joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x450678
movzx edx, byte [rax]
nop
test edx, edx
jne 0x45053c
test r8b, r8b
jne 0x45053c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x45054f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x450638
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x450626
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x45061c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x4505a3
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x4505e6
mov eax, 1
cmp rax, rbx
ja 0x4505d5
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.004627c0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x450614
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x4505dd
mov r8d, eax
mov eax, r10d
jmp 0x4505a8
mov rcx, rbx
call fcn.00462700
xor eax, eax
mov rcx, rax
call fcn.00462700
mov eax, r8d
mov rcx, rbx
call fcn.004627c0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45066e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x450631
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x450555
mov eax, edx
mov rcx, rbx
call fcn.00462700
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00462700
nop
int3
Function at 0x458180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458239
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00458280]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045ff60
xorps xmm15, xmm15
mov r14, qword [0x0065cdb0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004600a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00458180
Function at 0x462140
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40332f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409c80
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004600a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403300
cmp byte [0x0065cbd1], 0
je 0x462155
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45f1a0
jmp 0x403300

Function at 0x462160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0065cea0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0065cbd1], 0
je 0x462195
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0065d1e0]
aesenc xmm0, xmmword [0x0065d1f0]
aesenc xmm0, xmmword [0x0065d200]
movq rax, xmm0
ret
jmp 0x409e80

Function at 0x4621a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0065cea0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0065cbd1], 0
je 0x4621d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0065d1e0]
aesenc xmm0, xmmword [0x0065d1f0]
aesenc xmm0, xmmword [0x0065d200]
movq rax, xmm0
ret
jmp 0x409ee0

Function at 0x463be0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0065d160]
mov qword [rsp + 8], rdx
lea r8d, [0x0065cbe8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00462080
add rsp, 0x30
ret

Function at 0x464120
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x464150
mov rcx, 0x28
jmp 0x46415b
shl rcx, 3
add rcx, 0x1480
mov qword [0x0065cdb0], rcx
ret
Function at 0x470800
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x47086b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x470824
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x470841
cmp rdx, 0
je 0x47088d
test rdx, 0xf
je 0x47081d
test rdx, 7
jne 0x470841
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x47081d
ret
Function at 0x47f1c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x47f1ff
jb 0x47f214
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x47f280
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x47f350
jb 0x47f3af
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0047f160
aeskeygenassist xmm1, xmm0, 1
call fcn.0047f180
aeskeygenassist xmm1, xmm2, 2
call fcn.0047f160
aeskeygenassist xmm1, xmm0, 2
call fcn.0047f180
aeskeygenassist xmm1, xmm2, 4
call fcn.0047f160
aeskeygenassist xmm1, xmm0, 4
call fcn.0047f180
aeskeygenassist xmm1, xmm2, 8
call fcn.0047f160
aeskeygenassist xmm1, xmm0, 8
call fcn.0047f180
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047f160
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047f180
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047f160
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047f180
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047f160
jmp 0x47f41d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0047f0c0
aeskeygenassist xmm1, xmm2, 2
call fcn.0047f120
aeskeygenassist xmm1, xmm2, 4
call fcn.0047f0c0
aeskeygenassist xmm1, xmm2, 8
call fcn.0047f120
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047f0c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047f120
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047f0c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0047f120
jmp 0x47f41d
aeskeygenassist xmm1, xmm0, 1
call fcn.0047f080
aeskeygenassist xmm1, xmm0, 2
call fcn.0047f080
aeskeygenassist xmm1, xmm0, 4
call fcn.0047f080
aeskeygenassist xmm1, xmm0, 8
call fcn.0047f080
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047f080
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047f080
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0047f080
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0047f080
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0047f080
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0047f080
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x47f42a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x14000ae60
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002dd78]
test rcx, rcx
je 0x14000ae9b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000ae8e
mov rcx, qword [0x14002dd78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002dd78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14003cdd0], 0
je 0x14000af8e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140028888]
mov qword [rsp + 0x80], rsi
lea rsi, [0x1400305a0]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000af6f
test al, 0x10
je 0x14000af6f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000af15
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x402060
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00408624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x4021e8
mov rax, qword [0x00408628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x4020ac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x402135
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x402090
mov rcx, rbx
call fcn.00402d00
test rax, rax
mov r12, rax
je 0x40221d
mov rax, qword [0x00408628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00402e30
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x402200
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40212e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x402190
add dword [0x00408624], 1
cmp edi, 8
jae 0x402163
test dil, 4
jne 0x4021d4
test edi, edi
je 0x402158
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x4021ef
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x402158
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40217c
jmp 0x402158
add rsi, qword [0x00408628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40212e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00403230
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x402158
xor esi, esi
jmp 0x4020b7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x402158
mov rax, qword [0x00408628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00403230
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00403230
nop
nop dword [rax]

Function at 0x402970
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x4029c4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4029bb
test rsi, rsi
je 0x4029bb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4029a0
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x402d00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00405340]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x402d6d
mov rcx, r8
call fcn.00402be0
test eax, eax
je 0x402d6d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402d6d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402d64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402d6f
add rax, 0x28
cmp rax, r9
jne 0x402d50
xor eax, eax
add rsp, 0x28
ret

Function at 0x403230
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.004030c0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.004030c0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140014ac0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011280
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400139c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400139e0
xor al, al
jmp 0x140013a61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400139f3
xor al, al
jmp 0x140013a61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140013a1d
xor al, al
jmp 0x140013a61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140013a31
xor al, al
jmp 0x140013a61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140013a43
xor al, al
jmp 0x140013a61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140013a5f
xor al, al
jmp 0x140013a61
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113b1
Capabilities:
Capture process snapshot data

Disassembly:
jmp 0x140011820
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1588
call fcn.1400110af
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3d6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x15a8]
mov rax, qword [0x14001e158]
xor rax, rbp
mov qword [rbp + 0x1548], rax
lea rcx, [0x14002400f]
call fcn.14001138e
lea r9, [rbp + 0xf38]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1570]
call fcn.1400113bb
mov dword [rbp + 0x424], eax
cmp dword [rbp + 0x424], 0
je 0x1400118b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____PssCaptureSnapshot_failed:_Win32_error__d__n
call fcn.140011195
xor eax, eax
jmp 0x140011978
mov r9d, 0x2c0
lea r8, [rbp + 0xc40]
xor edx, edx
mov rcx, qword [rbp + 0xf38]
call fcn.1400111f4
mov dword [rbp + 0x424], eax
cmp dword [rbp + 0x424], 0
je 0x1400118f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____PssQuerySnapshot_failed:_Win32_error__d__n
call fcn.140011195
xor eax, eax
jmp 0x140011978
lea rax, [rbp + 0xf18]
mov qword [rsp + 0x20], rax
mov r9d, 0x7c8
lea r8, [rbp + 0x450]
mov rdx, qword [rbp + 0xc48]
mov rcx, qword [rbp + 0x1570]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp qword [rbp + 0xf18], 0
jne 0x140011949
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._____peb_ReadProcessMemory_failed:_Win32_error__d__n
call fcn.140011195
xor eax, eax
jmp 0x140011978
mov r8d, 0x400
mov rdx, qword [rbp + 0x4a8]
lea rcx, [rbp + 0x10]
call fcn.1400111b3
mov rdx, qword [rbp + 0x20]
lea rcx, str._i___AFTER_kct.__fnDWORD_:__0_16p__n
call fcn.140011195
mov eax, 1
jmp 0x140011978
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001adb0]
call fcn.14001131b
mov rax, rdi
mov rcx, qword [rbp + 0x1548]
xor rcx, rbp
call fcn.1400111ae
lea rsp, [rbp + 0x1558]
pop rdi
pop rbp
ret
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x141a1b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141a1b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141a1b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a1b06f
add dl, dl
jne 0x141a1b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a1b0f6
xor eax, eax
add dl, dl
jne 0x141a1b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141a1b1ad
add dl, dl
jne 0x141a1b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a1b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a1b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a1b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141a1b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141a1b07e
mov eax, 1
add dl, dl
jne 0x141a1b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141a1b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a1b0fb
sub eax, ebx
mov ebx, 1
jne 0x141a1b14c
mov ecx, 1
add dl, dl
jne 0x141a1b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141a1b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a1b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a1b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141a1b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141a1b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141a1b15d
cmp eax, 0x7d00
jae 0x141a1b19b
cmp eax, 0x500
jb 0x141a1b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a1b07e
cmp eax, 0x7f
ja 0x141a1b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141a1b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141a1b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141a1b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
movups xmm0, xmmword [0x1400152c0]
movups xmmword [rax - 0x48], xmm0
movzx eax, word [0x1400152d0]
mov word [rsp + 0x40], ax
mov al, byte [0x1400152d2]
mov byte [rsp + 0x42], al
call fcn.140001140
xor r13d, r13d
jmp 0x14000104a
mov rax, qword [rax]
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
jne 0x140001047
mov rsi, qword [rax + 0x10]
mov rbx, r13
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
add rcx, rsi
mov edi, dword [rcx + 0x1c]
mov r14d, dword [rcx + 0x20]
add rdi, rsi
mov r15d, dword [rcx + 0x24]
add r14, rsi
mov r12d, dword [rcx + 0x18]
add r15, rsi
test r12, r12
je 0x1400010b1
movzx eax, word [r15 + rbx*2]
lea rdx, [0x1400152b0]
mov ecx, dword [r14 + rbx*4]
add rcx, rsi
mov ebp, dword [rdi + rax*4]
add rbp, rsi
call fcn.14000cee0
test eax, eax
je 0x1400010b9
inc rbx
cmp rbx, r12
jb 0x140001087
mov rbp, qword [rsp + 0x80]
lea rdx, str.VirtualProtect
mov rcx, rsi
call rbp
lea rdx, str.CreateThread
mov rcx, rsi
mov rbx, rax
call rbp
lea rdx, str.WaitForSingleObject
mov rcx, rsi
mov rdi, rax
call rbp
mov edx, 0x13
lea r9, [rsp + 0x80]
lea rcx, [rsp + 0x30]
mov rsi, rax
lea r8d, [rdx + 0x2d]
call rbx
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea r8, [rsp + 0x30]
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call rdi
or edx, 0xffffffff
mov rcx, rax
call rsi
lea r11, [rsp + 0x50]
xor eax, eax
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140001140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret

Function at 0x140003748
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140003574