joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x140012f80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Resolve dns

Disassembly:
jmp 0x140011920
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400220f7]
call fcn.14001137f
lea rcx, str.www.sina.com.cn
call fcn.14001135c
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140011a37
mov rax, qword [rbp + 8]
mov rdx, qword [rax]
lea rcx, str.h_name:_s_n
call fcn.14001119a
mov rax, qword [rbp + 8]
movsx eax, word [rax + 0x12]
mov edx, eax
lea rcx, str.h_length:_d_n
call fcn.14001119a
mov rax, qword [rbp + 8]
movsx eax, word [rax + 0x10]
mov edx, eax
lea rcx, str.h_addrtype:_d
call fcn.14001119a
mov dword [rbp + 0x24], 0
jmp 0x1400119a6
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
movsxd rax, dword [rbp + 0x24]
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
cmp qword [rcx + rax*8], 0
je 0x1400119dc
movsxd rax, dword [rbp + 0x24]
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
mov edx, dword [rbp + 0x24]
inc edx
mov r8, qword [rcx + rax*8]
lea rcx, str.h_aliases_d:_s_n
call fcn.14001119a
jmp 0x14001199e
mov dword [rbp + 0x44], 0
jmp 0x1400119ed
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
movsxd rax, dword [rbp + 0x44]
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
cmp qword [rcx + rax*8], 0
je 0x140011a37
movsxd rax, dword [rbp + 0x44]
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + rax*8]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call fcn.1400111db
mov ecx, dword [rbp + 0x44]
inc ecx
mov r8, rax
mov edx, ecx
lea rcx, str.ip_d:_s_n
call fcn.14001119a
jmp 0x1400119e5
xor eax, eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140011280
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400142d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400142f0
xor al, al
jmp 0x140014371
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014303
xor al, al
jmp 0x140014371
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001432d
xor al, al
jmp 0x140014371
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014341
xor al, al
jmp 0x140014371
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014353
xor al, al
jmp 0x140014371
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001436f
xor al, al
jmp 0x140014371
mov al, 1
add rsp, 0x38
ret
Function at 0x140b95058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140b951df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140b95089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b9506f
add dl, dl
jne 0x140b95096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b950f6
xor eax, eax
add dl, dl
jne 0x140b950a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140b951ad
add dl, dl
jne 0x140b950b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b950c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b950d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b950dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140b950ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140b9507e
mov eax, 1
add dl, dl
jne 0x140b95106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140b95113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b950fb
sub eax, ebx
mov ebx, 1
jne 0x140b9514c
mov ecx, 1
add dl, dl
jne 0x140b9512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b9513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b95123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b9507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140b95168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140b95175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140b9515d
cmp eax, 0x7d00
jae 0x140b9519b
cmp eax, 0x500
jb 0x140b95196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b9507e
cmp eax, 0x7f
ja 0x140b9519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140b9507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140b951d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140b9507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400112c1
Capabilities:
Terminate process

Disassembly:
jmp 0x1400159d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011393
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016d20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016d40
xor al, al
jmp 0x140016dc1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016d53
xor al, al
jmp 0x140016dc1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140016d7d
xor al, al
jmp 0x140016dc1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016d91
xor al, al
jmp 0x140016dc1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016da3
xor al, al
jmp 0x140016dc1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140016dbf
xor al, al
jmp 0x140016dc1
mov al, 1
add rsp, 0x38
ret
Function at 0x18004cfe0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x18004d008
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18004d02e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18004d030
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18004d089
test ecx, ecx
jle 0x18004d069
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18004d089
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18004d089
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x18004d0b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18004d0d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18004d0e8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18004d104
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18004d106
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18004d142
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18004d1de
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18004d17d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18004d1be
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18004d1de
cmp rbx, rax
ja 0x18004d190
test rbx, rbx
je 0x18004d1de
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x18004d610
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180090010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18004d63d
xor eax, eax
jmp 0x18004d79a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x18004d668
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x18004d668
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x18004d79a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18004d78d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x18004d6ab
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18004d6d6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18004d792
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18004d745
sub eax, 1
je 0x18004d745
cmp eax, 2
jne 0x18004d78d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18004d792
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18004d773
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18004d78d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18004d792
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18005c260
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18004dbf0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180090010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18004dcc3
cmp byte [rcx + 0x71], 0
je 0x18004dcc3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18004dcbf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18004dc84
sub eax, 1
je 0x18004dc88
cmp eax, 2
jne 0x18004dcbf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18005c260
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18004dcb6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18004dcbf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18004dc6c
xor al, al
jmp 0x18004dc6c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18005c260
add rsp, 0x60
pop rbx
ret
Function at 0x18005baf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x18005bb13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x18005bb00
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x18005bc10
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18005bc49
mov rcx, qword [0x180090d60]
call fcn.180043340
call fcn.180051190
xor eax, eax
lea r8, [0x18005bb20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov eax, 1
add rsp, 0x38
ret

Function at 0x18005bc60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xc], al
je 0x18005bc83
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x18005bc70
mov byte [rcx + 0xc], 0
lea r8, [rcx + 0xb]
mov rdx, rcx
mov rcx, rbx
call fcn.180047c70
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14144ee10
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14144ee39
pop rbp
sub rbp, 0x29
sub rbp, 0x144ee10
jmp 0x14144ee99
sub rsp, 0x20
sub esp, 0x20
in al, dx
and byte [rax], al
add byte [rax], al
jmp 0x14144eea9
pushfq
xchg edx, eax
ror dword [rax - 0x39], 1
rcl byte [rax], 0xee
add dword [rax + 1], r9d
call 0x10d056fff
add byte [rax], al
add byte [rax - 0x39], cl
ror dword [rdx + 6], 0
add byte [rax - 0x39], cl
ret 0x4e30
mov rax, 0x144ee10
add rax, rbp
add rax, 0xcb
mov rcx, 0x64a
mov rdx, 0x496c4e30
xor byte [rax], dl
inc rax
dec rcx
adc byte [rax - 1], cl
ror byte [rax - 1], 0xc9
jne 0x14144eec8
jmp 0x14144eedf
js 0x14144ee9a
fnstcw word [rbx + 0x30300cb9]
xor byte [rax - 0x4f], bh
int1
cmp byte [rcx], dh
xor byte [rax], dh
js 0x14144ef22
fnstcw word [rax - 9]
lock xor byte ds:[rax], dh
xor byte [rax - 9], bh
sbb byte [rax], dh
xor byte [rax], dh
js 0x14144eec9
sar byte [rax + 0x31], cl
int1
mov ebx, 0x30303cb1
xor byte [rax + 0x31], bh
fsub dword [rax + 0x60]
js 0x14144ee9b
cmp al, 0xa3
and dh, byte [rax]
xor byte [rax], dh
xor byte [rax], dh
js 0x14144eea6
xor al, 0x6b
add dh, byte [rcx]
xor byte [rax], dh
xor byte [rax], dh
js 0x14144ef58
xor byte [rax], dh
xor byte [rax + 0x31], bh
fnstcw word [rax - 0x76]
invalid
xor byte [rax], dh
int1
fdiv dword [rdx]
add dword [rcx], esp
js 0x14144eef4
int1
xor al, 0x30
xor byte [rax], dh
js 0x14144ef19
clc
invalid
cmp al, 0xa3
and dh, byte [rax]
xor byte [rax], dh
xor byte [rax], dh
js 0x14144eeeb
xor al, 0x6b
add dh, byte [rcx]
xor byte [rax], dh
xor byte [rax], dh
js 0x14144ef9d
fstpnce st(0), st(0)
xor eax, 0xd9303030
mov ebp, 0x62303032
fmul dword [rbp + 0x30]
xor byte [rax], dh
push 0x67
js 0x14144ef3a
out 0x78, eax
add ecx, edi
js 0x14144ef88
loop 0x14144ef3c
mov bl, 0xd8
xor eax, 0x3ff8cf78
fdiv dword [0x1813dbf07]
mov ah, 0x54
xor byte [rax], dh
xor byte [rdi], bh
mov eax, 0x3030306e
push rsi
mov ebx, 0xcbb0092c
fdivr dword [rdi]
mov ah, 0x2c
xor byte [rax], dh
xor byte [rax - 0x4bc02635], dh
and esi, dword [rax]
xor byte [rax], dh
push rsi
mov cl, 0xcb
iretd
or dword [rax - 0x4bc02735], esi
sub al, 0x30
xor byte [rax], dh
mov al, 0xcb
fnstcw word [rdi]
mov ah, 0x23
xor byte [rax], dh
xor byte [rsi - 0x4f], dl
retf
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140001071
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x848
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140003af4
call fcn.140002568
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, [0x140011d50]
call fcn.140002144
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140001004
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140001071
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x848
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140003af4
call fcn.140002568
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, [0x140011d50]
call fcn.140002144
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140001074
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400010e5
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x448
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140007b84
call fcn.140002568
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, str.Fatal_error_in_launcher:__s_n
call fcn.140002cfc
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140001078
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400010e5
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x448
mov rax, qword [0x1400143c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140007b84
call fcn.140002568
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, str.Fatal_error_in_launcher:__s_n
call fcn.140002cfc
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret
Function at 0x140001150
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r13, rcx
lea r8, [0x140011db0]
lea rdx, [0x1400164b0]
lea rcx, [rbp + 0x38]
xor r12d, r12d
mov qword [rbp + 0x38], r12
call fcn.1400020d0
mov ecx, r12d
test eax, eax
lea rdx, str.Failed_to_open_executable
sete cl
call fcn.140001074
mov rcx, qword [rbp + 0x38]
lea r8d, [r12 + 2]
xor edx, edx
call fcn.140003bc8
mov rcx, qword [rbp + 0x38]
call fcn.140003388
mov rcx, qword [rbp + 0x38]
movsxd r14, eax
lea edi, [r14 - 0x104]
test edi, edi
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.140003bc8
mov r9, qword [rbp + 0x38]
lea r15d, [r12 + 1]
mov esi, 0x104
mov edx, r15d
mov rcx, r13
mov r8d, esi
call fcn.140002cdc
mov rcx, r13
mov rdx, rax
call fcn.1400010e8
mov rbx, rax
test rax, rax
je 0x140001229
lea rcx, [rbp - 0x20]
lea r8d, [r12 + 0x14]
mov rdx, rax
call fcn.14000c3c0
movsxd rdi, edi
sub rdi, r13
add rdi, rbx
jmp 0x1400012b0
mov ebx, 0x4100000
mov ecx, ebx
call fcn.1400024b0
mov rcx, qword [rbp + 0x38]
lea edi, [r14 - 0x4100000]
test edi, edi
mov rsi, rax
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.140003bc8
mov r9, qword [rbp + 0x38]
mov r8d, ebx
mov rdx, r15
mov rcx, rsi
call fcn.140002cdc
mov rcx, rsi
mov rdx, rax
call fcn.1400010e8
mov ecx, r12d
lea rdx, str.Unable_to_find_an_appended_archive.
test rax, rax
mov rbx, rax
setne cl
call fcn.140001074
lea rcx, [rbp - 0x20]
mov rdx, rbx
mov r8d, 0x14
call fcn.14000c3c0
movsxd rdi, edi
mov rcx, rsi
sub rdi, rsi
add rdi, rbx
call fcn.1400021d8
mov esi, 0x104
mov eax, dword [rbp - 0x10]
mov rcx, qword [rbp + 0x38]
xor r8d, r8d
add eax, dword [rbp - 0x14]
sub rdi, rax
mov edx, edi
call fcn.140003bc8
mov r9, qword [rbp + 0x38]
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.140002cdc
mov ecx, r12d
lea rdx, str.Unable_to_read_from_file
test rax, rax
setne cl
call fcn.140001074
movzx eax, word [r13]
cmp ax, word [0x140011e1c]
jne 0x140001301
mov r12, r13
jmp 0x140001367
mov rcx, qword [rbp + 0x38]
lea edx, [rdi - 0x104]
test edx, edx
cmovs edx, r12d
xor r8d, r8d
call fcn.140003bc8
mov r9, qword [rbp + 0x38]
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.140002cdc
mov ecx, r12d
lea rdx, str.Unable_to_read_from_file
test rax, rax
mov rbx, rax
setne cl
call fcn.140001074
lea r11, [rbx + r13 - 1]
cmp r11, r13
jb 0x140001367
movzx eax, word [0x140011e1c]
cmp word [r11], ax
je 0x140001364
sub r11, r15
cmp r11, r13
jae 0x140001354
jmp 0x140001367
mov r12, r11
mov rcx, qword [rbp + 0x38]
call fcn.140003eec
lea r11, [rsp + 0x40]
mov rax, r12
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140004307
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400143c8]
jne 0x140001fea
rol rcx, 0x10
test cx, 0xffff
jne 0x140001fe6
repz ret
ror rcx, 0x10
jmp 0x140004260
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140015490]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140015588]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400042e5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140015490]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140004307
mov rax, qword [rsp + 0x88]
mov qword [0x140015588], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140015528], rax
mov rax, qword [0x140015588]
mov qword [0x140015400], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140015510], rax
mov dword [0x1400153f0], 0xc0000409
mov dword [0x1400153f4], 1
mov rax, qword [0x1400143c8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400143d0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140015488], eax
mov ecx, 1
call fcn.140009544
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140010360]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140015488], 0
jne 0x14000438e
mov ecx, 1
call fcn.140009544
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret