joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001b710
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800a3bd8]
mov esi, ecx
mov rbx, qword [rax + 0x1c20]
add rbx, 0xc8
cmp dword [rbx], 0
jg 0x18001b759
mov r8d, 0x6c6
lea rdx, str.D:_spcool2imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x18008ec10]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x18001b7ec
lea ecx, [rdx + 1]
test r8d, r8d
je 0x18001b7d8
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18001b7dd
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1800222a0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18001e2e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1800a3bd8]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x30a4], ecx
test rbx, rbx
je 0x18001e34f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.18001e360
lea rdx, [0x180092f9c]
mov rcx, rbx
mov rdi, rax
call fcn.180013650
mov rbx, rax
test rax, rax
je 0x18001e34a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180020750
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x1800a3bd8]
cmp byte [rbx + 0x30a1], 0
jne 0x1800208c6
cmp dword [rbx + 0x30c8], 0
je 0x18002078d
mov r8d, 0x27bf
lea rdx, str.D:_spcool2imguiimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800208bf
lea rdx, [0x180092f98]
mov qword [rsp + 0x40], rdi
call fcn.180013650
mov rdi, rax
test rax, rax
je 0x1800208ba
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800208a7
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800208a7
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1800208a7
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800208a7
mov rbp, rsi
cmp rsi, 0xffffffffffffffff
je 0x1800208a7
mov rax, qword [0x1800a3bd8]
test rax, rax
je 0x180020836
inc dword [rax + 0x3b0]
mov rdx, qword [0x1800a3be8]
mov rcx, rbp
call qword [0x1800a32a0]
mov rsi, rax
test rax, rax
je 0x1800208a7
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rbp
je 0x180020872
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x180020883
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, rbp
mov rcx, rsi
call fcn.180015680
mov rax, qword [0x1800a3bd8]
test rax, rax
je 0x180020895
dec dword [rax + 0x3b0]
mov rdx, qword [0x1800a3be8]
mov rcx, rsi
call qword [0x1800a32a8]
jmp 0x1800208b0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x30a1], 1
movss xmm0, dword [rbx + 0x30a4]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x180020917
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x30a4], xmm0
jb 0x180020917
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x180020906
call fcn.18001e2e0
mov dword [rbx + 0x30a4], 0
add rsp, 0x20
pop rbx
ret
mov byte [rbx + 0x398], 1
mov dword [rbx + 0x30a4], 0
add rsp, 0x20
pop rbx
ret
Function at 0x180038290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x1800a3708]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx r8d, byte [rcx]
movaps xmm6, xmm2
mov ebx, edx
test r8b, r8b
je 0x1800382e5
lea rax, [rcx + 1]
cmp r8b, 0x25
jne 0x1800382d3
cmp byte [rax], r8b
jne 0x1800382e5
cmp r8b, r8b
cmovne rax, rcx
movzx r8d, byte [rax + 1]
lea rcx, [rax + 1]
test r8b, r8b
jne 0x1800382c1
cmp byte [rcx], 0x25
jne 0x1800383ce
cmp byte [rcx + 1], 0x25
je 0x1800383ce
mov r8d, 0x20
lea rdx, [rsp + 0x20]
call fcn.180043870
xorps xmm3, xmm3
lea r8, [rsp + 0x20]
cvtss2sd xmm3, xmm6
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.180013820
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x18003833c
inc rcx
cmp byte [rcx], 0x20
je 0x180038334
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1800383bc
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x180038357
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x18003836d
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x1800383aa
movss xmm2, dword [0x180093280]
cmp al, 0x39
ja 0x1800383aa
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x180038384
cmp r9b, 0x2d
jne 0x1800383c9
xorps xmm1, xmmword [0x1800932f0]
movaps xmm0, xmm1
jmp 0x1800383d1
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1800383d1
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18004ad90
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret
Function at 0x180038400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x1800a3708]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx r8d, byte [rcx]
movaps xmm6, xmm2
mov ebx, edx
test r8b, r8b
je 0x180038455
lea rax, [rcx + 1]
cmp r8b, 0x25
jne 0x180038443
cmp byte [rax], r8b
jne 0x180038455
cmp r8b, r8b
cmovne rax, rcx
movzx r8d, byte [rax + 1]
lea rcx, [rax + 1]
test r8b, r8b
jne 0x180038431
cmp byte [rcx], 0x25
jne 0x180038534
cmp byte [rcx + 1], 0x25
je 0x180038534
mov r8d, 0x20
lea rdx, [rsp + 0x20]
call fcn.180043870
movaps xmm3, xmm6
lea r8, [rsp + 0x20]
movq r9, xmm6
lea rcx, [rsp + 0x40]
mov edx, 0x40
call fcn.180013820
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1800384a8
inc rcx
cmp byte [rcx], 0x20
je 0x1800384a0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x180038526
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1800384c3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x1800384d9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x180038514
movsd xmm2, qword [0x18009a5a0]
cmp al, 0x39
ja 0x180038514
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x1800384f0
cmp r9b, 0x2d
jne 0x18003852f
xorps xmm1, xmmword [0x18009a620]
movaps xmm0, xmm1
jmp 0x180038537
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x180038537
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18004ad90
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret
Function at 0x180049270
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x1800a3708]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x1800492bf
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1800a42c0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x1800492fd
cmp rsi, r14
jb 0x1800492f5
cmp rsi, r15
jae 0x1800492f5
cmp qword [rsi + 8], 0
jne 0x1800494c7
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800492e0
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x180049392
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x180049389
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180049389
cmp dword [rsp + 0x40], 0x10000
je 0x18004940b
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x180049389
sub rbx, rbp
cmp rbx, r14
jae 0x180049350
test rsi, rsi
jne 0x180049470
cmp rdi, r15
ja 0x1800494af
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800494af
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800494af
cmp dword [rsp + 0x40], 0x10000
je 0x180049441
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800493c2
jmp 0x1800494af
test rbx, rbx
je 0x180049389
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180049470
cmp rbx, r14
jae 0x180049330
jmp 0x180049392
test rdi, rdi
je 0x1800494af
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180049470
cmp rdi, r15
jbe 0x1800493a0
jmp 0x1800494af
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x180049480
mov rax, qword [0x1800a42c0]
mov qword [rsi], rax
mov qword [0x1800a42c0], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18004ad90
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x180049d10
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x1800a42bc]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x180049d57
mov rax, qword [0x1800a42b0]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180049d64
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x180049d40
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x180049d57
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.18004a0b0
mov edi, eax
test eax, eax
jne 0x180049e4d
mov r9d, dword [0x1800a42bc]
cmp ebx, r9d
jae 0x180049ddc
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x1800a42b0]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x180049dd5
mov edx, esi
mov ecx, ebx
call fcn.180049f80
mov edi, eax
test eax, eax
jne 0x180049ddc
mov r9d, dword [0x1800a42bc]
inc ebx
cmp ebx, r9d
jb 0x180049da0
cmp qword [rsp + 0x20], 0
je 0x180049e4b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180049e37
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180049e28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180049e00
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800a3c78]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x180049f80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1800a3708]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800a42b0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180049ff3
mov eax, 0xa
jmp 0x18004a082
test esi, esi
je 0x18004a015
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18004a038
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18004a038
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18004a031
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18004a038
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
movzx eax, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18004ad90
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18004a0b0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800a3708]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov r14d, edx
xor edx, edx
mov qword [rcx], r15
mov rbx, rcx
mov qword [rcx + 8], r15
mov ebp, r8d
mov edi, r15d
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18004a258
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x18004a1f5
lea edi, [r15 + 1]
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x18004a1b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18004a1b0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18004a1b0
mov rdx, qword [rbx]
test rdx, rdx
jne 0x18004a172
mov dword [rbx + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x1800a3c78]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x18004a1d8
jmp 0x18004a1a3
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18004a1a3
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [rbx + 8], eax
mov rcx, qword [0x1800a3c78]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18004a1d8
mov qword [rbx], rax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x18004a120
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x18004a1f5
mov r8, qword [rbx]
mov edi, r15d
test r8, r8
je 0x18004a1f5
mov rcx, qword [0x1800a3c78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x18004a258
cmp qword [rbx], r15
je 0x18004a253
mov edi, r15d
cmp dword [rbx + 0xc], r15d
jbe 0x18004a253
mov rax, qword [rbx]
xor edx, edx
mov ecx, edi
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18004a24c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.18004a5c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18004a210
mov eax, r15d
jmp 0x18004a25d
mov eax, 9
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18004ad90
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004a770
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rcx
je 0x18004a7df
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x18004a7c8
mov qword [rsp + 0x38], rsi
mov rax, qword [rdi]
xor edx, edx
mov r8d, dword [rax + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18004a7bc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x18004a790
mov rsi, qword [rsp + 0x38]
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x1800a3c78]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
push rcx
push rsi
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x141c3cc08
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141c3cd8f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141c3cc39
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c3cc1f
add dl, dl
jne 0x141c3cc46
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c3cca6
xor eax, eax
add dl, dl
jne 0x141c3cc55
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c3cd5d
add dl, dl
jne 0x141c3cc66
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c3cc73
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c3cc80
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c3cc8d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141c3cc9a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141c3cc2e
mov eax, 1
add dl, dl
jne 0x141c3ccb6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c3ccc3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c3ccab
sub eax, ebx
mov ebx, 1
jne 0x141c3ccfc
mov ecx, 1
add dl, dl
jne 0x141c3ccde
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c3cceb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c3ccd3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c3cc2e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141c3cd18
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c3cd25
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c3cd0d
cmp eax, 0x7d00
jae 0x141c3cd4b
cmp eax, 0x500
jb 0x141c3cd46
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c3cc2e
cmp eax, 0x7f
ja 0x141c3cd4e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c3cc2e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141c3cd82
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141c3cc2e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400024a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400024ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400024ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400024ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400024ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400024ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400024f0
xor al, al
add rsp, 0x28
ret
Function at 0x14000db9c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000dbcc
xor eax, eax
jmp 0x14000dc8f
mov rbp, rbx
cmp word [rax], si
je 0x14000dbf1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000dbd8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000dbd4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000daec
movsxd r14, eax
test eax, eax
jne 0x14000dc2f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000dbc5
mov rcx, r14
call fcn.14000a39c
mov rdi, rax
test rax, rax
jne 0x14000dc48
xor ecx, ecx
call fcn.140009728
jmp 0x14000dc24
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000daec
test eax, eax
jne 0x14000dc79
mov rcx, rdi
call fcn.140009728
jmp 0x14000dc83
xor ecx, ecx
call fcn.140009728
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret