joyce8/EMBER2024-capa huggingface dataset:
Function at 0x33008c3a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x33008c3e5
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x33008c3dc
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x33008c3e7
add rax, 0x28
cmp rax, r9
jne 0x33008c3c8
xor eax, eax
ret

Function at 0x33008c3f0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x33008c480
mov rdx, qword [0x330107e50]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x33008c46e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x33008c46e
cmp word [rax + 0x18], 0x20b
jne 0x33008c46e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x33008c480
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x33008c459
add r12, 0x28
cmp r12, rsi
je 0x33008c480
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x33008c450
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x33008c490
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x330107e50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x33008c4b0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x33008c4b8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x33008c4b0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x33008c505
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x33008c4fc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x33008c4b0
add rax, 0x28
cmp rax, r9
jne 0x33008c4e8
xor eax, eax
ret

Function at 0x33008c510
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x330107e50]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x33008c530
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x33008c538
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x33008c530
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x33008c550
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x330107e50]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x33008c570
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x33008c578
ret
cmp word [rdx + 0x18], 0x20b
jne 0x33008c570
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x33008c5b8
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x33008c5af
test rcx, rcx
je 0x33008c570
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x33008c5a0
xor eax, eax
ret
Function at 0x33008c5c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x330107e50]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x33008c5e0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x33008c5e8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x33008c600
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x330107e50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x33008c620
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x33008c628
ret
cmp word [r8 + 0x18], 0x20b
jne 0x33008c620
sub rcx, rdx
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x33008c620
lea eax, [r8 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop dword [rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x33008c66c
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x33008c680
add rdx, 0x28
cmp rdx, r9
jne 0x33008c658
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x33008c690
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x330107e50]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x33008c6b2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x33008c6c0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x33008c6b2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x33008c6b2
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x33008c6b2
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x33008c70d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x33008c720
add rdx, 0x28
cmp r10, rdx
jne 0x33008c6f8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x33008c72f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x33008c73f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x33008c716
test ecx, ecx
jg 0x33008c728
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140001b48
Capabilities:
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rbx, rcx
mov ecx, 0x64000
call fcn.14000211c
and dword [rsp + 0x20], 0
lea rcx, str.RookIE_1.0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rdi, rax
mov dword [rsp + 0x78], 1
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r12, rax
test rax, rax
je 0x140001cf4
and qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov dword [rsp + 0x20], 0x4000000
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
je 0x140001ceb
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x80]
lea rdx, str.Console
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001ce2
xor ebx, ebx
xor esi, esi
cmp dword [rsp + 0x78], ebx
jbe 0x140001cad
mov r8d, 0x64000
mov edx, ebx
lea r9, [rsp + 0x78]
sub r8d, ebx
add rdx, rdi
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r11d, dword [rsp + 0x78]
test r11d, r11d
je 0x140001c80
add ebx, r11d
cmp ebx, 0x64000
jne 0x140001c7b
mov rcx, qword [rsp + 0x80]
lea rdx, str.huorongcaoqq
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rsp + 0x78]
add esi, ebx
xor ebx, ebx
test r11d, r11d
jne 0x140001c1a
test ebx, ebx
je 0x140001cad
mov rcx, qword [rsp + 0x80]
lea rdx, str.huorongcaoqq
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, ebx
mov rcx, qword [rsp + 0x80]
lea rdx, str.huorongcaoqq
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call fcn.140002124
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140002f4c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140002dbc

Function at 0x140005f40
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000d550]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140003c30
xor ebx, ebx
cmp qword [0x14000eeb8], rbx
mov rdi, rax
jne 0x140006053
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000612a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000612a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000eeb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000eec0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000eec8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000eed8], rax
test rax, rax
je 0x14000604a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000eed0], rax
jmp 0x14000605a
mov rax, qword [0x14000eed0]
jmp 0x140006061
mov rax, qword [0x14000eed0]
mov r11, qword [0x14000eed8]
cmp rax, rdi
je 0x1400060c8
cmp r11, rdi
je 0x1400060c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000eed8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400060c8
test rax, rax
je 0x1400060c8
call rsi
test rax, rax
je 0x1400060c2
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400060c2
test byte [rsp + 0x40], 1
jne 0x1400060c8
bts ebp, 0x15
jmp 0x140006108
mov rcx, qword [0x14000eec0]
cmp rcx, rdi
je 0x140006108
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006108
call rax
mov rbx, rax
test rax, rax
je 0x140006108
mov rcx, qword [0x14000eec8]
cmp rcx, rdi
je 0x140006108
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006108
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000eeb8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000612a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000612c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400056c0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007e17
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000d550]
jne 0x1400056da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400056d6
repz ret
ror rcx, 0x10
jmp 0x140007d70
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000ef90]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000f088]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140007df5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000ef90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140007e17
mov rax, qword [rsp + 0x88]
mov qword [0x14000f088], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000f028], rax
mov rax, qword [0x14000f088]
mov qword [0x14000ef00], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000f010], rax
mov dword [0x14000eef0], 0xc0000409
mov dword [0x14000eef4], 1
mov rax, qword [0x14000d550]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000d558]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000ef88], eax
mov ecx, 1
call fcn.1400056e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000ace0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000ef88], 0
jne 0x140007e9e
mov ecx, 1
call fcn.1400056e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140003200
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000322d
xor eax, eax
jmp 0x14000338a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140003258
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140003258
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14000338a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000337d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000329b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400032c6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003382
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003335
sub eax, 1
je 0x140003335
cmp eax, 2
jne 0x14000337d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003382
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003363
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000337d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003382
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004b10
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003880
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003953
cmp byte [rcx + 0x71], 0
je 0x140003953
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000394f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003914
sub eax, 1
je 0x140003918
cmp eax, 2
jne 0x14000394f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004b10
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003946
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000394f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400038fc
xor al, al
jmp 0x1400038fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004b10
add rsp, 0x60
pop rbx
ret

Function at 0x140005614
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000565e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000565e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000565e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000565e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000565e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005660
xor al, al
add rsp, 0x28
ret
Function at 0x141b19058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141b191df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141b19089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b1906f
add dl, dl
jne 0x141b19096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b190f6
xor eax, eax
add dl, dl
jne 0x141b190a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b191ad
add dl, dl
jne 0x141b190b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b190c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b190d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b190dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141b190ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141b1907e
mov eax, 1
add dl, dl
jne 0x141b19106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b19113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b190fb
sub eax, ebx
mov ebx, 1
jne 0x141b1914c
mov ecx, 1
add dl, dl
jne 0x141b1912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b1913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b19123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b1907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141b19168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b19175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b1915d
cmp eax, 0x7d00
jae 0x141b1919b
cmp eax, 0x500
jb 0x141b19196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b1907e
cmp eax, 0x7f
ja 0x141b1919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b1907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141b191d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141b1907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x140095ee4
Capabilities:
Encode data using xor

Disassembly:
push r9
mov r9, rdx
xor dx, r9w
mov rdx, qword [rsp + 0x20]
and r9w, 0x761f
or r9d, 0x6a67701
jbe 0x140095ee9
setno r9b
call fcn.1400a343e
Function at 0x140006f50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140006fad
lea rbx, [0x1400601d0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140006f94
cmp r10, 2
jb 0x140006f94
cmp byte [r9], r8b
jne 0x140006f94
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140006f70
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140006fef
lea rbx, [0x1400601d0]
cmp r8b, 0x23
jne 0x140006fd3
cmp byte [r9], r8b
jne 0x140006fd3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140006fc0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140007130
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000714a
mov qword [r8], 0
lea rdx, [0x14005fdc4]
call fcn.140007000
mov rbx, rax
test rax, rax
jne 0x14000716a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140007241
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140007241
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140007241
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140007241
cmp rdi, 0xffffffffffffffff
je 0x140007241
mov rax, qword [0x1401b6bd0]
test rax, rax
je 0x1400071de
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140007241
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000722e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401b6bd0]
test rax, rax
je 0x140007223
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000724a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000723c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000724c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret