joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053c30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140053c5d
xor eax, eax
jmp 0x140053db2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140053c88
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140053c88
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140053db2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140053da5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140053ccb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140053cf6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140053daa
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140053d65
sub eax, 1
je 0x140053d65
cmp eax, 2
jne 0x140053da5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140053daa
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140053d93
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140053da5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140053daa
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006ce00
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140053f80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140053fa5
xor eax, eax
mov r8d, 0x165d
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x24
jb 0x140053f90
mov byte [rcx + 0x4a], 0
ret

Function at 0x140053fb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x140053fd5
xor eax, eax
mov r8d, 0x165d
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x27
jb 0x140053fc0
mov byte [rcx + 0x50], 0
ret
Function at 0x140053fe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140054005
xor eax, eax
mov r8d, 0x165d
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1e
jb 0x140053ff0
mov byte [rcx + 0x3e], 0
ret

Function at 0x140054010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x140054035
xor eax, eax
mov r8d, 0x165d
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1a
jb 0x140054020
mov byte [rcx + 0x36], 0
ret

Function at 0x140054040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x140054065
xor eax, eax
mov r8d, 0x165d
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x25
jb 0x140054050
mov byte [rcx + 0x4c], 0
ret

Function at 0x140054070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x140054095
xor eax, eax
mov r8d, 0x165d
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x22
jb 0x140054080
mov byte [rcx + 0x46], 0
ret

Function at 0x1400540a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x1400540c5
xor eax, eax
mov r8d, 0x165d
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2b
jb 0x1400540b0
mov byte [rcx + 0x58], 0
ret

Function at 0x140054460
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140054533
cmp byte [rcx + 0x71], 0
je 0x140054533
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14005452f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400544f4
sub eax, 1
je 0x1400544f8
cmp eax, 2
jne 0x14005452f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006ce00
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140054526
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14005452f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400544dc
xor al, al
jmp 0x1400544dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006ce00
add rsp, 0x60
pop rbx
ret
Function at 0x14005c380
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14005c498
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14005c498
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x14005c3f8
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x14005c4a5
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x14005c486
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x14005c486
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x14005c45f
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x48]
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x14005c476
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14005c9d0
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
mov rdx, qword [rsp + 0x50]
cmp rbx, rbp
jb 0x14005c410
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x14005c4a5
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14006ce00
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14005e080
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
xor ebp, ebp
mov ebx, ebp
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14005e114
test rbx, rbx
je 0x14005e0dc
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14005e0c6
test eax, eax
jns 0x14005e153
test rbx, rbx
je 0x14005e12e
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006ce00
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
test rbx, rbx
je 0x14005e12e
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14005e11d
nop
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], socket
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14005e192
lea rcx, [rsp + 0x28]
call fcn.140054910
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14005e1b3
mov rdx, qword [r14]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14005e216
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14005e207
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e202
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e267
call fcn.14006cef0
inc edi
cmp edi, dword [rbx]
jb 0x14005e160
jmp 0x14005e11d
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14005e273
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e26e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005e26e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cef0
mov rax, rdi
jmp 0x14005e130
Function at 0x140063c00
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, dword [0x14009418c]
movsxd rax, dword [0x1400930bc]
xor esi, esi
mov edx, esi
cmp eax, 0x7b
ja 0x140063c46
lea rdx, [0x1400930f0]
mov rdx, qword [rdx + rax*8]
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], recv
mov byte [rbp - 0x28], 0
test rdx, rdx
jne 0x140063cb2
mov dword [rbp - 0x40], 0x3090130
mov dword [rbp - 0x3c], 0x21491c04
mov dword [rbp - 0x38], 0x100150e
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140063c80
mov byte [rbp - 0x35], 0
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140063ca2
lea rdx, [rbp - 0x40]
jmp 0x140063cca
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140063cc0
lea rcx, [rbp - 0x28]
call fcn.140054910
cmp edi, 1
jne 0x140063d39
movdqa xmm0, xmmword [0x140087a80]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], reloc.WS2_32.dll_socket
mov byte [rbp - 0x2e], dil
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x140063d00
mov byte [rbp - 0x2e], 0
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140063d20
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.140054910
movss xmm0, dword [0x1400877e0]
movss dword [rbp - 0x40], xmm0
movss xmm1, dword [0x1400877a8]
movss dword [rbp - 0x3c], xmm1
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x40]
call fcn.14003e2c0
test al, al
je 0x140063d90
test edi, edi
jne 0x140063d90
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x14005f5b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140063dce
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063dc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140063dc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006cef0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006ce00
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140063df0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140063e13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x63]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x140063e00
mov byte [rcx + 0x12], 0
mov rax, rcx
ret
Function at 0x140064500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
movdqa xmm0, xmmword [0x1400879d0]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x1319041e
mov dword [rsp + 0x34], 0x16181b57
mov dword [rsp + 0x38], 0x191917
mov byte [rsp + 0x3c], 1
nop dword [rax]
nop word [rax + rax]
lea edx, [rax + 0x63]
xor byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x1b
jb 0x140064540
mov rcx, qword [0x140070250]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x3c], 0
call fcn.1400590a0
lea rdx, [0x140054ca0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
add rsp, 0x48
ret
Function at 0x140065930
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x140065953
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x63]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x140065940
mov byte [rcx + 7], 0
mov rax, rcx
ret
Function at 0x140069610
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x140069633
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x63]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x140069620
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x14006a770
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x14006a793
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x63]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4b
jb 0x14006a780
mov byte [rcx + 0x4c], 0
mov rax, rcx
ret

Function at 0x14006a7a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4d], 0
je 0x14006a7c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x63]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x4c
jb 0x14006a7b0
mov byte [rcx + 0x4d], 0
mov rax, rcx
ret

Function at 0x14006a7d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14006a7f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x63]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x14006a7e0
mov byte [rcx + 0x18], 0
mov rax, rcx
ret
Function at 0x14006af50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5a], 0
je 0x14006af73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x63]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x59
jb 0x14006af60
mov byte [rcx + 0x5a], 0
mov rax, rcx
ret

Function at 0x14006af80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5b], 0
je 0x14006afa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x63]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5a
jb 0x14006af90
mov byte [rcx + 0x5b], 0
mov rax, rcx
ret

Function at 0x14006d4c8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1400a46e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400a470d
xor al, al
jmp 0x1400a486f
mov rax, qword [0x1400c56c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400c56c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400c56d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400c56d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400c56e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400c56e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400c56f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400c56f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400c5700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400a4861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400a47b9
mov r11d, 2
jmp 0x1400a47dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400a47d3
mov r11d, 1
jmp 0x1400a47dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400a4885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400a4822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400a483a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400a484a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400a4858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400a47a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400a486a
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
xor r9, r9
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1406fa058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406fa1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406fa089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406fa06f
add dl, dl
jne 0x1406fa096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406fa0f6
xor eax, eax
add dl, dl
jne 0x1406fa0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406fa1ad
add dl, dl
jne 0x1406fa0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fa0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fa0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fa0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406fa0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406fa07e
mov eax, 1
add dl, dl
jne 0x1406fa106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fa113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406fa0fb
sub eax, ebx
mov ebx, 1
jne 0x1406fa14c
mov ecx, 1
add dl, dl
jne 0x1406fa12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406fa13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406fa123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406fa07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406fa168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406fa175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406fa15d
cmp eax, 0x7d00
jae 0x1406fa19b
cmp eax, 0x500
jb 0x1406fa196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406fa07e
cmp eax, 0x7f
ja 0x1406fa19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406fa07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406fa1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406fa07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
test rax, rax
je 0x140004ca5
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140004ca5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140004c95
nop
cmp rbx, rcx
jae 0x140004ca5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140004c80
cmp rbx, rcx
jae 0x140004ca5
cmp word [rbx], 0
je 0x140004ca5
mov rax, rbx
jmp 0x140004ca7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret