joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007c30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15d, dword [r8]
xor edi, edi
mov r12, qword [rsp + 0x90]
mov r14, r9
mov rbp, rdx
mov rsi, rcx
lea eax, [r15 + 1]
mov dword [r8], eax
test r9, r9
je 0x180007c90
mov r8, qword [rdx + 0x38]
mov r9d, r15d
mov qword [rsp + 0x38], r12
lea edx, [rdi + 1]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call r14
test eax, eax
je 0x180007dcc
cmp rsi, 0xffffffffffffffff
je 0x180007dcc
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, 1
lea rdx, [0x180065814]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007dcc
cmp dword [rsp + 0x78], 1
jne 0x180007dcc
mov rdx, qword [rbp + 0x38]
mov ebx, edi
mov rax, rdx
test rdx, rdx
je 0x180007ceb
cmp byte [rdx], bl
je 0x180007ceb
nop
lea rax, [rax + 1]
inc ebx
cmp byte [rax], dil
jne 0x180007ce0
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007dcc
cmp ebx, dword [rsp + 0x78]
jne 0x180007dcc
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, 3
lea rdx, [0x180065818]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007dcc
cmp dword [rsp + 0x78], 3
jne 0x180007dcc
mov rax, qword [rbp + 0x40]
mov dword [rsp + 0x78], edi
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180007d96
nop word [rax + rax]
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], r14
mov r9, rbx
mov r8d, r15d
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call fcn.180007df0
test eax, eax
je 0x180007da1
mov rax, qword [rbx + 0x18]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180007d60
test r14, r14
jne 0x180007da5
lea edi, [r14 + 1]
jmp 0x180007dcc
xor eax, eax
jmp 0x180007dce
mov r8, qword [rbp + 0x38]
mov r9d, r15d
mov qword [rsp + 0x38], r12
mov edx, 4
mov qword [rsp + 0x30], rdi
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call r14
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180007df0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x48
mov rdi, r9
xor ebx, ebx
mov r9, qword [r9 + 0x40]
mov r13, rdx
mov rsi, rcx
mov rax, r9
test r9, r9
je 0x180007e30
mov r10d, ebx
cmp byte [r9], bl
je 0x180007e30
nop dword [rax]
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x180007e20
test r10d, r10d
jne 0x180007e4d
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + 0x30]
test byte [rcx + 0xc], 0x20
je 0x180007e4d
mov eax, 1
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x90]
test r9, r9
mov qword [rsp + 0x70], rbp
mov rbp, qword [rsp + 0x98]
mov qword [rsp + 0x78], r12
mov r12, qword [rsp + 0xa0]
mov qword [rsp + 0x80], r14
lea r14, [0x18006581c]
mov qword [rsp + 0x40], r15
cmovne r14, r9
mov r15d, dword [rcx]
lea eax, [r15 + 1]
mov dword [rcx], eax
mov rax, qword [rdi + 0x38]
test rbp, rbp
je 0x180007ec9
mov qword [rsp + 0x38], r12
mov r9d, r8d
mov r8, qword [rdx + 0x38]
mov rcx, rsi
mov qword [rsp + 0x30], r14
mov edx, 2
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x180007fc3
mov rdx, qword [rdi + 0x38]
mov edi, ebx
mov rax, rdx
test rdx, rdx
je 0x180007eea
cmp byte [rdx], bl
je 0x180007eea
nop dword [rax + rax]
lea rax, [rax + 1]
inc edi
cmp byte [rax], bl
jne 0x180007ee0
cmp rsi, 0xffffffffffffffff
je 0x180007fc3
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007fc3
cmp edi, dword [rsp + 0x88]
jne 0x180007fc3
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov r8d, 3
lea rdx, [0x180065820]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007fc3
cmp dword [rsp + 0x88], 3
jne 0x180007fc3
mov rdx, r14
mov rcx, rsi
call fcn.180007ff0
test eax, eax
je 0x180007fc3
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov r8d, 2
lea rdx, [0x180065824]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007fc3
cmp dword [rsp + 0x88], 2
jne 0x180007fc3
test rbp, rbp
jne 0x180007f9d
lea ebx, [rbp + 1]
jmp 0x180007fc3
mov r8, qword [r13 + 0x38]
mov r9d, r15d
mov qword [rsp + 0x38], r12
mov edx, 4
mov qword [rsp + 0x30], rbx
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call rbp
mov ebx, eax
mov r15, qword [rsp + 0x40]
mov eax, ebx
mov r14, qword [rsp + 0x80]
mov r12, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x180007ff0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rdx
mov ebp, 1
mov r14, rcx
mov ebx, r15d
mov r8d, ebp
mov r10d, r15d
mov edx, r15d
movzx eax, byte [rdi]
mov r9, rdi
test al, al
je 0x1800081b9
lea r11, [0x180065690]
nop dword [rax + rax]
movzx eax, al
movzx ecx, byte [rax + r11]
cmp cl, 8
jne 0x180008046
test r8d, r8d
jne 0x18000806b
mov edx, ebp
jmp 0x180008058
cmp cl, 5
je 0x18000806b
cmp cl, bpl
jne 0x180008055
test r8d, r8d
jne 0x18000806b
mov edx, r15d
movzx eax, byte [r9 + 1]
inc r9
inc ebx
mov r8d, r15d
test al, al
jne 0x180008030
jmp 0x18000806e
mov r10d, ebp
test edx, edx
jne 0x18000807b
test r10d, r10d
je 0x1800081b9
cmp r14, 0xffffffffffffffff
je 0x1800081ab
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], r15
mov r8d, ebp
lea rdx, [0x180065828]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800081ab
cmp dword [rsp + 0x68], ebp
jne 0x1800081ab
movzx eax, byte [rdi]
mov rbx, rdi
mov qword [rsp + 0x60], rsi
test al, al
je 0x18000816e
cmp al, 0x22
jne 0x180008126
cmp rdi, rbx
je 0x1800080f7
mov esi, ebx
mov qword [rsp + 0x20], r15
sub esi, edi
lea r9, [rsp + 0x68]
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000815b
cmp esi, dword [rsp + 0x68]
jne 0x18000815b
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], r15
mov r8d, 2
lea rdx, [0x18006582c]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000815b
cmp dword [rsp + 0x70], 2
jne 0x18000815b
lea rdi, [rbx + 1]
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x1800080c7
cmp rbx, rdi
jbe 0x18000816e
sub ebx, edi
mov qword [rsp + 0x20], r15
mov r8d, ebx
lea r9, [rsp + 0x68]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000815b
cmp ebx, dword [rsp + 0x68]
je 0x18000816e
xor eax, eax
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], r15
mov r8d, ebp
lea rdx, [0x180065828]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180008195
cmp dword [rsp + 0x68], ebp
je 0x180008198
mov ebp, r15d
mov eax, ebp
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
cmp r14, 0xffffffffffffffff
je 0x1800081e2
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], r15
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800081e2
cmp ebx, dword [rsp + 0x68]
je 0x1800081e5
mov ebp, r15d
mov eax, ebp
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x180008a00
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov r14, r9
mov rsi, r8
mov rax, rdx
mov rbp, rcx
mov edi, r15d
test rcx, rcx
je 0x180008b41
test rdx, rdx
je 0x180008b41
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 1]
mov dword [rsp + 0x28], r15d
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x180008b41
mov qword [rsp + 0x78], rbx
test rsi, rsi
je 0x180008aa1
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], r15
call rsi
test eax, eax
je 0x180008b17
mov rcx, qword [rsp + 0x40]
mov rax, qword [rbp + 0x18]
mov dword [rsp + 0x70], r15d
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180008aeb
nop dword [rax]
nop word [rax + rax]
mov r9, rsi
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x70]
mov rdx, rbx
call fcn.180007c30
test eax, eax
je 0x180008b17
mov rax, qword [rbx + 0x18]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180008ac0
test rsi, rsi
jne 0x180008af5
lea edi, [rsi + 1]
jmp 0x180008b1c
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea edx, [r9 + 5]
call rsi
mov edi, eax
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x180008b2d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x180008b3d
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x180008b41
mov dword [rbp + 8], r15d
lea r11, [rsp + 0x50]
mov eax, edi
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x180015920
Capabilities:
Check for software breakpoints

Disassembly:
mov r10, rcx
cmp edx, 4
jb 0x180015984
mov r8, qword [rcx + 0x3f8]
mov r9, qword [rcx + 0x400]
cmp r8, r9
jae 0x18001597d
cmp byte [r8], 0xcc
jne 0x180015968
mov eax, 1
cmp eax, edx
jae 0x180015960
lea rcx, [r8 + 1]
nop
cmp byte [rcx], 0xcc
jne 0x18001595e
inc eax
inc rcx
cmp eax, edx
jb 0x180015950
cmp eax, edx
je 0x18001596d
lea ecx, [rax + 1]
add r8, rcx
inc r8
jmp 0x180015936
mov ecx, edx
mov rax, r8
add rcx, r8
mov qword [r10 + 0x3f8], rcx
ret
mov qword [r10 + 0x3f8], r9
xor eax, eax
ret
Function at 0x180015990
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov esi, r8d
mov rdi, rdx
mov rbx, r9
mov r14, rcx
xor r15d, r15d
lea r9, [rsp + 0x50]
mov edx, esi
mov rcx, rdi
lea r8d, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180015a1a
mov rdx, rdi
mov rcx, r14
call fcn.180003810
mov edx, eax
xor r8d, r8d
mov rcx, rbx
call fcn.180002150
test eax, eax
je 0x180015a1a
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.180001e20
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov edx, esi
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
cmove ebx, r15d
mov eax, ebx
jmp 0x180015a1d
mov eax, r15d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x18003ee40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x590
mov rax, qword [0x18007c5c8]
xor rax, rsp
mov qword [rsp + 0x580], rax
mov rdi, rdx
mov esi, r8d
mov rbx, rcx
lea rdx, [0x180065468]
mov rcx, rdi
xor r8d, r8d
call fcn.180001610
cmp eax, 0x208
jae 0x18003f00a
lea r8, [rsp + 0x160]
mov qword [rsp + 0x5c8], rbp
lea rdx, [0x180065468]
mov rcx, rdi
call fcn.180001610
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18003f002
mov ecx, dword [rsp + 0x20]
test cl, 0x10
je 0x18003ef46
lea rdx, [0x180065460]
lea rcx, [rsp + 0x4c]
call fcn.180003f80
test eax, eax
je 0x18003efe3
lea rdx, [0x180065464]
lea rcx, [rsp + 0x4c]
call fcn.180003f80
test eax, eax
je 0x18003efe3
xor r8d, r8d
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.180001610
cmp eax, 0x208
jae 0x18003efe3
lea r8, [rsp + 0x370]
mov rcx, rdi
lea rdx, [rsp + 0x4c]
call fcn.180001610
lea r8d, [rsi + 1]
mov rcx, rbx
lea rdx, [rsp + 0x370]
call fcn.18003ee40
jmp 0x18003efe3
test cl, 0x40
jne 0x18003efe3
mov eax, dword [rbx]
cmp eax, 0x3e7
jae 0x18003eff9
cmp dword [rsp + 0x3c], 0
jne 0x18003efe3
cmp dword [rsp + 0x40], 0
jl 0x18003efe3
imul rcx, rax, 0x218
xor r8d, r8d
mov dword [rcx + rbx + 0x38], esi
mov eax, dword [rsp + 0x40]
mov edx, dword [rsp + 0x3c]
shl rdx, 0x20
add rdx, rax
mov eax, dword [rbx]
imul rcx, rax, 0x218
mov qword [rcx + rbx + 0x40], rdx
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call fcn.180001610
mov edx, dword [rbx + 0x82be0]
sub eax, edx
cmp eax, 0x208
jae 0x18003efe1
mov eax, dword [rbx]
lea r8, [rbx + 0x48]
imul rcx, rax, 0x218
xor eax, eax
add r8, rcx
lea rcx, [rdi - 1]
cmp esi, 1
setne al
add rcx, rax
add rcx, rdx
lea rdx, [rsp + 0x4c]
call fcn.180001610
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18003eec2
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbp, qword [rsp + 0x5c8]
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.180045df0
add rsp, 0x590
pop rdi
pop rsi
pop rbx
ret
Function at 0x180049b1c
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, str.FlsAlloc
xor ecx, ecx
lea r8, [0x18005f000]
lea rdx, str.FlsAlloc
call fcn.180049944
mov rbx, rax
test rax, rax
je 0x180049b5c
mov rcx, rax
call fcn.180046c34
mov rcx, rdi
call rbx
jmp 0x180049b62
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180049bc4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, str.FlsGetValue
mov ecx, 2
lea r8, [0x18005f028]
lea rdx, str.FlsGetValue
call fcn.180049944
mov rdi, rax
test rax, rax
je 0x180049c05
mov rcx, rax
call fcn.180046c34
mov ecx, ebx
call rdi
jmp 0x180049c0d
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180049c18
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, str.FlsSetValue
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x18005f040]
call fcn.180049944
mov rsi, rax
test rax, rax
je 0x180049c64
mov rcx, rax
call fcn.180046c34
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x180049c6f
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
push rdi
and dword [rbx + 2], esp
xor eax, 0x35353535
pop rbp
xor eax, 0x35353540
xor rax, 0x7e35354e
movabs dword [0x96a8a89a8255a49b], eax
pushfq
Function at 0x140003f64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003fae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003fae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003fae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003fae
cmp dword [rcx + 0x84], 0xe
jbe 0x140003fae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003fb0
xor al, al
add rsp, 0x28
ret

Function at 0x1400079c8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140007a37
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007a37
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007a37
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007a37
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007a37
cmp dword [rcx + 0x84], 0xe
jbe 0x140007a37
cmp dword [rcx + 0xf8], 0
je 0x140007a37
mov ecx, ebx
call fcn.140007ae8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400078c4
nop
cmp dword [rbp + 0x20], 0
je 0x140007a85
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007a90
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400079c8

Function at 0x140007bcc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400079c8
Function at 0x14000ad44
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000ad74
xor eax, eax
jmp 0x14000ae37
mov rbp, rbx
cmp word [rax], si
je 0x14000ad99
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000ad80
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000ad7c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000ac64
movsxd r14, eax
test eax, eax
jne 0x14000add7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000ad6d
mov rcx, r14
call fcn.140008b28
mov rdi, rax
test rax, rax
jne 0x14000adf0
xor ecx, ecx
call fcn.140008aec
jmp 0x14000adcc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000ac64
test eax, eax
jne 0x14000ae21
mov rcx, rdi
call fcn.140008aec
jmp 0x14000ae2b
xor ecx, ecx
call fcn.140008aec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400104c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400104e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400104e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40e90]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x180de5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180de51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180de5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180de506f
add dl, dl
jne 0x180de5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180de50f6
xor eax, eax
add dl, dl
jne 0x180de50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180de51ad
add dl, dl
jne 0x180de50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180de50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180de50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180de50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180de50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180de507e
mov eax, 1
add dl, dl
jne 0x180de5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180de5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180de50fb
sub eax, ebx
mov ebx, 1
jne 0x180de514c
mov ecx, 1
add dl, dl
jne 0x180de512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180de513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180de5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180de507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180de5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180de5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180de515d
cmp eax, 0x7d00
jae 0x180de519b
cmp eax, 0x500
jb 0x180de5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180de507e
cmp eax, 0x7f
ja 0x180de519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180de507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180de51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180de507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20