425eb096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1425eb0f6
xor eax, eax
add dl, dl
jne 0x1425eb0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1425eb1ad
add dl, dl
jne 0x1425eb0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1425eb0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1425eb0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1425eb0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1425eb0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1425eb07e
mov eax, 1
add dl, dl
jne 0x1425eb106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1425eb113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1425eb0fb
sub eax, ebx
mov ebx, 1
jne 0x1425eb14c
mov ecx, 1
add dl, dl
jne 0x1425eb12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1425eb13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1425eb123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1425eb07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1425eb168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1425eb175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1425eb15d
cmp eax, 0x7d00
jae 0x1425eb19b
cmp eax, 0x500
jb 0x1425eb196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1425eb07e
cmp eax, 0x7f
ja 0x1425eb19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1425eb07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1425eb1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1425eb07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400165e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140016786
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1401058c8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140032b40
xorps xmm15, xmm15
mov r14, qword [0x14028b390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001664b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140016660
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x140016685
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140016699
cmp rbx, 0x1000
jae 0x140016655
nop dword [rax]
jmp 0x140016709
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x1400166ad
xor edx, edx
jmp 0x140016700
mov rcx, qword [0x1401058c8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140032b40
xorps xmm15, xmm15
mov r14, qword [0x14028b390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x14001668f
jmp 0x140016674
call fcn.140064b40
xorps xmm15, xmm15
mov r14, qword [0x14028b390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.140037220
lea rax, [0x1401418a8]
mov ebx, 0x18
call fcn.140037b20
mov rax, qword [rsp + 0x38]
call fcn.140037820
lea rax, [0x140141980]
mov ebx, 0x19
call fcn.140037b20
mov rax, qword [rsp + 0x30]
nop
call fcn.140037820
call fcn.140037480
call fcn.1400372a0
lea rax, [0x14014465d]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.1400358e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140060f80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.1400165e0