joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005c820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
test eax, eax
js 0x18005c871
cmp eax, 1
je 0x18005c871
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x18005c87e
mov eax, dword [rbx + 0x20]
mov edx, dword [rbx + 0x24]
cmp eax, edx
cmovb edx, eax
mov eax, edx
lea rdx, [rsp + 0x40]
shl rax, 0xb
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
je 0x18005c87e
mov dword [rbx + 0x28], 0x80004004
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.18005c8d0
mov rcx, qword [rbx + 8]
xor eax, eax
lea r9, [rsp + 0x40]
mov r8d, 0x800
mov rdx, rdi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18005c8b5
call fcn.1800030e0
mov dword [rbx + 0x28], eax
mov rcx, rbx
call fcn.18005c950
mov rbx, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x18005c8d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.1800644c0
mov rax, qword [rbx]
xor ecx, ecx
mov r8d, dword [rax + 0xc]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18005c932
call fcn.1800030e0
mov dword [rbx + 0x28], eax
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180062100
add rsp, 0x150
pop rbx
ret

Function at 0x18005c950
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xa50
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0xa40], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0xa00
call fcn.1800644c0
mov rax, qword [rbx]
xor ecx, ecx
mov r8d, dword [rax + 0x10]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18005c9b2
call fcn.1800030e0
mov dword [rbx + 0x28], eax
mov eax, 1
mov rcx, qword [rsp + 0xa40]
xor rcx, rsp
call fcn.180062100
add rsp, 0xa50
pop rbx
ret
Function at 0x18005ebd0
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1800f7050]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov edi, edx
lea rcx, [rsp + 0x32]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bp
call fcn.1800644c0
lea edx, [rbp + 0x5c]
lea rcx, [rbx + 0xc0]
call fcn.180063034
test rax, rax
jne 0x18005ec32
mov eax, 0x80004005
jmp 0x18005ec87
sub rax, rbx
lea rdx, [rbx + 0xc0]
lea rcx, [rsp + 0x30]
lea r8, [rax - 0xc0]
sar r8, 1
inc r8d
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x18005ec75
call fcn.1800030e0
jmp 0x18005ec87
mov ecx, dword [rbx + 0x6c]
mov eax, 0x80070070
add ecx, edi
cmp qword [rsp + 0x20], rcx
cmova eax, ebp
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180062100
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180064217
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800f7050]
jne 0x18006211a
rol rcx, 0x10
test cx, 0xffff
jne 0x180062116
repz ret
ror rcx, 0x10
jmp 0x180064170
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1800feef0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1800fefe8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800641f5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1800feef0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180064217
mov rax, qword [rsp + 0x88]
mov qword [0x1800fefe8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800fef88], rax
mov rax, qword [0x1800fefe8]
mov qword [0x1800fee60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800fef70], rax
mov dword [0x1800fee50], 0xc0000409
mov dword [0x1800fee54], 1
mov rax, qword [0x1800f7050]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800f7058]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800feee8], eax
mov ecx, 1
call fcn.18006474c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800b8728]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800feee8], 0
jne 0x18006429e
mov ecx, 1
call fcn.18006474c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x18006603c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180065eb0
Function at 0x18006ce54
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18006475c
xor ebx, ebx
mov rdi, rax
cmp qword [0x1800ffbb8], rbx
jne 0x18006cf5a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18006d02f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18006d02f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1800b99c0]
mov rcx, rsi
mov qword [0x1800ffbb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1800ffbc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1800ffbc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1800ffbd8], rax
test rax, rax
je 0x18006cf51
lea rdx, [0x1800b9970]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1800ffbd0], rax
jmp 0x18006cf61
mov rax, qword [0x1800ffbd0]
jmp 0x18006cf68
mov rax, qword [0x1800ffbd0]
mov r11, qword [0x1800ffbd8]
cmp rax, rdi
je 0x18006cfd0
cmp r11, rdi
je 0x18006cfd0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1800ffbd8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18006cfd0
test rax, rax
je 0x18006cfd0
call rsi
test rax, rax
je 0x18006cfca
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18006cfca
test byte [rsp + 0x38], 1
jne 0x18006cfd0
bts ebp, 0x15
jmp 0x18006d00e
mov rcx, qword [0x1800ffbc0]
cmp rcx, rdi
je 0x18006d00e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18006d00e
call rax
mov rbx, rax
test rax, rax
je 0x18006d00e
mov rcx, qword [0x1800ffbc8]
cmp rcx, rdi
je 0x18006d00e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18006d00e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1800ffbb8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18006d02f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18006d031
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180078c50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
movsxd rbx, dword [rsp + 0x40]
xor r10d, r10d
mov rsi, r8
mov r11, rdx
cmp r9d, 2
jne 0x180078d52
cmp rbx, 2
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], r12
mov r12d, r10d
mov ebp, r10d
mov r9, r10
jl 0x180078d0d
mov qword [rsp + 0x30], r13
mov rdi, rdx
mov qword [rsp + 0x38], r14
lea r14, [rbx - 1]
lea r13, [r8 + 4]
sub rdi, r8
mov ecx, dword [r13 - 4]
mov r8d, dword [r11 + r9*4]
add r9, 2
mov eax, ecx
add r13, 8
cdq
sub eax, edx
sar eax, 1
sub r8d, eax
lea eax, [rcx + r8]
cdq
mov ecx, eax
mov eax, r8d
mov r8d, dword [rdi + r13 - 8]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
add ebp, ecx
mov ecx, dword [r13 - 8]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
sub r8d, eax
lea eax, [rcx + r8]
cdq
mov ecx, eax
mov eax, r8d
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add r12d, eax
add r12d, ecx
cmp r9, r14
jl 0x180078ca1
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
cmp r9, rbx
jge 0x180078d3d
mov ecx, dword [rsi + r9*4]
mov r8d, dword [r11 + r9*4]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
sub r8d, eax
lea eax, [rcx + r8]
cdq
mov r10d, eax
mov eax, r8d
xor r10d, edx
sub r10d, edx
cdq
xor eax, edx
sub eax, edx
add r10d, eax
lea eax, [r12 + rbp]
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
add eax, r10d
pop rdi
pop rsi
pop rbx
ret
cmp r9d, 1
jne 0x180078dae
cmp rbx, 2
mov r8d, r10d
mov r9d, r10d
mov rcx, r10
jl 0x180078d92
lea rdi, [rbx - 1]
nop dword [rax + rax]
mov eax, dword [r11 + rcx*4]
add rcx, 2
cdq
xor eax, edx
sub eax, edx
add r8d, eax
mov eax, dword [r11 + rcx*4 - 4]
cdq
xor eax, edx
sub eax, edx
add r9d, eax
cmp rcx, rdi
jl 0x180078d70
cmp rcx, rbx
jge 0x180078da3
mov eax, dword [r11 + rcx*4]
cdq
xor eax, edx
sub eax, edx
mov r10d, eax
lea eax, [r9 + r8]
add eax, r10d
pop rdi
pop rsi
pop rbx
ret
mov eax, r10d
pop rdi
pop rsi
pop rbx
ret
Function at 0x18007ba90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
xor ebp, ebp
mov eax, 1
mov rdi, r9
mov r12d, r8d
mov r13, rdx
mov r14, rcx
mov esi, ebp
mov dword [r9], eax
mov ebx, r8d
test r8d, r8d
jle 0x18007bb04
nop
cmp dword [rdi], ebp
jbe 0x18007bb04
test eax, eax
je 0x18007bb04
mov rcx, qword [r14 + 8]
mov edx, r12d
mov r9, rdi
sub edx, ebx
mov r8d, ebx
mov qword [rsp + 0x20], rbp
add rdx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x18007bb00
mov ecx, dword [rdi]
sub ebx, ecx
add esi, ecx
test ebx, ebx
jg 0x18007bad0
mov rbx, qword [rsp + 0x50]
test eax, eax
mov dword [rdi], esi
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov ecx, 0x3e8
cmove ebp, ecx
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r13
pop r12
ret

Function at 0x18007bb40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx + 8]
mov rbx, r9
mov edi, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18007bb78
cmp dword [rbx], edi
jne 0x18007bb78
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, 0x3e9
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18007bbb0
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x18007bdf0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x10]
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800a2390
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
test rcx, rcx
je 0x1800a2450
mov rax, qword [rcx]
xor r8d, r8d
lea r11, [0x1800c25b0]
mov byte [rax + 0x16], r8b
mov rax, qword [rcx]
mov byte [rax + 0x17], r8b
mov rax, qword [rcx]
mov byte [rax + 0x18], r8b
mov rax, qword [rcx]
mov byte [rax + 0x19], r8b
mov eax, dword [rcx + 8]
test eax, eax
jle 0x1800a23f4
mov r9, qword [rcx]
mov r10, rax
nop
movzx eax, byte [r9]
mov ecx, r8d
inc r9
shr rcx, 0x18
xor rcx, rax
mov eax, r8d
mov r8d, dword [r11 + rcx*4]
shl eax, 8
xor r8d, eax
sub r10, 1
jne 0x1800a23d0
mov eax, dword [rdx + 0x18]
test eax, eax
jle 0x1800a2426
mov r9, qword [rdx + 0x10]
mov r10, rax
movzx eax, byte [r9]
mov ecx, r8d
inc r9
shr rcx, 0x18
xor rcx, rax
mov eax, r8d
mov r8d, dword [r11 + rcx*4]
shl eax, 8
xor r8d, eax
sub r10, 1
jne 0x1800a2402
mov rax, qword [rdx]
mov ecx, r8d
mov byte [rax + 0x16], r8b
mov rax, qword [rdx]
shr ecx, 8
mov byte [rax + 0x17], cl
mov rax, qword [rdx]
mov ecx, r8d
shr ecx, 0x10
shr r8d, 0x18
mov byte [rax + 0x18], cl
mov rax, qword [rdx]
mov byte [rax + 0x19], r8b
repz ret
Function at 0x14000139c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x140013fc0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rcx, qword [0x140014058]
test rcx, rcx
je 0x1400013f3
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rsi, [rsp + 0x2c]
mov edx, 8
mov r8d, 0x40
mov r9, rsi
call rdi
mov qword [0x140014058], 0
mov r8d, dword [rsi]
mov edx, 8
xor ecx, ecx
mov r9, rsi
call rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14000b570
nop
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140001408
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x140013fc0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.VirtualAlloc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140014058], rax
lea rsi, [0x140014058]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdi, [rsp + 0x24]
mov edx, 8
mov rcx, rsi
mov r8d, 0x40
mov r9, rdi
call rbx
lea rax, [0x140001392]
mov qword [0x140014058], rax
mov r8d, dword [rdi]
mov edx, 8
mov rcx, rsi
mov r9, rdi
call rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000b570
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140001d4f
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov rsi, rcx
mov rax, qword [0x140013fc0]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rdi, [rsp + 0x20]
mov ecx, 0x100
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rsi
mov rdx, rdi
call fcn.140001250
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14000b570
mov rax, rsi
add rsp, 0x128
pop rdi
pop rsi
ret
Function at 0x140004023
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rdx
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x140004038
test r8, r8
je 0x140004062
xor r9d, r9d
movabs r10, 0x100000001b3
movzx eax, byte [rdx + r9]
xor rax, rcx
imul rax, r10
inc r9
mov rcx, rax
cmp r8, r9
jne 0x14000404a
ret
mov rax, rcx
ret

Function at 0x14000691c
Capabilities:
Parse credit card information

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, edx
mov rsi, rcx
mov edi, 1
cmp edx, 0x3a
je 0x14000694b
xor edi, edi
cmp ebp, 0x3d
je 0x14000694b
xor eax, eax
cmp ebp, 0x2e
mov edi, 0xe
cmove edi, eax
mov rbx, qword [rsi]
xor r14d, r14d
movabs r15, 0x4800800000000001
mov eax, dword [rsi + 0x7c]
lea ecx, [rax + 1]
cmp ecx, 0x3e
ja 0x14000696c
bt r15, rcx
jb 0x140006979
mov rcx, rsi
call fcn.1400052ce
inc r14
jmp 0x14000695b
cmp eax, ebp
jne 0x1400069cb
cmp ebp, 0x3a
jne 0x1400069f9
mov r14, qword [rsi + 0x68]
mov ecx, dword [rsi + 0x70]
mov edx, 0x100
call fcn.140004420
test eax, eax
setne r9b
mov r8, qword [rsi]
mov rcx, r14
mov rdx, rbx
call fcn.140005e92
mov ebx, eax
test ax, ax
jne 0x1400069bb
mov rcx, rsi
mov edx, 1
call fcn.140004eb0
lea rcx, [rsi + 0x40]
mov edx, ebx
xor r8d, r8d
call fcn.14000600a
jmp 0x1400069d5
mov rcx, rsi
mov edx, edi
call fcn.140004eb0
mov rcx, rsi
call fcn.1400052ce
mov rcx, rsi
mov edx, 0x5d
mov r8d, edi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14000554e
cmp ebp, 0x2e
je 0x140006a1c
cmp ebp, 0x3d
jne 0x1400069d5
mov r8, qword [rsi]
cmp rbx, r8
je 0x140006a35
lea rcx, [rsi + 0x40]
mov rdx, rbx
mov r9, r14
call fcn.140006a3c
jmp 0x1400069d5
mov r8, qword [rsi]
cmp rbx, r8
je 0x140006a35
lea rcx, [rsi + 0x40]
mov rdx, rbx
mov r9, r14
call fcn.140006b38
jmp 0x1400069d5
mov rcx, rsi
xor edx, edx
jmp 0x1400069d0

Function at 0x14000b248
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx], 0
je 0x14000b279
mov eax, 0x75776791
mov edx, 1
xor r8d, r8d
movzx r8d, word [r8 + rcx]
mov r9d, eax
rol r9d, 0x18
add r9d, r8d
xor eax, r9d
mov r8d, edx
inc edx
cmp byte [rcx + r8], 0
jne 0x14000b25a
ret
mov eax, 0x75776791
ret
Function at 0x14000b27f
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, 1
cmp dword [0x140014070], 0
jne 0x14000b436
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x14000b3ae
xor r8d, r8d
mov ecx, 0xdfdfdfdf
mov rbx, rdx
movsxd rdx, dword [rdx + 0x3c]
mov edx, dword [rdx + rbx + 0x88]
test rdx, rdx
je 0x14000b30b
mov r8d, dword [rdx + rbx + 0xc]
add rdx, rbx
mov r9d, dword [r8 + rbx]
and r9d, ecx
cmp r9d, 0x4c44544e
jne 0x14000b308
mov r9d, dword [r8 + rbx + 4]
and r9d, ecx
mov r8, rdx
cmp r9d, 0x4c440e4c
jne 0x14000b30b
jmp 0x14000b323
mov r8, rdx
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
test rdx, rdx
jne 0x14000b2c7
mov rdx, r8
test r8, r8
je 0x14000b3ae
mov r14d, dword [rdx + 0x18]
mov r15d, dword [rdx + 0x1c]
add r15, rbx
mov r12d, dword [rdx + 0x20]
add r12, rbx
mov r13d, dword [rdx + 0x24]
add r13, rbx
lea ebp, [r14 - 1]
xor edi, edi
lea rsi, [0x140014070]
mov ecx, dword [r12 + rbp*4]
movzx eax, word [rcx + rbx]
cmp eax, 0x775a
jne 0x14000b38b
add rcx, rbx
call fcn.14000b248
mov ecx, edi
shl rcx, 4
mov dword [rcx + rsi + 8], eax
movzx eax, word [r13 + rbp*2]
mov eax, dword [r15 + rax*4]
mov dword [rcx + rsi + 0xc], eax
mov qword [rcx + rsi + 0x10], 0
inc edi
cmp edi, 0x258
je 0x14000b3b5
dec r14d
dec rbp
test r14d, r14d
jne 0x14000b349
mov dword [0x140014070], edi
mov r15d, edi
dec r15d
mov eax, 1
jne 0x14000b3cf
jmp 0x14000b436
xor eax, eax
jmp 0x14000b436
mov dword [0x140014070], 0x258
mov edi, 0x258
mov r15d, 0x257
mov eax, 1
xor ecx, ecx
lea rdx, [0x140014090]
mov r8d, r15d
mov r8d, r8d
inc ecx
cmp edi, ecx
je 0x14000b42e
mov r10d, dword [0x14001407c]
mov r9, r8
mov r11, rdx
mov esi, dword [r11 - 4]
cmp r10d, esi
jbe 0x14000b422
mov ebx, dword [r11 - 0x18]
mov r14, qword [r11 - 0x10]
mov ebp, dword [r11 - 8]
mov dword [r11 - 0x18], ebp
mov dword [r11 - 0x14], esi
mov rsi, qword [r11]
mov qword [r11 - 0x10], rsi
mov dword [r11 - 8], ebx
mov dword [r11 - 4], r10d
mov qword [r11], r14
jmp 0x14000b425
mov r10d, esi
add r11, 0x10
dec r9
jne 0x14000b3f1
dec r8d
cmp ecx, r15d
jne 0x14000b3db
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000b4a0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x8395cb5a
call fcn.14000b447
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x14000bd9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bde6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bde6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bde6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bde6
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bde6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bde8
xor al, al
add rsp, 0x28
ret
Function at 0x142463058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1424631df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x142463089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14246306f
add dl, dl
jne 0x142463096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1424630f6
xor eax, eax
add dl, dl
jne 0x1424630a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1424631ad
add dl, dl
jne 0x1424630b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424630c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424630d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1424630dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1424630ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14246307e
mov eax, 1
add dl, dl
jne 0x142463106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x142463113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1424630fb
sub eax, ebx
mov ebx, 1
jne 0x14246314c
mov ecx, 1
add dl, dl
jne 0x14246312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14246313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x142463123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14246307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x142463168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x142463175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14246315d
cmp eax, 0x7d00
jae 0x14246319b
cmp eax, 0x500
jb 0x142463196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14246307e
cmp eax, 0x7f
ja 0x14246319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14246307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1424631d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14246307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20