joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a770
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x140025c00]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.14000dc80
test rax, rax
je 0x14000a7c4
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x14000a859
mov ecx, 2
call fcn.140012380
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.140012240
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14000a845
test ebx, ebx
jne 0x14000a845
lea ecx, [rax + 2]
call fcn.140012380
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000a880
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x5b8
mov rcx, qword [0x140025c00]
call fcn.14000dc80
test rax, rax
je 0x14000a8b5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call rax
add rsp, 0x5b8
ret
mov ecx, 2
mov qword [rsp + 0x5b0], rbx
call fcn.140012380
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.140012240
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14000a93e
test ebx, ebx
jne 0x14000a93e
lea ecx, [rax + 2]
call fcn.140012380
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x5b8
ret
Function at 0x14000aac0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
xor ebx, ebx
test rcx, rcx
mov rbp, r8
mov r12d, edx
mov rsi, rcx
jne 0x14000ab0d
call fcn.14000c950
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rax], 0x16
call fcn.14000a770
or rax, 0xffffffffffffffff
jmp 0x14000aba2
mov qword [rsp + 0x40], rdi
call fcn.14000dd70
mov edx, 0x2d8
mov ecx, 1
call fcn.14000eb10
test rax, rax
mov rdi, rax
je 0x14000ab86
call fcn.14000dfb0
mov rcx, rdi
mov rdx, qword [rax + 0xc0]
call fcn.14000dd90
lea r8, [0x14000aa20]
mov rdx, r12
mov r9, rdi
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov rbx, rax
mov qword [rdi + 8], rax
jne 0x14000abb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.14000ae80
test ebx, ebx
je 0x14000ab99
mov ecx, ebx
call fcn.14000c9b0
or rax, 0xffffffffffffffff
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14000abd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14000ab86
mov rax, rbx
jmp 0x14000ab9d
Function at 0x14000c857
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140024050]
jne 0x140009b7a
rol rcx, 0x10
test cx, 0xffff
jne 0x140009b76
repz ret
ror rcx, 0x10
jmp 0x14000c7b0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140025cd0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140025dc8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000c835
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140025cd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000c857
mov rax, qword [rsp + 0x88]
mov qword [0x140025dc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140025d68], rax
mov rax, qword [0x140025dc8]
mov qword [0x140025c40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140025d50], rax
mov dword [0x140025c30], 0xc0000409
mov dword [0x140025c34], 1
mov rax, qword [0x140024050]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140024058]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140025cc8], eax
mov ecx, 1
call fcn.140012380
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001c6e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140025cc8], 0
jne 0x14000c8de
mov ecx, 1
call fcn.140012380
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140014270
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
lea r12, [0x140024f90]
xor esi, esi
mov edi, ecx
mov rax, r12
mov ebx, esi
nop
cmp ecx, dword [rax]
je 0x1400142ae
add ebx, 1
add rax, 0x10
cmp ebx, 0x17
jb 0x140014290
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
cmp ebx, 0x17
jae 0x140014495
mov ecx, 3
call fcn.140019e80
cmp eax, 1
je 0x14001444c
mov ecx, 3
call fcn.140019e80
test eax, eax
jne 0x1400142e5
cmp dword [0x140024048], 1
je 0x14001444c
cmp edi, 0xfc
je 0x140014495
mov qword [rsp + 0x50], rbp
lea rbp, [0x1400264d0]
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rbp
mov edx, 0x314
call fcn.140011d60
test eax, eax
je 0x140014329
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a6d0
lea rdx, [0x1400264e9]
mov r8d, 0x104
xor ecx, ecx
mov byte [0x1400265ed], sil
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140014379
lea r8, str._program_name_unknown_
lea rcx, [0x1400264e9]
mov edx, 0x2fb
call fcn.140011d60
test eax, eax
je 0x140014379
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a6d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1400264e9]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 0x3c
jbe 0x1400143c8
lea rcx, [rcx + rbp - 0x23]
lea rdx, [0x1400267e4]
lea r9d, [rax + 3]
lea r8, [0x14001ce14]
sub rdx, rcx
call fcn.1400174a0
test eax, eax
je 0x1400143c8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a6d0
lea r8, [0x14001ce10]
mov edx, 0x314
mov rcx, rbp
call fcn.1400173e0
test eax, eax
je 0x1400143f4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a6d0
movsxd r8, ebx
mov edx, 0x314
mov rcx, rbp
add r8, r8
mov r8, qword [r12 + r8*8 + 8]
call fcn.1400173e0
test eax, eax
je 0x140014424
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call fcn.14000a6d0
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov r8d, 0x12010
mov rcx, rbp
call fcn.140019c20
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140014495
cmp rax, 0xffffffffffffffff
je 0x140014495
xor eax, eax
movsxd rcx, ebx
lea r9, [rsp + 0x58]
add rcx, rcx
mov qword [rsp + 0x20], rsi
mov rdx, qword [r12 + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1400144b0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov ecx, 3
call fcn.140019e80
cmp eax, 1
je 0x1400144e2
mov ecx, 3
call fcn.140019e80
test eax, eax
jne 0x140014596
cmp dword [0x140024048], 1
jne 0x140014596
mov qword [rsp + 0x48], rbx
lea rbx, [0x140024f90]
mov qword [rsp + 0x30], rdi
mov rax, rbx
xor edi, edi
cmp dword [rax], 0xfc
je 0x14001450e
add edi, 1
add rax, 0x10
cmp edi, 0x17
jb 0x1400144f8
jmp 0x140014582
cmp edi, 0x17
jae 0x140014582
mov ecx, 3
call fcn.140019e80
cmp eax, 1
je 0x140014539
mov ecx, 3
call fcn.140019e80
test eax, eax
jne 0x140014582
cmp dword [0x140024048], 1
jne 0x140014582
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
test rax, rax
mov r11, rax
je 0x140014582
cmp rax, 0xffffffffffffffff
je 0x140014582
movsxd rcx, edi
xor eax, eax
lea r9, [rsp + 0x40]
add rcx, rcx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbx + rcx*8 + 8]
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xff
call fcn.140014270
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
ret
Function at 0x140014b40
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov eax, dword [0x1400269fc]
xor r12d, r12d
test eax, eax
mov ebp, r12d
jne 0x140014b9c
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x140014b7c
mov dword [0x1400269fc], 1
jmp 0x140014baf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x140014b96
mov dword [0x1400269fc], 2
jmp 0x140014c19
mov eax, dword [0x1400269fc]
cmp eax, 1
jne 0x140014c10
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test rax, rax
mov rdi, rax
je 0x140014bea
cmp word [rdi], bp
mov rax, rdi
je 0x140014bc9
add rax, 2
cmp word [rax], bp
jne 0x140014bb7
add rax, 2
cmp word [rax], bp
jne 0x140014bb7
sub eax, edi
add eax, 2
movsxd rsi, eax
mov rcx, rsi
call fcn.14000eaa0
test rax, rax
mov rbx, rax
jne 0x140014bf1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x140014d0b
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140011ef0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbx
jmp 0x140014d0b
cmp eax, 2
je 0x140014c19
test eax, eax
jne 0x140014bea
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
test rax, rax
mov rsi, rax
je 0x140014bea
cmp byte [rax], bpl
mov rbx, rax
je 0x140014c68
nop
or r9d, 0xffffffff
mov r8, rbx
xor ecx, ecx
lea edx, [r9 + 2]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140014bea
or rcx, 0xffffffffffffffff
add ebp, eax
mov rdi, rbx
xor eax, eax
repne scasb al, byte [rdi]
not rcx
add rbx, rcx
cmp byte [rbx], al
jne 0x140014c30
add ebp, 1
mov edx, 2
movsxd rcx, ebp
call fcn.14000eb10
test rax, rax
mov r12, rax
jne 0x140014c8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x140014d0b
cmp byte [rsi], 0
mov qword [rsp + 0x50], r13
mov rbx, rax
mov r13, rsi
je 0x140014cf5
nop
or r9d, 0xffffffff
mov eax, ebp
mov rcx, rbx
sub rcx, r12
lea edx, [r9 + 2]
mov r8, r13
sar rcx, 1
sub eax, ecx
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140014d1e
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasb al, byte [rdi]
mov rdi, rbx
not rcx
add r13, rcx
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
cmp byte [r13], al
not rcx
lea rbx, [rbx + rcx*2]
jne 0x140014ca0
mov rcx, rsi
mov word [rbx], 0
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov rax, r12
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rcx, r12
call fcn.14000ae80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
jmp 0x140014d06
Function at 0x140017770
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140024050]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400177b7
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140009b60
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.140019fb0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140009b60
add rsp, 0x38
ret
Function at 0x140019c20
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000db90
xor ebx, ebx
cmp qword [0x140026ad8], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x140019d4c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x140019e5f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140019e5f
mov rcx, rax
call fcn.14000dac0
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140026ad8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14000dac0
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140026ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14000dac0
lea rcx, [rsp + 0x98]
mov qword [0x140026ae8], rax
call fcn.140012760
test eax, eax
je 0x140019cff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14000a6d0
cmp dword [rsp + 0x98], 2
jne 0x140019d4c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14000dac0
test rax, rax
mov qword [0x140026af8], rax
je 0x140019d4c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.14000dac0
mov qword [0x140026af0], rax
mov rcx, qword [0x140026af0]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140019df8
cmp qword [0x140026af8], rbp
je 0x140019df8
call fcn.14000dc80
mov rcx, qword [0x140026af8]
mov rsi, rax
call fcn.14000dc80
test rsi, rsi
mov r12, rax
je 0x140019df8
test rax, rax
je 0x140019df8
call rsi
test rax, rax
je 0x140019dc3
lea rcx, [rsp + 0x34]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140019dc3
test byte [rsp + 0x40], 1
jne 0x140019df8
lea rcx, [rsp + 0x30]
call fcn.1400127b0
test eax, eax
je 0x140019de5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14000a6d0
cmp dword [rsp + 0x30], 4
jb 0x140019df2
bts edi, 0x15
jmp 0x140019e36
bts edi, 0x12
jmp 0x140019e36
mov rcx, qword [0x140026ae0]
cmp rcx, rbp
je 0x140019e36
call fcn.14000dc80
test rax, rax
je 0x140019e36
call rax
test rax, rax
mov rbx, rax
je 0x140019e36
mov rcx, qword [0x140026ae8]
cmp rcx, rbp
je 0x140019e36
call fcn.14000dc80
test rax, rax
je 0x140019e36
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140026ad8]
call fcn.14000dc80
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x140019e5f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140019e61
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c9cc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000c9c4
cmp dword [rcx + 0x3c], edx
jl 0x14000c9c4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000c9c4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000c9cc
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140990058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409901df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140990089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14099006f
add dl, dl
jne 0x140990096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409900f6
xor eax, eax
add dl, dl
jne 0x1409900a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409901ad
add dl, dl
jne 0x1409900b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409900c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409900d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409900dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409900ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14099007e
mov eax, 1
add dl, dl
jne 0x140990106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140990113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409900fb
sub eax, ebx
mov ebx, 1
jne 0x14099014c
mov ecx, 1
add dl, dl
jne 0x14099012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14099013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140990123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14099007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140990168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140990175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14099015d
cmp eax, 0x7d00
jae 0x14099019b
cmp eax, 0x500
jb 0x140990196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14099007e
cmp eax, 0x7f
ja 0x14099019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14099007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409901d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14099007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000179a
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x110], 0
mov dword [rbp - 0x20], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x118], rax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x140001900
jmp 0x1400018df
mov rax, qword [rbp + 0x130]
lea rdx, [rbp - 0x20]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x1400018df
mov qword [rbp - 0x28], 0
mov eax, dword [rbp - 0x18]
mov ecx, eax
call fcn.140001584
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x60], 0x30
mov qword [rbp - 0x58], 0
mov dword [rbp - 0x48], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov r10, qword [0x140332090]
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0x110]
mov r9, rcx
mov r8, rdx
mov edx, 0x1fffff
mov rcx, rax
call r10
mov rax, qword [rbp + 0x110]
test rax, rax
je 0x1400018c3
mov rax, qword [rbp + 0x110]
cmp rax, 0xffffffffffffffff
je 0x1400018c3
mov rdx, qword [0x140332088]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x110]
jmp 0x14000191a
mov rdx, qword [0x140332088]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call rdx
mov rax, 0xffffffffffffffff
jmp 0x14000191a
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x1400017ff
mov rdx, qword [0x140332088]
mov rax, qword [rbp + 0x118]
mov rcx, rax
call rdx
mov rax, 0xffffffffffffffff
add rsp, 0x1a0
pop rbp
ret
Function at 0x1400139a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14001de80
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.14001de80
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140013a10
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140332154]
mov rbx, rcx
test esi, esi
jle 0x140013b40
mov rax, qword [0x140332158]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140013a5b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140013ae5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140013a40
mov rcx, rbx
call fcn.140014460
mov rdi, rax
test rax, rax
je 0x140013b62
mov rax, qword [0x140332158]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400145a0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140332158]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140013b47
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140013ade
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140013af0
add dword [0x140332154], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140332158]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140013ade
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400139a0
nop dword [rax]
xor esi, esi
jmp 0x140013a68
mov rax, qword [0x140332158]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400139a0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400139a0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400140d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1403321c0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1403321a0]
test rbx, rbx
je 0x14001412c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140014123
test rsi, rsi
je 0x140014123
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140014108
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]