joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002030
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x14000c100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000c0e0]
test rbx, rbx
je 0x140002084
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000207b
test r12, r12
je 0x14000207b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002060
lea rcx, [0x14000c100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400022b0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x1400022c0
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x1400022d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002315
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x14000230c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140002317
add rax, 0x28
cmp rax, r9
jne 0x1400022f8
xor eax, eax
ret

Function at 0x1400023c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x1400096e0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140002439
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140002439
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140002436
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x14000242d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140002439
add r8, 0x28
cmp r8, r9
jne 0x140002418
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x140002520
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400096e0]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000258f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14000258f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x14000258d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002584
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002598
add rax, 0x28
cmp rax, r9
jne 0x140002570
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x1400025b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1400096e0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x140002628
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140002628
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x140002628
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002628
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x14000261c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140002630
add rdx, 0x28
cmp rdx, r10
jne 0x140002608
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x140002640
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x14000264e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002625
test r8d, r8d
jg 0x140002638
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x140003190
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword gs:[0x30]
mov r14, r8
mov rbp, qword [rcx + 0x88]
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x4478
add rcx, 0x818
mov r9, qword [rax + 0x60]
lea rax, [0x1400c1920]
sub rbp, qword [r9 + 0x10]
add rbp, rax
mov qword [rsp + 0x60], 0
call sym.VBoxNetNAT.exe_nocrt_memset
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
mov r9d, 0x4478
mov qword [rsp + 0x20], rax
lea r8, [rdi + 0x818]
mov rdx, rbp
call qword [0x1400bf250]
test eax, eax
js 0x1400032f3
mov edx, dword [rdi + 0x830]
cmp edx, esi
je 0x1400032e0
mov byte [rdi + 0x4c8b], 0
lea rbx, [rdi + 0x88c]
mov byte [rdi + 0x88b], 0
lea rbp, [rdi + 0x83c]
mov r9d, dword [rdi + 0x838]
lea rcx, str.supR3HardenedWinCheckChild:_enmRequest_d_rc_d_enmWhat_d__s:__s_n
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
call fcn.14000cf80
mov eax, dword [rdi + 0x830]
cmp eax, 2
jne 0x140003316
mov rcx, qword [rdi + 0x18]
xor edx, edx
call qword [0x1400bf2a0]
test eax, eax
js 0x140003340
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x78], 0xfffffffffd050f80
call fcn.140001cff
test eax, eax
je 0x1400032bd
mov edx, eax
lea rcx, str.supR3HardNtChildProcessRequest:_Child_is_taking_too_long_to_quit__rcWait_x___killing_it..._n
call fcn.14000cf80
mov rcx, qword [rdi]
mov edx, 0x40010004
call qword [0x1400bf320]
mov edx, dword [rdi + 0x838]
lea r9, [0x14007f8f0]
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x20], rbx
test edx, edx
jne 0x140003370
jmp 0x14000335e
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x28], eax
lea r9, str.NtReadVirtualMemory___p___failed_reading_child_process_status:__x_n
mov r8d, eax
mov qword [rsp + 0x20], rbp
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140007f40
int3
mov qword [rsp + 0x30], r14
lea r9, str.Unexpected_child_request__d._Was_expecting__d___s_._n
mov dword [rsp + 0x28], esi
lea rdx, str.supR3HardenedWinCheckChild
mov r8d, 0xfffffffe
mov dword [rsp + 0x20], eax
mov rcx, rdi
call fcn.140007f40
int3
lea r9, str.NtSetEvent_failed:__x_n
mov dword [rsp + 0x20], eax
mov r8d, eax
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140007f40
int3
mov edx, 5
lea rcx, str.supR3HardenedWinCheckChild
call fcn.14000cd10
int3
mov rcx, rbp
call fcn.14000cd10
int3
Function at 0x140015990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rcx + 0x10], 2
mov r11, rcx
mov r8, qword [rdx]
movabs rax, 0x112e0be826d694b3
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
lea r9, [rdx - 1]
sub r8d, eax
cmovns r9, rdx
test r8d, r8d
lea eax, [r8 + 0x3b9aca00]
cmovns eax, r8d
mov dword [rcx + 0xc], eax
movabs rax, 0x8888888888888889
imul r9
add rdx, r9
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3c
lea r8d, [rdx - 1]
sub r9d, eax
lea eax, [r9 + 0x3c]
movzx ecx, al
movzx eax, r9b
cmovns ecx, eax
test r9d, r9d
mov byte [r11 + 0xb], cl
mov eax, 0x88888889
cmovns r8d, edx
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
lea r9d, [rdx - 1]
sub r8d, eax
cmovns r9d, edx
test r8d, r8d
lea eax, [r8 + 0x3c]
movzx ecx, al
movzx eax, r8b
cmovns ecx, eax
mov eax, 0x2aaaaaab
imul r9d
mov byte [r11 + 0xa], cl
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea ecx, [rdx - 1]
shl eax, 3
sub r9d, eax
cmovns ecx, edx
test r9d, r9d
lea eax, [r9 + 0x18]
movzx edx, al
movzx eax, r9b
cmovns edx, eax
mov eax, 0x92492493
mov byte [r11 + 9], dl
imul ecx
mov eax, 0x92492493
add edx, ecx
sar edx, 2
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
mov r8d, ecx
imul edx, edx, 7
sub r8d, edx
add r8d, 0xa
imul r8d
add edx, r8d
lea r10, [0x140086d90]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub r8d, eax
mov eax, 0xb38cf9b1
mov byte [r11 + 5], r8b
imul ecx
add edx, ecx
sar edx, 8
mov r8d, edx
add edx, 0x12c
shr r8d, 0x1f
add r8d, edx
lea edx, [r8 + 1]
cmp dword [r10 + rdx*4], ecx
jg 0x140015b0c
nop dword [rax + rax]
inc r8d
lea edx, [rdx + 1]
cmp dword [r10 + rdx*4], ecx
jle 0x140015b00
cmp dword [r10 + r8*4], ecx
jle 0x140015b1b
dec r8d
cmp dword [r10 + r8*4], ecx
jg 0x140015b12
sub ecx, dword [r10 + r8*4]
lea r9d, [r8 + 0x686]
mov dword [r11], r9d
lea eax, [rcx + 1]
mov word [r11 + 6], ax
mov eax, r9d
and eax, 0x80000003
jge 0x140015b42
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140015b85
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul r8d, edx, 0x64
cmp r9d, r8d
jne 0x140015b81
mov eax, 0x51eb851f
imul r9d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x190
cmp r9d, eax
jne 0x140015b85
mov al, 1
jmp 0x140015b87
xor al, al
test al, al
lea rdx, [0x140086d48]
movzx eax, al
lea r10, [0x140086d68]
cmove r10, rdx
xor eax, 1
inc eax
shl eax, 6
or eax, 2
mov dword [r11 + 0x10], eax
mov eax, ecx
cdq
inc ecx
and edx, 0x1f
add eax, edx
sar eax, 5
movsxd r9, eax
movzx r8d, word [r10 + r9*2 + 2]
cmp r8d, ecx
jg 0x140015be1
nop dword [rax + rax]
movsxd rdx, r9d
inc r9d
movzx r8d, word [r10 + rdx*2 + 4]
cmp r8d, ecx
jle 0x140015bd0
lea eax, [r9 + 1]
mov byte [r11 + 4], al
movsxd rax, r9d
sub cl, byte [r10 + rax*2]
mov rax, r11
inc cl
mov dword [r11 + 0x14], 0
mov byte [r11 + 8], cl
ret
Function at 0x14001b090
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword [rcx + 0x28]
mov r8, rcx
xor edx, edx
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b0cd
mov edx, dword [rax + 0x3c]
cmp edx, 0x800
jbe 0x14001b0cd
mov al, byte [2]
inc al
mov byte [2], al
int3
mov r9d, edx
add r9, rax
mov qword [r8 + 0x30], r9
cmp dword [r9], 0x4550
je 0x14001b0f1
mov al, byte [3]
inc al
mov byte [3], al
int3
mov eax, pe_nt_image_headers64
cmp word [r9 + 0x14], ax
je 0x14001b10e
mov al, byte [4]
inc al
mov byte [4], al
int3
mov eax, 0x20b
cmp word [r9 + 0x18], ax
je 0x14001b12b
mov al, byte [5]
inc al
mov byte [5], al
int3
cmp dword [r9 + 0x84], 0x10
je 0x14001b146
mov al, byte [6]
inc al
mov byte [6], al
int3
mov dword [r8 + 0x38], edx
movzx eax, word [r9 + 6]
lea ecx, [rax*4 + 0x21]
add ecx, eax
lea eax, [rdx + rcx*8]
mov edx, eax
mov dword [r8 + 0x3c], eax
mov eax, dword [r9 + 0x50]
mov dword [r8 + 0x40], eax
mov rax, qword [r9 + 0x88]
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x28
jb 0x14001b18e
cmp eax, edx
jb 0x14001b18e
mov edx, dword [r9 + 0x50]
cmp eax, edx
jae 0x14001b18e
add ecx, eax
cmp ecx, edx
jbe 0x14001b19f
mov cl, byte [7]
inc cl
mov byte [7], cl
int3
mov r10d, eax
mov rcx, rax
add r10, qword [r8 + 0x28]
shr rcx, 0x20
mov dword [r8 + 0x44], eax
mov dword [r8 + 0x48], ecx
mov eax, dword [r10 + 0x14]
dec eax
cmp eax, 0xffffe
ja 0x14001b1d2
mov eax, dword [r10 + 0x18]
cmp eax, 0x100000
jae 0x14001b1d2
cmp eax, 1
jae 0x14001b1e7
mov al, byte [8]
inc al
mov byte [8], al
int3
mov edi, dword [r8 + 0x3c]
mov dword [r8 + 0x5c], eax
mov ecx, dword [r10 + 0x18]
cmp ecx, dword [r10 + 0x14]
cmovb ecx, dword [r10 + 0x14]
mov dword [r8 + 0x58], ecx
mov r11d, dword [r10 + 0x1c]
cmp r11d, edi
jb 0x14001b21b
mov ebx, dword [r9 + 0x50]
cmp r11d, ebx
jae 0x14001b21b
lea rdx, [r11 + rcx*4]
cmp rdx, rbx
jbe 0x14001b234
mov al, byte [9]
inc al
mov byte [9], al
int3
mov rbx, qword [r8 + 0x28]
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x50], rax
mov r11d, dword [r10 + 0x20]
cmp r11d, edi
jb 0x14001b262
cmp r11d, dword [r9 + 0x50]
jae 0x14001b262
mov ecx, dword [r10 + 0x18]
mov eax, dword [r9 + 0x50]
lea rdx, [r11 + rcx*4]
cmp rdx, rax
jbe 0x14001b27f
mov al, byte [0xa]
inc al
mov byte [0xa], al
int3
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x60], rax
mov r11d, dword [r10 + 0x24]
cmp r11d, edi
jb 0x14001b2a8
mov r9d, dword [r9 + 0x50]
cmp r11d, r9d
jae 0x14001b2a8
mov ecx, dword [r10 + 0x18]
lea rdx, [r11 + rcx*4]
cmp rdx, r9
jbe 0x14001b2c1
mov al, byte [0xb]
inc al
mov byte [0xb], al
int3
mov rdi, qword [rsp + 0x10]
mov eax, r11d
add rax, rbx
mov rbx, qword [rsp + 8]
mov qword [r8 + 0x68], rax
ret
Function at 0x1400202a0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rsi, r9
mov edi, r8d
mov ebp, edx
mov rbx, rcx
cmp r8d, 2
jne 0x1400202c1
call fcn.1400247f0
mov edi, eax
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x80]
xor r9d, r9d
mov rcx, rbx
lea r8d, [r9 + 4]
call qword [case.0x14002093f.0]
test eax, eax
js 0x1400204a0
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x40], r13
mov r13d, 0x5a4d
mov qword [rsp + 0x38], r14
mov r14d, 0x584c
mov qword [rsp + 0x30], r15
cmp ax, r13w
je 0x140020351
cmp eax, 0x4550
je 0x140020351
cmp eax, 0x464c457f
je 0x140020351
cmp ax, r14w
je 0x140020351
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x140020351
cmp eax, 0xfefaedfe
je 0x140020351
cmp eax, 0xcefaedfe
je 0x140020351
cmp eax, 0xcafebabe
je 0x140020351
cmp eax, 0xbebafeca
jne 0x1400203dd
mov dword [rsp + 0x70], 0
mov r12d, 0x454c
lea r15d, [r12 + 2]
cmp ax, r13w
jne 0x1400203e7
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x70]
mov r9d, 0x3c
mov rcx, rbx
lea r8d, [r9 - 0x38]
call qword [case.0x14002093f.0]
test eax, eax
js 0x14002048c
mov eax, dword [rsp + 0x70]
cmp eax, 0x40
jbe 0x1400203dd
mov r9d, eax
lea rdx, [rsp + 0x80]
mov rax, qword [rbx + 8]
mov r8d, 4
mov rcx, rbx
call qword [case.0x14002093f.0]
test eax, eax
js 0x14002048c
mov eax, dword [rsp + 0x80]
cmp eax, 0x4550
je 0x1400203ee
cmp ax, r14w
je 0x1400203e7
cmp ax, r12w
je 0x1400203e7
cmp ax, r15w
je 0x1400203e7
mov eax, 0xfffffda8
jmp 0x14002048c
cmp eax, 0x4550
jne 0x140020416
mov rax, qword [rsp + 0x90]
mov r8d, edi
mov r9d, dword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.1400411b0
mov ecx, eax
jmp 0x14002048a
cmp eax, 0x464c457f
jne 0x140020424
mov ecx, 0xfffffda7
jmp 0x14002048a
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x140020485
cmp eax, 0xfefaedfe
je 0x140020485
cmp eax, 0xcefaedfe
je 0x140020485
cmp eax, 0xcafebabe
je 0x140020485
cmp eax, 0xbebafeca
je 0x140020485
cmp ax, r14w
jne 0x140020458
mov ecx, 0xfffffda5
jmp 0x14002048a
cmp ax, r12w
jne 0x140020465
mov ecx, 0xfffffda4
jmp 0x14002048a
cmp ax, r15w
jne 0x140020472
mov ecx, 0xfffffda3
jmp 0x14002048a
cmp ax, r13w
mov ecx, 0xfffffda8
mov edx, 0xfffffda2
cmove ecx, edx
jmp 0x14002048a
mov ecx, 0xfffffda8
mov eax, ecx
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140024570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x1400245b9
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x1400245cf
mov r10b, 1
jmp 0x1400245d8
cmp cl, 0x2d
jne 0x1400245e1
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x1400245c2
lea rbx, [0x140000000]
test edx, edx
jne 0x140024636
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x14002466e
cmp r8d, 1
jbe 0x140024621
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x140024621
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0xa7950], 0x10
jae 0x140024621
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x14002466e
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0xa7950], 8
jae 0x14002466e
mov edi, 8
jmp 0x14002466e
mov edi, edx
cmp edx, 0x10
jne 0x14002466e
cmp byte [rax], 0x30
jne 0x14002466e
cmp r8d, 1
jbe 0x14002466e
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x140024656
cmp cl, 0x58
jne 0x14002466e
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0xa7950], 0x10
jae 0x14002466e
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0xa7a50]
mov rbx, r9
test r8d, r8d
je 0x1400246d7
lea r13, [0x140000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x1400246cd
movzx esi, byte [rcx + r13 + 0xa7950]
cmp esi, edi
jae 0x1400246cd
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x1400246be
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x1400246c4
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x140024691
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x1400246fa
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x140024703
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x140024726
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x140024773
cmp byte [rax], r9b
je 0x140024773
test r8d, r8d
je 0x140024773
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x14002474d
cmp cl, 9
jne 0x140024760
inc rax
add r8d, 0xffffffff
jne 0x140024740
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x140024756
test cl, cl
je 0x140024756
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret
Function at 0x14003d300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rcx + 0xb8]
mov qword [rcx + 0x130], rax
mov eax, dword [rcx + 0xb4]
mov qword [rcx + 0x128], rax
mov eax, dword [rcx + 0xb0]
mov qword [rcx + 0x120], rax
mov eax, dword [rcx + 0xac]
mov qword [rcx + 0x118], rax
mov eax, dword [rcx + 0xa8]
mov qword [rcx + 0x110], rax
mov eax, dword [rcx + 0xa4]
mov qword [rcx + 0x108], rax
mov eax, dword [rcx + 0xa0]
mov qword [rcx + 0x100], rax
mov eax, dword [rcx + 0x9c]
mov qword [rcx + 0xf8], rax
mov eax, dword [rcx + 0x98]
mov dword [rcx + 0xf4], eax
mov eax, dword [rcx + 0x94]
mov dword [rcx + 0xf0], eax
mov eax, dword [rcx + 0x90]
mov qword [rcx + 0xe8], rax
movzx eax, word [rcx + 0x8e]
mov word [rcx + 0xe6], ax
movzx eax, word [rcx + 0x8c]
mov word [rcx + 0xe4], ax
mov eax, dword [rcx + 0x88]
mov dword [rcx + 0xe0], eax
mov eax, dword [rcx + 0x84]
mov qword [rcx + 0xd8], rax
mov eax, dword [rcx + 0x80]
mov qword [rcx + 0xd0], rax
mov eax, dword [rcx + 0x7c]
mov qword [rcx + 0xc8], rax
mov eax, dword [rcx + 0x78]
mov qword [rcx + 0xc0], rax
mov eax, dword [rcx + 0x74]
mov qword [rcx + 0xb8], rax
mov eax, dword [rcx + 0x70]
mov qword [rcx + 0xb0], rax
mov eax, dword [rcx + 0x6c]
mov qword [rcx + 0xa8], rax
mov eax, dword [rcx + 0x68]
mov qword [rcx + 0xa0], rax
mov eax, dword [rcx + 0x64]
mov dword [rcx + 0x9c], eax
mov eax, dword [rcx + 0x60]
mov dword [rcx + 0x98], eax
movzx eax, word [rcx + 0x5e]
mov word [rcx + 0x96], ax
movzx eax, word [rcx + 0x5c]
mov word [rcx + 0x94], ax
mov eax, dword [rcx + 0x58]
mov dword [rcx + 0x90], eax
mov eax, dword [rcx + 0x54]
mov qword [rcx + 0x88], rax
mov eax, dword [rcx + 0x50]
mov qword [rcx + 0x80], rax
mov eax, dword [rcx + 0x4c]
mov qword [rcx + 0x78], rax
mov eax, dword [rcx + 0x48]
mov qword [rcx + 0x70], rax
mov eax, dword [rcx + 0x44]
mov qword [rcx + 0x68], rax
mov eax, dword [rcx + 0x40]
mov qword [rcx + 0x60], rax
mov eax, dword [rcx + 0x3c]
mov qword [rcx + 0x58], rax
mov eax, dword [rcx + 0x38]
mov qword [rcx + 0x50], rax
movzx eax, word [rcx + 0x36]
mov word [rcx + 0x4e], ax
movzx eax, word [rcx + 0x34]
mov word [rcx + 0x4c], ax
mov eax, dword [rcx + 0x2c]
mov dword [rcx + 0x48], eax
mov eax, dword [rcx + 0x30]
mov qword [rcx + 0x40], rax
mov eax, dword [rcx + 0x28]
mov qword [rcx + 0x38], rax
mov eax, dword [rcx + 0x24]
mov qword [rcx + 0x30], rax
mov eax, dword [rcx + 0x20]
mov qword [rcx + 0x28], rax
mov eax, dword [rcx + 0x1c]
mov qword [rcx + 0x20], rax
mov eax, dword [rcx + 0x18]
mov qword [rcx + 0x18], rax
ret
Function at 0x1400646e0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0xf]
and rax, 0xfffffffffffffff0
jbe 0x14006470d
mov rdx, qword [0x1400bf9d0]
dec rax
shr rax, 3
inc rax
nop dword [rax + rax]
xor qword [rcx], rdx
lea rcx, [rcx + 8]
sub rax, 1
jne 0x140064700
xor eax, eax
ret
Function at 0x140a07058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140a071df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a07089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a0706f
add dl, dl
jne 0x140a07096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a070f6
xor eax, eax
add dl, dl
jne 0x140a070a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a071ad
add dl, dl
jne 0x140a070b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a070c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a070d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a070dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a070ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a0707e
mov eax, 1
add dl, dl
jne 0x140a07106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a07113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a070fb
sub eax, ebx
mov ebx, 1
jne 0x140a0714c
mov ecx, 1
add dl, dl
jne 0x140a0712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a0713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a07123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a0707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a07168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a07175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a0715d
cmp eax, 0x7d00
jae 0x140a0719b
cmp eax, 0x500
jb 0x140a07196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a0707e
cmp eax, 0x7f
ja 0x140a0719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a0707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a071d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a0707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180003500
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.180016540
test al, al
jne 0x180003524
nop dword [rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180016540
test al, al
je 0x180003510
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x180003530
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x20a
call fcn.18001b174
xor edx, edx
mov r8d, 0x20a
mov rcx, rax
mov rbx, rax
call fcn.18001d780
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x104
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.mstsc
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x1800035a4
call fcn.180016540
test al, al
jne 0x1800035a4
nop dword [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180016540
test al, al
je 0x180003590
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x18000b4c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18000b4f4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18000b4e0
ret