joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bb6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bb8
xor al, al
add rsp, 0x28
ret

Function at 0x14094e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14094e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14094e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14094e06f
add dl, dl
jne 0x14094e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14094e0f6
xor eax, eax
add dl, dl
jne 0x14094e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14094e1ad
add dl, dl
jne 0x14094e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14094e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14094e07e
mov eax, 1
add dl, dl
jne 0x14094e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14094e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14094e0fb
sub eax, ebx
mov ebx, 1
jne 0x14094e14c
mov ecx, 1
add dl, dl
jne 0x14094e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14094e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14094e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14094e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14094e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14094e15d
cmp eax, 0x7d00
jae 0x14094e19b
cmp eax, 0x500
jb 0x14094e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094e07e
cmp eax, 0x7f
ja 0x14094e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14094e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14094e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140005d40
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005daf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005daf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005daf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005daf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005daf
cmp dword [rcx + 0x84], 0xe
jbe 0x140005daf
cmp dword [rcx + 0xf8], 0
je 0x140005daf
mov ecx, ebx
call fcn.140005e60
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005c3c
nop
cmp dword [rbp + 0x20], 0
je 0x140005dfd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005e08
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005d40

Function at 0x140005f44
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005daf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005daf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005daf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005daf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005daf
cmp dword [rcx + 0x84], 0xe
jbe 0x140005daf
cmp dword [rcx + 0xf8], 0
je 0x140005daf
mov ecx, ebx
call fcn.140005e60
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005c3c
nop
cmp dword [rbp + 0x20], 0
je 0x140005dfd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005e08
int3
xor r8d, r8d
xor edx, edx
jmp 0x140005d40
Function at 0x14000b320
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000b350
xor eax, eax
jmp 0x14000b413
mov rbp, rbx
cmp word [rax], si
je 0x14000b375
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000b35c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000b358
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000b240
movsxd r14, eax
test eax, eax
jne 0x14000b3b3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000b349
mov rcx, r14
call fcn.140006720
mov rdi, rax
test rax, rax
jne 0x14000b3cc
xor ecx, ecx
call fcn.1400066e4
jmp 0x14000b3a8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000b240
test eax, eax
jne 0x14000b3fd
mov rcx, rdi
call fcn.1400066e4
jmp 0x14000b407
xor ecx, ecx
call fcn.1400066e4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000da30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400220f0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14000da87
cmp word [rdx], r13w
jne 0x14000da87
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14000da8c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14000dbb1
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14000dbd2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14000dac5
mov rdx, r9
mov word [rbx], cx
jmp 0x14000daec
cmp r9, r8
jae 0x14000dafc
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14000daa6
jmp 0x14000dbb1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000dba6
cmp dword [rsp + 0x80], esi
je 0x14000dba6
lea r8, [0x1400220f0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14000db7e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14000db4e
mov word [rbx], r13w
jmp 0x14000dbae
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14000db5b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14000dbae
cmp word [rsp + 0x70], r13w
jne 0x14000db8b
cmp rbx, r14
je 0x14000db48
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400119b4
cmp word [rsp + 0x70], r13w
je 0x14000dbb1
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400220f0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14000dbab
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14000dbb1
Function at 0x1400101cc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400101e2
mov al, 1
jmp 0x140010242
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400101f3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140010240
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000bc40
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140010240
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140010240
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140010240
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140010242
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140011280
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14000a310
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001130a
cmp byte [rbp - 0x21], r15b
je 0x140011305
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140011340
call fcn.140006fa4
test eax, eax
jne 0x14001132c
cmp byte [rbp - 0x21], r15b
je 0x140011324
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140011340
cmp byte [rbp - 0x21], r15b
je 0x14001133d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400098f0
test eax, eax
jne 0x1400113e0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14000a310
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001137f
cmp byte [rbp - 0x21], r15b
je 0x1400113b4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400113b4
call fcn.140006fa4
test eax, eax
jne 0x1400113a0
cmp byte [rbp - 0x21], r15b
je 0x140011399
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400113b4
cmp byte [rbp - 0x21], r15b
je 0x1400113b1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400098f0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400113e0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400113e3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400113f1
mov rcx, rdi
call fcn.1400066e4
cmp byte [rbp + 0x3f], r15b
je 0x140011400
mov rcx, qword [rbp + 0x27]
call fcn.1400066e4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403aa1c6

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403abda5
Function at 0x140120041
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x1401615b8
jmp 0x140442b30
push rsi
or sil, 0x90
mov sil, 0xe3
sbb si, r14w
push rdi
movzx ax, spl
inc al
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x18]
cmove ax, cx
mov rax, qword [rcx]
xor edx, edx
sub r8d, r8d
jmp 0x140442b60
call qword [rax + 0x188]
mov edi, eax
not cx
cmovnp ecx, r11d
lea rcx, [rsi + 0x30]
jmp 0x140442b78
call fcn.140456715
test edi, edi
jmp 0x140442b84
je 0x140442bbc
cmp edi, 0x8899000c
jmp 0x140442b95
jne 0x140442bd6
mov rcx, rsi
xchg edi, esi
sub dil, 0x7b
bsr rdi, r14
add rsp, 0x28
movsx rdi, r9w
pop rdi
pop rsi
jmp 0x140442bb7
jmp fcn.1404427dc
nop
add esi, r15d
movsx edi, r8w
bts edi, edx
add rsp, 0x28
pop rdi
cmovne si, r10w
bswap rsi
pop rsi
ret
mov ecx, edi
adc dl, r13b
movabs r8, 0xad4a5352d2edebd0
rcl edi, cl
btc r9w, 0xd1
mov dl, 3
mov r9d, 0x54
sar si, cl
btr rsi, 0xe5
add rsp, 0x28
movsx edi, r9w
movzx si, bl
jmp 0x140442c0e
pop rdi
mov si, si
pop rsi
jmp 0x140442c18
jmp fcn.1403ac354

Function at 0x14012a9bc
Capabilities:
Parse pe header

Disassembly:
sub r8d, r8d
cdq
movsxd rdx, r9d
bswap rdx
lea edx, [r8 + 2]
jmp 0x1404adac2
mov qword [rsp + 8], rbx
rol ebx, cl
bts bx, sp
mov dword [rsp + 0x18], r8d
rcr ebx, 0xbc
mov bx, 0x2320
mov dword [rsp + 0x10], edx
rol ebx, 0x57
setae bl
adc ebx, ebx
push rbp
xor bx, 0xf41
btr bp, 0x73
mov rbp, rsp
movsxd rbx, ebp
sar ebx, cl
sub rsp, 0x50
dec ebx
movsx ebx, bp
mov ebx, ecx
jmp 0x1404adb08
test r8d, r8d
jmp 0x1404adb10
jne 0x1404adbab
sub ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1404adbab
mov ecx, 0x5a4d
cmp word [rax], cx
jmp 0x1404adb34
jne 0x1404adbab
movsxd rcx, dword [rax + 0x3c]
test r10b, 0xdb
cmp edx, 0x3f9f074a
clc
add rcx, rax
stc
clc
cmp dword [rcx], 0x4550
jmp 0x1404adb59
jne 0x1404adbab
mov eax, 0x20b
cmp rbp, 0x343416c7
clc
cmp word [rcx + 0x18], ax
jmp 0x1404adb75
jne 0x1404adbab
cmp dword [rcx + 0x84], 0xe
jmp 0x1404adb87
jbe 0x1404adbab
cmp dword [rcx + 0xf8], 0
jmp 0x1404adb99
je 0x1404adbab
mov ecx, ebx
jmp 0x1404adba6
call fcn.1404ad9a1
lea rax, [rbp + 0x18]
movzx ecx, ax
mov byte [rbp + 0x28], 0
movsxd r9, r12d
mov ch, 0xca
mov qword [rbp - 0x20], rax
cwde
lea r9, [rbp - 0x2c]
movzx edx, r9w
cdq
lea rax, [rbp + 0x20]
mov dx, 0x27ac
cmovno r8w, r15w
mov qword [rbp - 0x18], rax
cdq
jmp 0x1404adbe5
lea r8, [rbp - 0x20]
rdtsc
movsx rcx, r10w
setb dl
lea rax, [rbp + 0x28]
cqo
not cx
movsx cx, ah
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
movsx rcx, r8w
movsx ax, bh
mov eax, 2
lea rcx, [rbp - 0x30]
jmp 0x1404adc1d
mov dword [rbp - 0x2c], eax
jmp 0x1404adc25
mov dword [rbp - 0x28], eax
jmp 0x1404adc2d
call fcn.1404added
cmp dword [rbp + 0x20], 0
je 0x1404adc4c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp 0x1404adc4b
ret
mov ecx, ebx
jmp 0x1404adc53
call fcn.1404ada2e
int3
Function at 0x14018bcc1
Capabilities:
Access peb ldr_data

Disassembly:
jne 0x140135fb3
sub r8, rdx
test r8, r8
je 0x140144f45
mov word [rcx], 0
jmp 0x140144f45
je 0x140118901
sub edx, edx
lea r9, [0x1400b8f10]
cmp r8, rdx
jmp 0x1401c0ca2
ret
je 0x140268685
xor eax, eax
nop word [rax + rax]
cmp r8, rax
je 0x1401cf86c
mov word [r10], r11w
add r10, 2
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14017c5a8
inc rax
cmp r8b, bl
test r11w, r11w
jmp 0x140268676
movzx eax, word [0x1400b8f10]
test ax, ax
jmp 0x14028c599
je 0x14011890a
mov word [rcx], ax
add rcx, 2
mov eax, 0x1dfd3e3d
movsx rax, dx
movzx eax, word [r9 + rdx*2 + 2]
inc rdx
test rbx, rcx
cmp sil, 0x45
test ax, ax
jmp 0x1401188f8
je 0x1401cf87d
mov word [r10], 0
xadd al, r8b
neg r8w
bts eax, eax
movzx eax, word [0x1400b8f10]
shl r8b, cl
cmp rdx, 0x104
mov r8b, 0xfd
not r8b
cmovbe r8w, r11w
mov r8d, 0x104
cmovb r8, rdx
cmp bl, r15b
test ax, ax
jmp 0x140135fa4
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
sbb r9b, 0xc7
sar r10b, cl
ror r9w, cl
mov rax, qword [rax + 0x10]
movzx r8d, word [rax + 0x58]
cmp r8, rdx
movzx r11w, al
cmovae r8, rdx
mov r9, qword [rax + 0x60]
sub r11b, al
bt r11d, 0xbe
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
test sil, cl
test rsi, 0x52984be2
test r11w, r11w
jmp 0x14014e9ff
jne 0x14014ea0d
sub r8, rax
clc
test r10w, r9w
cmc
test r8, r8
jmp 0x1401cf866
je 0x1401ed058
cmp rdx, 0x104
movsx r8d, sp
movsx r8, r8w
mov r8d, 0x104
jmp 0x140298ef0
cmovb r8, rdx
jmp 0x140135faa

Function at 0x14019dca4
Capabilities:
Enumerate pe sections

Disassembly:
je 0x14028b006
mov edx, dword [rax + 0xc]
cmc
test ah, 0x47
clc
cmp r10, rdx
jb 0x140105603
mov ecx, dword [rax + 8]
clc
stc
add ecx, edx
cmp r10, rcx
jb 0x14028b008
inc r9d
cmc
cmp r14b, r10b
test cl, 0x24
add rax, 0x28
cmp r10b, 0x33
cmp r9d, r11d
jmp 0x14028b000
movsxd r8, dword [rcx + 0x3c]
sub r9d, r9d
xchg r10b, r11b
add r8, rcx
movzx r11, r14w
xadd r10d, eax
mov r10, rdx
mov r11w, 0x564b
mov rax, r8
movzx eax, word [r8 + 0x14]
rcl r11w, 0x88
mov r11w, di
movzx r11d, word [r8 + 6]
add rax, 0x18
cmc
lea rax, [rax + r8]
cmc
test r11d, r11d
jmp 0x1401055dc
jb 0x1401055e2
xor eax, eax
ret

Function at 0x1401af336
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
ret
cmp word [rcx], ax
jne 0x1400ee3c1
movsxd rdx, dword [rcx + 0x3c]
test sil, 0x3e
jmp 0x1401afdff
ret
mov eax, 0x5a4d
cmp r12w, 0x6809
jmp 0x1400f6861
lea rdx, [rdx + rcx]
cmp dword [rdx], 0x4550
jmp 0x1402873cd
jne 0x1400ee3c1
xor eax, eax
dec cl
and al, 0xd3
adc al, 0x43
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
jmp 0x1401a7729

Function at 0x1401f7dee
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
movsx r8w, r14b
not r8b
sub ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1404adac2
Function at 0x140219434
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret
setne cl
cmp r12b, 0x28
stc
neg cl
mov byte [r11 + 7], cl
cmp r12w, 0x7d11
test r10d, edx
stc
add r11, 8
jmp 0x140245488
jne 0x140283d7e
jmp 0x1400e14be
test r9d, r9d
jmp 0x140208271
cmp r9d, ecx
jmp 0x140112bb8
inc rcx
jmp 0x14012b1e4
inc rcx
cmp cx, 0x2cda
cmp r8d, ecx
je 0x1400e14be
cmp byte [r11 + rcx*4], r10b
jmp 0x14022bc30
je 0x1400e14be
movzx r10d, byte [rdx]
test r9b, dl
shld r8w, di, 0x16
btr r8w, 0xcc
mov r8d, r9d
cmp bpl, 0x85
sub ecx, ecx
jmp 0x14028b01c
jne 0x1401efde9
movzx eax, byte [r11 + rcx*4 + 2]
clc
cmp al, byte [rdx + 2]
jmp 0x14025f1a2
mov r10, qword [rcx]
or r11b, 0x39
mov r11, qword [rcx + 0x18]
bswap r9
ror r9b, cl
mov r9d, dword [r10 + 4]
imul r9d, dword [r10]
test r13d, 0x605d207e
stc
cmp r8d, 2
jmp 0x140246429
movzx ecx, byte [r11 + 4]
cmp cl, byte [rdx]
setne cl
cmc
stc
neg cl
mov byte [r11 + 5], cl
movzx ecx, byte [r11 + 6]
cmp r12, 0x6df96ac7
test r15w, sp
cmp cl, byte [rdx]
mov cl, bpl
jmp 0x1400e7892
jne 0x1401efde9
movzx eax, byte [r11 + rcx*4 + 1]
cmp al, byte [rdx + 1]
jmp 0x140217add
je 0x1400e14be
lea ecx, [r9 - 1]
stc
test r13w, 0x6502
cmp ecx, 3
jmp 0x14027d71a
add r8d, 0xfffffffc
jmp 0x140283d44
jne 0x140118b95
test r9d, r9d
jmp 0x140244c8d
setne al
stc
test rdi, r8
jmp 0x14026b59f
jne 0x1401efde9
mov byte [r11 + rcx*4 + 3], 0
movzx r10w, r14b
movzx r10d, byte [rdx]
jmp 0x1401efde9
neg al
mov byte [r11 + rcx*2 + 1], al
jmp 0x1401ecd48
jb 0x140283d4a
mov r8d, r9d
and r8d, 0xfffffffc
cmp sil, al
xor r10d, r9d
nop word cs:[rax + rax]
movsx rcx, cx
movzx ecx, byte [r11]
shrd r10, rsp, 0x2a
cmp cl, byte [rdx]
movzx r10d, byte [r11 + 2]
not cl
setne cl
test dl, r13b
cmc
test r11b, 0x70
neg cl
stc
cmp rsp, 0x43043ef2
mov byte [r11 + 1], cl
rol cl, 0xa7
add cl, r13b
cmp r10b, byte [rdx]
setne cl
test r9b, 0xeb
neg cl
mov byte [r11 + 3], cl
jmp 0x14021e8e6
jne 0x14027d73f
test r9b, 3
je 0x1400e14be
and r9d, 3
shl ax, cl
sub eax, esi
xor ecx, ecx
dec ah
movsxd rax, r9d
bt ax, r14w
nop word cs:[rax + rax]
bts eax, ecx
add eax, 0x770b5c4c
or ax, sp
movzx eax, byte [r11 + rcx*2]
clc
stc
test r13w, r14w
cmp al, byte [rdx]
not al
jmp 0x14024b2d5
jmp 0x1401efdfa

Function at 0x1402709de
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404adac2
xor r8d, r8d
xor edx, edx
jmp 0x14019bd75
Function at 0x14028b068
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x1401e1bfd
movzx eax, r8b
stc
cmp byte [rax + rdx], 0x78
jne 0x14018a123
movzx r8d, byte [rcx + 2]
cdqe
movsx edx, ax
mov rax, qword [r9 + 0xf8]
not dx
movsx dx, dl
lea rdx, [rcx + 2]
jmp 0x140287108
movzx r8d, byte [rcx]
mov rdx, qword [r9 + 0x110]
cmp bp, cx
test dil, r14b
cmp byte [r8 + rdx], 0x65
je 0x14018a10a
mov rax, qword [r9]
movzx r8, r11w
not r8b
cmovg r8w, bx
nop dword [rax + rax]
movzx r8d, byte [rcx + 1]
jmp 0x1401ecd50
test dl, dl
jmp 0x140233210
test byte [rax + r8*2], 4
jmp 0x14018a104
inc rcx
jmp 0x1401e9a68
jne 0x140287148
ret
cmovne rdx, rcx
xor ch, 0xae
mov rcx, qword [rax]
rol ah, 0x12
adc rax, rcx
movzx eax, byte [rcx]
bts cx, r9w
movzx cx, cl
adc rcx, r13
mov byte [rdx], al
btc cx, r15w
shr al, cl
lea rax, [rdx + 1]
btr dx, 0xe8
xchg cl, cl
stc
nop dword [rax]
cmp eax, 0x4e9f4f81
movzx ecx, byte [rax]
movzx edx, r8b
cmp r8d, r12d
mov byte [rax], r8b
not r8w
lea rax, [rax + 1]
sar r8w, cl
movzx r8d, cl
clc
jmp 0x1401e5816
mov r9, qword [rdx]
movsxd rdx, ebx
jmp 0x1401e1bca