joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cb98a
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x140185018]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, r8
mov rbp, rcx
movabs r8, 0x200000000801
jmp 0x1400cb9e6
movzx eax, word [rdx]
sub ax, 0x2f
cmp ax, 0x2d
ja 0x1400cb9e2
movzx eax, ax
bt r8, rax
jb 0x1400cb9ef
sub rdx, 2
cmp rdx, rcx
jne 0x1400cb9c4
movzx ecx, word [rdx]
cmp cx, 0x3a
jne 0x1400cba1e
lea rax, [rbp + 2]
cmp rdx, rax
je 0x1400cba1e
mov r9, r14
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.1400cb85b
jmp 0x1400cbab3
sub cx, 0x2f
xor edi, edi
cmp cx, 0x2d
ja 0x1400cba3e
movzx eax, cx
bt r8, rax
lea eax, [rdi + 1]
jb 0x1400cba40
mov eax, edi
sub rdx, rbp
lea rcx, [rsp + 0x30]
sar rdx, 1
mov r8d, 0x250
inc rdx
neg al
sbb r15, r15
and r15, rdx
xor edx, edx
call fcn.1400b970f
xor r9d, r9d
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400cbada
mov r9, r14
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.1400cb85b
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x1400cbab1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400d2976
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x290
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rsi, qword [r14 + 8]
sub rsi, qword [r14]
sar rsi, 3
cmp word [rsp + 0x5c], 0x2e
jne 0x1400cbb13
cmp word [rsp + 0x5e], di
je 0x1400cbb2e
cmp word [rsp + 0x5e], 0x2e
jne 0x1400cbb13
cmp word [rsp + 0x60], di
je 0x1400cbb2e
mov r9, r14
lea rcx, [rsp + 0x5c]
mov r8, r15
mov rdx, rbp
call fcn.1400cb85b
test eax, eax
jne 0x1400cba9c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400cbae5
mov rax, qword [r14]
mov rdx, qword [r14 + 8]
sub rdx, rax
sar rdx, 3
cmp rsi, rdx
je 0x1400cba9e
sub rdx, rsi
lea rcx, [rax + rsi*8]
lea r9, [0x1400cb5dd]
mov r8d, 8
call fcn.1400bd874
jmp 0x1400cba9e

Function at 0x1400cc82d
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x1400cc8bf
jmp 0x1400cc873
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x1400cc85e
lea rax, [rax + rcx*2]
add rax, 2
cmp word [rax], si
jne 0x1400cc85a
sub rax, rbx
add rax, 2
sar rax, 1
lea rbp, [rax + rax]
mov rcx, rbp
call fcn.1400c6603
mov rdi, rax
test rax, rax
je 0x1400cc8af
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.1400b86f2
mov rsi, rdi
xor ecx, ecx
call fcn.1400c65bb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d13bf
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movsxd r13, ecx
lea r10, [0x140188d00]
mov rdi, r13
mov r15, r13
sar r15, 6
and edi, 0x3f
shl rdi, 6
mov r14, rdx
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
mov rcx, qword [rax + rdi + 0x28]
mov qword [rsp + 0x98], rcx
test r8, r8
je 0x1400d1422
cmp word [rdx], r9w
jne 0x1400d1422
or byte [rax + rdi + 0x38], 4
jmp 0x1400d1427
and byte [rax + rdi + 0x38], 0xfb
lea r12, [rdx + r8*2]
mov rsi, rdx
mov rbx, rdx
cmp rdx, r12
jae 0x1400d160f
add byte [rax], al
lea rbp, [rdx + 2]
mov edx, SafeArrayGetElemsize
movzx eax, word [rsi]
cmp ax, 0x1a
je 0x1400d15ea
cmp ax, dx
je 0x1400d146d
mov word [rbx], ax
add rbx, 2
add rsi, 2
add rbp, 2
jmp 0x1400d151d
cmp rbp, r12
jae 0x1400d149e
cmp word [rbp], r9w
jne 0x1400d1496
add rsi, 4
mov word [rbx], r9w
add rbp, 4
add rbx, 2
jmp 0x1400d151d
mov word [rbx], dx
jmp 0x1400d145c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, 2
lea rdx, [rsp + 0x80]
add rsi, 2
add rbp, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400d15ce
cmp dword [rsp + 0x90], 0
je 0x1400d15ce
lea r10, [0x140188d00]
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
test byte [rax + rdi + 0x38], 0x48
je 0x1400d156a
movzx eax, word [rsp + 0x80]
cmp ax, r9w
jne 0x1400d152b
mov word [rbx], r9w
mov edx, SafeArrayGetElemsize
mov rcx, qword [rsp + 0x98]
cmp rsi, r12
jb 0x1400d1443
jmp 0x1400d160f
mov ecx, SafeArrayGetElemsize
mov word [rsp + 0x88], ax
mov word [rbx], cx
xor edx, edx
mov rcx, qword [r10 + r15*8]
mov al, byte [rsp + rdx + 0x88]
add rcx, rdi
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, 2
jl 0x1400d153d
mov rax, qword [r10 + r15*8]
mov byte [rax + rdi + 0x3c], r9b
jmp 0x1400d1510
cmp word [rsp + 0x80], r9w
jne 0x1400d158f
cmp rbx, r14
jne 0x1400d158f
mov word [rbx], r9w
add rbx, 2
jmp 0x1400d1510
mov rdx, 0xfffffffffffffffe
mov ecx, r13d
lea r8d, [rdx + 3]
call fcn.1400d050f
mov r9d, 0xa
lea r10, [0x140188d00]
cmp word [rsp + 0x80], r9w
je 0x1400d1510
lea edx, [r9 + 3]
mov word [rbx], dx
add rbx, 2
jmp 0x1400d1515
mov edx, SafeArrayGetElemsize
lea r10, [0x140188d00]
mov word [rbx], dx
add rbx, 2
lea r9d, [rdx - 3]
jmp 0x1400d1515
mov rcx, qword [r10 + r15*8]
mov al, byte [rcx + rdi + 0x38]
test al, 0x40
jne 0x1400d1605
or al, 2
mov byte [rcx + rdi + 0x38], al
jmp 0x1400d160f
movzx ecx, word [rsi]
mov word [rbx], cx
add rbx, 2
sub rbx, r14
sar rbx, 1
lea rax, [rbx + rbx]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d27eb
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
test r11d, r11d
je 0x1400d283c
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x1400d282c
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x1400d283e
inc r9d
add rax, 0x28
cmp r9d, r11d
jb 0x1400d2812
xor eax, eax
ret

Function at 0x1400d28a6
Capabilities:
Parse pe header

Disassembly:
mov rax, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x1400d28ba
xor eax, eax
ret
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
jne 0x1400d28db
mov edx, 0x20b
cmp word [rcx + 0x18], dx
sete al
ret
Function at 0x1400e79cc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400e3d6c
Function at 0x140002cbf
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
cmp word [rcx], 0x5a4d
jne 0x140002dd9
mov rsi, rcx
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140002dde
mov rdi, r8
mov rbx, rdx
mov eax, dword [rax + rsi + 0x88]
mov r13d, dword [rax + rsi + 0x20]
add r13, rsi
mov ecx, dword [rax + rsi + 0x24]
add rcx, rsi
mov qword [rsp + 0x30], rcx
mov ebp, dword [rax + rsi + 0x18]
mov eax, dword [rax + rsi + 0x1c]
add rax, rsi
mov qword [rsp + 0x28], rax
neg rbp
mov r14, 0xffffffffffffffff
lea r15, [rsp + 0x38]
lea rax, [r14 + rbp]
cmp rax, 0xffffffffffffffff
je 0x140002d91
mov r12d, dword [r13 + r14*4 + 4]
add r12, rsi
mov rcx, r12
call fcn.14001a0a0
mov rcx, r15
mov rdx, r12
mov r8, rax
call fcn.140005100
cmp qword [rsp + 0x38], 0
jne 0x140002da4
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov r8, rbx
mov r9, rdi
call fcn.140016c53
inc r14
test al, al
je 0x140002d2e
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + r14*2]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
add rax, rsi
jmp 0x140002d93
xor eax, eax
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x40]
movups xmm0, xmmword [rax]
lea r8, [rsp + 0x50]
movaps xmmword [r8], xmm0
lea rax, [0x140039198]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400275c0]
mov edx, 0x2b
call fcn.1400258e0
call fcn.140025510
call fcn.140025521
int3

Function at 0x140006c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140006c90
cmp r11, r10
ja 0x140006d07
cmp r10, rdx
ja 0x140006d19
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140006c92
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140006c70
jmp 0x140006cf4
ja 0x140006c9a
mov r11, r10
cmp rax, r8
jne 0x140006c3e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140006cd0
mov rdi, r8
sub ecx, edx
jns 0x140006ceb
jmp 0x140006cf6
cmp r8, rsi
je 0x140006d28
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140006cf6
xor al, 1
cmp rdi, rsi
jne 0x140006cb0
jmp 0x140006cf6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140025870
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400256e0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140025970
int3
Function at 0x14000b090
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000b0b5
cmp rax, rcx
je 0x14000b0bb
cmp rdx, 4
jae 0x14000b0c2
xor eax, eax
xor r8d, r8d
jmp 0x14000b160
pop rbp
jmp fcn.1400040a0
xor eax, eax
jmp 0x14000b177
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140027540]
movdqa xmm3, xmmword [0x140027550]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000b0f0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000b177
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000b160
pop rbp
ret
Function at 0x140011d90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movzx r9d, byte [rdx + 0x38]
movzx eax, byte [rdx + 0x3a]
cmp al, byte [rax + r8*8 - 0x3f6af0bf]

Function at 0x1400174e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14001752e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001752e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001752e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001752e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001752e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140017530
xor al, al
add rsp, 0x28
ret

Function at 0x14001ac60
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001accf
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14001accf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001accf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001accf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001accf
cmp dword [rcx + 0x84], 0xe
jbe 0x14001accf
cmp dword [rcx + 0xf8], 0
je 0x14001accf
mov ecx, ebx
call fcn.14001ad80
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001ab5c
nop
cmp dword [rbp + 0x20], 0
je 0x14001ad1d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001ad28
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14001ac60

Function at 0x14001ae64
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001ac60
Function at 0x14001df2c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001df5c
xor eax, eax
jmp 0x14001e01f
mov rbp, rbx
cmp word [rax], si
je 0x14001df81
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14001df68
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001df64
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001de4c
movsxd r14, eax
test eax, eax
jne 0x14001dfbf
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
jmp 0x14001df55
mov rcx, r14
call fcn.14001ee08
mov rdi, rax
test rax, rax
jne 0x14001dfd8
xor ecx, ecx
call fcn.14001c4ac
jmp 0x14001dfb4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001de4c
test eax, eax
jne 0x14001e009
mov rcx, rdi
call fcn.14001c4ac
jmp 0x14001e013
xor ecx, ecx
call fcn.14001c4ac
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140021510
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14001cf1c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14002159a
cmp byte [rbp - 0x21], r15b
je 0x140021595
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400215d0
call fcn.14001f618
test eax, eax
jne 0x1400215bc
cmp byte [rbp - 0x21], r15b
je 0x1400215b4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400215d0
cmp byte [rbp - 0x21], r15b
je 0x1400215cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14001c4fc
test eax, eax
jne 0x140021670
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14001cf1c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14002160f
cmp byte [rbp - 0x21], r15b
je 0x140021644
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140021644
call fcn.14001f618
test eax, eax
jne 0x140021630
cmp byte [rbp - 0x21], r15b
je 0x140021629
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140021644
cmp byte [rbp - 0x21], r15b
je 0x140021641
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14001c4fc
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140021670
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140021673
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140021681
mov rcx, rdi
call fcn.14001c4ac
cmp byte [rbp + 0x3f], r15b
je 0x140021690
mov rcx, qword [rbp + 0x27]
call fcn.14001c4ac
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140024570
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140024598
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140024598
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140df3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140df31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140df3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140df306f
add dl, dl
jne 0x140df3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140df30f6
xor eax, eax
add dl, dl
jne 0x140df30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140df31ad
add dl, dl
jne 0x140df30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140df30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140df30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140df30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140df30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140df307e
mov eax, 1
add dl, dl
jne 0x140df3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140df3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140df30fb
sub eax, ebx
mov ebx, 1
jne 0x140df314c
mov ecx, 1
add dl, dl
jne 0x140df312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140df313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140df3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140df307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140df3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140df3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140df315d
cmp eax, 0x7d00
jae 0x140df319b
cmp eax, 0x500
jb 0x140df3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140df307e
cmp eax, 0x7f
ja 0x140df319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140df307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140df31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140df307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140fa3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140fa31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140fa3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fa306f
add dl, dl
jne 0x140fa3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fa30f6
xor eax, eax
add dl, dl
jne 0x140fa30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fa31ad
add dl, dl
jne 0x140fa30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fa30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fa30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fa30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140fa30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140fa307e
mov eax, 1
add dl, dl
jne 0x140fa3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fa3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fa30fb
sub eax, ebx
mov ebx, 1
jne 0x140fa314c
mov ecx, 1
add dl, dl
jne 0x140fa312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fa313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fa3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fa307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140fa3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fa3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fa315d
cmp eax, 0x7d00
jae 0x140fa319b
cmp eax, 0x500
jb 0x140fa3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fa307e
cmp eax, 0x7f
ja 0x140fa319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fa307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140fa31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140fa307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140130be6
Capabilities:
Access peb ldr_data
Get number of processors
Resolve function by parsing pe exports

Disassembly:
je 0x140130b45
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140130b45
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
jmp 0x140130e19
mul r8
xchg r8, r12
mov rcx, r12
xchg r12, r8
loope 0x140130b6c
xchg esp, eax
sub rcx, rdx
shr rcx, 1
add rcx, rdx
jmp 0x140130c88
mov rax, qword [rax]
jmp 0x140130eba
rdtsc
je 0x140130b82
jne 0x140130b82
js 0x140131090
mul rdi
lea r10d, [rbx - 0xa704]
movabs rdx, 0x2cdad0000002c2e9
call rcx
pop rdi
ret
jmp 0x140130e49
and r9d, 0xfff
add r9, r10
mov byte [r9], 0xc3
test rbx, rbx
jmp 0x140130db8
jb 0x140130bd9
xchg rbp, rbx
mov rbp, r9
xchg rbp, rbx
xchg rdi, rcx
mov rdi, qword [rsp + 0x48]
jmp 0x140130d79
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
invalid
je 0x140130c36
jne 0x140130c36
jmp rax
jmp 0x140130eb3
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
jmp 0x140130aee
shl rdx, 2
shl rdx, 1
shl rdx, 1
shl rdx, 1
jmp 0x140130de5
shl rdx, 1
or rax, rdx
mov r8, rax
jmp 0x140130cd9
shr rcx, 3
shr rcx, 1
shr rcx, 1
jmp 0x140130da5
xchg rdi, rax
mov rdi, r11
xchg rdi, rax
jmp 0x140130b15
mov rcx, qword [rsp + 0x30]
call rdi
test eax, eax
jne 0x1401335e0
mov r9d, 0x8000
xchg r12, rsi
jmp 0x140130e75
xchg rcx, rdi
add r10, 0x1000
add rcx, qword [rbp + 0xd0]
jmp 0x140130df6
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140130b3c
shr rcx, 1
imul rcx, rcx, 0x64
sub r8, rcx
cmp r8, 0x4b
jmp 0x140130bca
je 0x140130bd0
rdtsc
shl rdx, 0x11
shl rdx, 0xa
shl rdx, 4
jmp 0x140130c7a
call r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rbx
jmp 0x140130ce5
or rax, rdx
xchg r11, r9
mov r11, rax
xchg r9, r11
jmp 0x140130bb4
cmp r10, rcx
jb 0x140130b6a
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], r13d
mov r9d, 0x20
xchg r14, rax
mov qword [rsp + 0x20], r14
jmp 0x140130e2f
dec r9d
mov r8d, 0xab06c879
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
jmp 0x140130d8f
xchg r14, rax
lea r8, [rbp + 0xd0]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x48]
jmp 0x140130dd1
shl rdx, 0x12
shl rdx, 2
shl rdx, 6
shl rdx, 1
jmp 0x140130c68
mov qword [rsp + 0x3a8], rsi
xchg r12, rsi
lea r8, [rbp + 0xd0]
mov qword [rbp + 0xd0], r13
lea rdx, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
call r15
jmp 0x140130be6
nop dword [rax]
xchg r13, r10
mov r13, qword [rax + 0x30]
xchg r13, r10
jmp 0x140130c51
add byte [rbp + 3], cl
ror dword [rdi], 1
invalid
jmp 0x140130b1d
Function at 0x1401323dd
Capabilities:
Execute anti-debugging instructions
Execute syscall
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
xchg ecx, ecx
call rax
jmp 0x14013064e
add byte [rcx - 9], al
mov dl, 0xdf
push rax
movsd dword [rdi], dword [rsi]
jmp 0x1401323ea
test rdx, rbp
rcr r9d, 0x3d
call rcx
jmp 0x14013216c