joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f7d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, r8
mov edi, edx
test r8, r8
je 0x14000f9a0
mov rax, qword [rcx]
call qword [rax]
mov rbp, rax
test edi, edi
je 0x14000f840
cmp edi, 3
je 0x14000f840
sub edi, 1
je 0x14000f82f
cmp edi, 1
jne 0x14000f9a0
movzx edx, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x14000f9a2
movzx edx, bx
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x14000f9a2
movzx edx, bx
mov r8d, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14000f9a0
xor ebx, ebx
mov esi, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x14000f9a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x14000f906
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14000d3b0
test rax, rax
je 0x14000f8df
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000f906
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rsi, rsi
je 0x14000f9a0
cmp edi, 3
jne 0x14000f99b
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1d]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x14000f98d
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x14000f98d
lea ecx, [rdx + 1]
and ecx, 0xfffffffe
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [rdi + 0x1e]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, rax
test rax, rax
je 0x14000f98d
mov r8d, 0xff00ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test eax, eax
jns 0x14000f98a
mov rcx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14000f9a2
mov rbx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14000f9a2
mov rax, rsi
jmp 0x14000f9a2
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000fa60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x14000fa92
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14000fb87
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14000fb87
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14000fb7e
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x14000fb5c
cmp rdi, 1
jne 0x14000fb1a
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x14000fb79
cmp rdi, 2
jne 0x14000fb31
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x14000fb79
cmp rdi, 4
jne 0x14000fb46
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x14000fb79
cmp rdi, 8
jne 0x14000fb5c
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x14000fb79
test eax, eax
je 0x14000fb79
mov rdx, rdi
mov rcx, rbx
call fcn.140011690
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.140017500
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x140010450
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
test rcx, rcx
je 0x1400105b9
cmp word [rcx], 0
je 0x1400105b9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 1
mov dword [rbp - 0x24], eax
xor edi, edi
mov word [rbp - 0x20], di
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea rsi, vtable.CVolObject.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, vtable.CVolMem.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400117e0
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], rdi
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14001055b
mov ebx, edi
jmp 0x140010583
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], r14
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x1400105a0
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
call qword [r8 + 0x18]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], rsi
mov rax, rbx
jmp 0x1400105bb
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140010610
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r14
sub rsp, 0x28
mov r14, rcx
call fcn.14000c650
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x140010643
nop
cmp dx, 0x20
ja 0x140010643
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
jne 0x140010630
movzx r8d, word [rax]
movzx ecx, r8w
cmp r8w, 0x22
jne 0x140010656
movzx ecx, word [rax + 2]
mov edx, 0x22
lea rdi, [rax + 2]
mov r9d, 0x20
cmovne rdi, rax
cmovne dx, r9w
cmp cx, dx
je 0x140010685
test cx, cx
je 0x14001068e
movzx ecx, word [rdi + 2]
add rdi, 2
cmp cx, dx
jne 0x140010673
test cx, cx
je 0x14001068e
add rdi, 2
cmp r8w, 0x22
jne 0x14001069f
cmp word [rdi], r9w
jne 0x14001069f
add rdi, 2
movzx eax, word [rdi]
test ax, ax
je 0x14001082e
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
cmp ax, 0x22
jne 0x140010772
movzx eax, word [rdi + 2]
add rdi, 2
mov rsi, rdi
test ax, ax
je 0x1400106f3
nop dword [rax]
cmp ax, 0x22
je 0x1400106f3
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x1400106e0
mov rbx, rsi
sub rbx, rdi
sar rbx, 1
test rbx, rbx
jle 0x140010728
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call fcn.140017500
mov word [rbx + rbp], r15w
jmp 0x14001072b
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14001074f
mov rax, qword [rcx + 0x18]
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14001075c
lea rdx, [rbx + 8]
call fcn.140011690
mov qword [rax + rbx], rbp
mov rdi, rsi
cmp word [rsi], r15w
je 0x14001080e
lea rdi, [rsi + 2]
jmp 0x14001080e
cmp ax, 0x20
jbe 0x14001080a
mov rsi, rdi
nop
cmp ax, 0x22
je 0x140010799
cmp ax, 0x20
jbe 0x140010799
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x140010780
mov rbx, rsi
sub rbx, rdi
sar rbx, 1
test rbx, rbx
jle 0x1400107ce
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call fcn.140017500
mov word [rbx + rbp], r15w
jmp 0x1400107d1
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x1400107f8
mov rax, qword [rcx + 0x18]
mov rdi, rsi
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14001080e
lea rdx, [rbx + 8]
call fcn.140011690
mov rdi, rsi
mov qword [rax + rbx], rbp
jmp 0x14001080e
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x1400106c2
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, qword [r14 + 0x30]
shr rax, 3
add rsp, 0x28
pop r14
pop rdi
ret
Function at 0x140017c4c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140017adf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140017adf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017adf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017adf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017adf
cmp dword [rcx + 0x84], 0xe
jbe 0x140017adf
cmp dword [rcx + 0xf8], 0
je 0x140017adf
mov ecx, ebx
call fcn.140017b80
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140017970
cmp dword [rbp + 0x20], 0
je 0x140017b2c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140017b34
int3
xor r8d, r8d
xor edx, edx
jmp 0x140017a78
Function at 0x180658058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1806581df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180658089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18065806f
add dl, dl
jne 0x180658096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806580f6
xor eax, eax
add dl, dl
jne 0x1806580a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806581ad
add dl, dl
jne 0x1806580b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806580c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806580d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806580dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806580ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18065807e
mov eax, 1
add dl, dl
jne 0x180658106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180658113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806580fb
sub eax, ebx
mov ebx, 1
jne 0x18065814c
mov ecx, 1
add dl, dl
jne 0x18065812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18065813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180658123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18065807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180658168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180658175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18065815d
cmp eax, 0x7d00
jae 0x18065819b
cmp eax, 0x500
jb 0x180658196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18065807e
cmp eax, 0x7f
ja 0x18065819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18065807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806581d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18065807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400023a0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
mov r14, r8
push r13
mov r13, rdx
push r12
push rbp
push rdi
mov rdi, rcx
mov rcx, rdx
push rsi
mov rsi, r9
push rbx
sub rsp, 0x48
call fcn.140013a30
mov rbx, qword [0x14001a170]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
cmp dword [rax + 0xf4], 0
je 0x140002412
lea rdx, [0x140017a10]
mov ecx, 1
call qword [rax + 0x1b0]
mov r12, rax
test rax, rax
jne 0x140002415
mov rax, qword [rbx]
mov ecx, 1
mov rax, qword [rax + 0x8c2]
mov edx, dword [rax + 0x68]
call fcn.14000fae0
jmp 0x1400025a5
xor r12d, r12d
xor ebp, ebp
mov r15d, 0x40
mov rax, qword [rdi + 8]
cmp word [rax + 2], bp
jbe 0x1400024e4
movzx edx, bp
mov rcx, qword [rdi]
imul rax, rdx, 0x28
lea rax, [rcx + rax + 0x14]
cmp dword [rax + 0x10], 0
mov qword [rdi + 0x10], rax
jne 0x140002448
inc ebp
jmp 0x14000241d
mov r8d, dword [rax + 0x24]
mov eax, 1
mov ecx, r8d
and ecx, 0xe0000000
je 0x1400024ac
mov eax, 0x10
cmp ecx, 0x20000000
je 0x1400024ac
mov eax, 2
cmp ecx, 0x40000000
je 0x1400024ac
mov eax, 0x20
cmp ecx, 0x60000000
je 0x1400024ac
mov eax, 8
cmp ecx, 0x80000000
je 0x1400024ac
mov eax, pe_nt_image_headers64
cmp ecx, 0xa0000000
je 0x1400024ac
cmp ecx, 0xc0000000
mov eax, 4
cmovne eax, r15d
bt r8d, 0x1a
jae 0x1400024b6
or ah, 2
shl rdx, 4
add rdx, qword [rdi + 0x3c]
mov ecx, 2
mov r9, qword [rdx + 8]
mov dword [rsp + 0x20], eax
mov r8, qword [rdx]
or rdx, 0xffffffffffffffff
call fcn.14000f2b0
test eax, eax
jne 0x140002444
jmp 0x1400025a5
mov r9, qword [rdi + 0x4c]
test r9, r9
jne 0x1400024f2
xor r15d, r15d
jmp 0x140002518
mov dword [rsp + 0x20], 2
mov r8, qword [rdi + 0x44]
or rdx, 0xffffffffffffffff
mov ecx, 2
call fcn.14000f2b0
test eax, eax
jne 0x1400024ed
jmp 0x1400025a5
inc r15d
mov rax, qword [rdi + 8]
mov eax, dword [rax + 0xc]
cmp eax, r15d
jbe 0x140002571
mov ebp, r15d
mov rdx, qword [rdi + 0x20]
imul rbp, rbp, 0x12
lea rcx, [rdx + rbp]
cmp dword [rcx], 0
jne 0x140002546
imul rax, rax, 0x12
mov ecx, dword [rcx + 4]
add rax, rcx
lea rcx, [rdx + rax]
mov r8d, dword [rsp + 0x38]
mov rdx, r13
call fcn.14000eec0
test eax, eax
jne 0x140002515
add rbp, qword [rdi + 0x20]
mov rax, qword [rdi + 0x3c]
movzx edx, word [rbp + 0xc]
mov ecx, dword [rbp + 8]
shl rdx, 4
add rcx, qword [rax + rdx - 0x10]
jne 0x1400025a9
mov edx, dword [rsp + 0xb0]
mov ecx, 0x132
call fcn.14000f830
mov edx, 3
mov r12, rax
mov rcx, rax
call fcn.14000f5b0
mov rcx, r12
mov rdx, r13
call fcn.14000f6e0
mov rcx, r12
call fcn.14000f8e0
xor eax, eax
jmp 0x14000260d
mov rdx, qword [rdi + 8]
mov r9w, word [rdx + 2]
xor edx, edx
jmp 0x1400025c5
mov r8, qword [rax]
cmp r8, rcx
jbe 0x1400025cd
inc rdx
add rax, 0x10
cmp r9w, dx
ja 0x1400025b6
jmp 0x1400025a5
add r8, qword [rax + 8]
cmp rcx, r8
jae 0x1400025be
imul rdx, rdx, 0x28
mov rax, qword [rdi]
lea rax, [rax + rdx + 0x14]
mov qword [rdi + 0x10], rax
test byte [rax + 0x27], 0x20
je 0x1400025a5
mov r8, rsi
mov rdx, r14
call fcn.140002620
test r12, r12
je 0x140002608
mov rax, qword [rbx]
mov rcx, r12
call qword [rax + 0x1b8]
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000be70
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140012d40
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x140012d40
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x140012d40
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000bf31
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x140012d40
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000c420
cmp eax, 0xa6caa1c5
jne 0x14000bf1d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x140012d40
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140012d40
mov rcx, r13
inc rsi
call fcn.14000c420
cmp eax, 0xffe885ef
jne 0x14000bec1
jmp 0x14000beee
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x140012d8a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140012d88
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140012d80
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x140012d80
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x140012d5e
xor eax, eax
ret

Function at 0x14000bfa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x14001a170]
push r12
xor r8d, r8d
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [rax]
mov rax, qword [rbx + 0x84a]
test rax, rax
je 0x14000c055
mov r8d, dword [rbx + 0x800]
test r8d, r8d
jne 0x14000c055
movsxd rdx, dword [rax + 0x3c]
xor ecx, ecx
mov edx, dword [rax + rdx + 0x88]
add rdx, rax
mov edi, dword [rdx + 0x20]
mov r10d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x24]
mov ebp, dword [rdx + 0x18]
xor edx, edx
add r10, rax
add rdi, rax
add rsi, rax
cmp ebp, ecx
jbe 0x14000c04e
mov r9d, dword [rdi + rcx*4]
cmp word [rax + r9], 0x775a
jne 0x14000c049
test rdx, rdx
movzx r9d, word [rsi + rcx*2]
jne 0x14000c01f
mov edx, dword [r10 + r9*4]
add rdx, rax
jmp 0x14000c049
mov r9d, dword [r10 + r9*4]
mov r11, rdx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rdx
cmp rdx, r9
mov r9d, r12d
cmova r9d, r11d
test r8d, r8d
je 0x14000c046
cmp r8d, r9d
jbe 0x14000c049
mov r8d, r9d
inc rcx
jmp 0x14000bffb
mov dword [rbx + 0x800], r8d
pop rbx
mov eax, r8d
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14000dee0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x14000dee4
mov r11d, 8
lea r10, str.cw
lea rbx, [0x14001a1c0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x14000df62
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x14000df77
cmp esi, 4
jne 0x14000df77
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x14000df28
pop rbx
pop rsi
ret

Function at 0x14000e490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x14000e4c6
mov esi, edx
test edx, edx
jne 0x14000e4cd
xor eax, eax
jmp 0x14000e5ba
movsxd rax, dword [rcx + 0x3c]
mov r12, rcx
xor ebx, ebx
add rax, rcx
mov r9d, dword [rax + 0x88]
mov eax, dword [rax + 0x8c]
lea r15, [rcx + r9]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x18]
mov r14d, dword [r15 + 0x20]
mov ebp, dword [r15 + 0x1c]
mov r13d, dword [r15 + 0x24]
mov dword [rsp + 0x2c], eax
add r14, rcx
cmp dword [rsp + 0x2c], ebx
jbe 0x14000e4c6
mov edi, dword [r14 + rbx*4]
mov r8d, 1
xor edx, edx
add rdi, r12
mov rcx, rdi
call fcn.14000c3d0
mov r8d, eax
lea rax, [rbx + 1]
cmp r8d, esi
jne 0x14000e5b2
add rbx, rbx
add rbx, r12
movzx eax, word [rbx + r13]
lea rax, [r12 + rax*4]
mov eax, dword [rax + rbp]
add rax, r12
mov qword [rsp + 0x38], rax
cmp rax, r15
jae 0x14000e558
mov rax, qword [rsp + 0x38]
jmp 0x14000e5ba
mov esi, dword [rsp + 0x28]
add rsi, r12
add rsi, r15
cmp rax, rsi
jae 0x14000e551
call fcn.140013a30
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], ax
inc eax
mov word [rsp + 0x42], ax
mov rax, qword [0x14001a170]
mov rax, qword [rax]
mov rax, qword [rax + 0x138]
test rax, rax
je 0x14000e4c6
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, r12
call rax
test eax, eax
jns 0x14000e551
jmp 0x14000e4c6
mov rbx, rax
jmp 0x14000e505
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140012d40
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140012d40
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x140012d40
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x140012d40
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000bf31
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x140012d40
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000c420
cmp eax, 0xa6caa1c5
jne 0x14000bf1d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x140012d40
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140012d40
mov rcx, r13
inc rsi
call fcn.14000c420
cmp eax, 0xffe885ef
jne 0x14000bec1
jmp 0x14000beee
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x140012d8a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140012d88
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140012d80
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x140012d80
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x140012d5e
xor eax, eax
ret