joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002cb20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [0x1400ecd08]
mov rsi, r8
mov r15d, edx
mov r14d, 0x1000
xor edx, edx
mov r8d, r14d
mov r12, r9
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14002cce4
movzx r8d, byte [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
cmp rsi, 0xffffffffffffffff
je 0x14002cb8a
test rsi, rsi
je 0x14002cc4a
dec rsi
lea rdx, [rsp + 0x30]
cmp qword [rdi + 8], r13
je 0x14002cba9
mov r8d, 1
mov rcx, rdi
call fcn.14002c530
mov dword [rsp + 0x34], eax
jmp 0x14002cbc6
mov rcx, qword [rdi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx r8d, byte [rsp + 0x30]
cmp eax, 1
jne 0x14002cc4a
test r8b, r8b
je 0x14002cbe2
mov byte [rbx], r8b
movzx r8d, byte [rsp + 0x30]
inc rbx
lea eax, [r14 - 1]
mov rdx, rbx
movsxd rcx, eax
sub rdx, rbp
cmp rdx, rcx
jle 0x14002cc24
mov rcx, qword [0x1400ecd08]
add r14d, 0x1000
mov r8, rbp
mov edx, 8
movsxd r9, r14d
sub ebx, ebp
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx r8d, byte [rsp + 0x30]
movsxd rbx, ebx
mov rbp, rax
add rbx, rax
test r8b, r8b
je 0x14002cc4a
test r15d, r15d
jne 0x14002cb78
cmp r8b, 0xd
je 0x14002cc4f
cmp r8b, 0xa
jne 0x14002cb78
dec rbx
jmp 0x14002cccd
test r15d, r15d
jne 0x14002cccd
cmp r8b, 0xa
jne 0x14002cc5a
dec rbx
jmp 0x14002cccd
cmp r8b, 0xd
jne 0x14002cccd
dec rbx
lea rdx, [rsp + 0x30]
cmp qword [rdi + 8], r13
je 0x14002cc82
mov r8d, 1
mov rcx, rdi
call fcn.14002c530
mov dword [rsp + 0x34], eax
jmp 0x14002cc9b
mov rcx, qword [rdi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x30], 0xa
je 0x14002cccd
cmp qword [rdi + 8], r13
je 0x14002ccad
inc dword [rdi + 0x14]
jmp 0x14002cccd
mov rcx, qword [rdi]
lea r8, [rsp + 0x3c]
mov r9d, 1
or edx, 0xffffffff
mov qword [rsp + 0x38], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, rbx
sub rax, rbp
mov qword [r12], rax
mov byte [rbx], r13b
mov rbx, qword [rsp + 0x70]
mov rax, rbp
jmp 0x14002cce7
mov rax, r13
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002cd10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x68], ebp
test rdx, rdx
je 0x14002cead
cmp byte [rdx], bpl
je 0x14002cead
cmp r8d, 0x19
jne 0x14002cdae
lea r8, [rsp + 0x78]
xor ecx, ecx
call fcn.14002d090
mov rbx, rax
test rax, rax
je 0x14002cead
mov r8d, dword [rsp + 0x78]
mov rdx, rax
add r8d, r8d
cmp qword [rdi + 8], rbp
je 0x14002cd77
mov rcx, rdi
call fcn.14002c660
mov dword [rsp + 0x68], eax
jmp 0x14002cd8a
mov rcx, qword [rdi]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1400ecd08]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movsxd rax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp r8d, 2
jne 0x14002ce5e
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], bpl
jne 0x14002cdc0
mov rcx, qword [0x1400ecd08]
mov qword [rsp + 0x78], r8
lea r8, [r8*4]
xor edx, edx
mov qword [rsp + 0x30], r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x14002cead
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov r8, rbx
mov rcx, rax
call fcn.140038230
mov r8d, dword [rsp + 0x30]
mov rdx, rsi
cmp qword [rdi + 8], rbp
je 0x14002ce27
mov rcx, rdi
call fcn.14002c660
mov dword [rsp + 0x68], eax
jmp 0x14002ce3a
mov rcx, qword [rdi]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x1400ecd08]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movsxd rax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
or r8, 0xffffffffffffffff
cmp qword [rcx + 8], rbp
je 0x14002ce91
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], bpl
jne 0x14002ce70
call fcn.14002c660
mov dword [rsp + 0x68], eax
cdqe
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
inc r8
cmp byte [rdx + r8], bpl
jne 0x14002ce91
mov rcx, qword [rcx]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002cf50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rbx, rdx
mov rsi, rcx
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x50], 0
je 0x14002cf85
mov r8d, 1
call fcn.14002c530
mov dword [rsp + 0x50], eax
jmp 0x14002cfa6
mov rcx, qword [rcx]
lea r9, [rsp + 0x50]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x50]
cmp eax, 1
je 0x14002cfb8
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
movzx ecx, byte [rsp + 0x40]
test cl, cl
js 0x14002cfd7
mov byte [rbx], cl
mov byte [rbx + 1], 0
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
movzx eax, cl
mov qword [rsp + 0x48], rdi
and al, 0xe0
cmp al, 0xc0
jne 0x14002cfec
mov edi, 2
jmp 0x14002d00a
movzx eax, cl
and al, 0xf0
cmp al, 0xe0
jne 0x14002cffc
mov edi, 3
jmp 0x14002d00a
movzx eax, cl
and al, 0xf8
cmp al, 0xf0
jne 0x14002d075
mov edi, 4
mov byte [rbx], cl
cmp qword [rsi + 8], 0
lea rdx, [rbx + 1]
je 0x14002d02a
lea eax, [rdi - 1]
mov rcx, rsi
movsxd r8, eax
call fcn.14002c530
mov rcx, rax
jmp 0x14002d049
mov rcx, qword [rsi]
lea r8d, [rdi - 1]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x50]
lea eax, [rdi - 1]
cmp ecx, eax
je 0x14002d062
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
movsxd rax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rdi, qword [rsp + 0x48]
mov word [rbx], 0x3f
mov rbx, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x30
pop rsi
ret

Function at 0x14002e2a8
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x20
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x14002e2ca
call qword [sym.imp.USER32.DLL_EmptyClipboard]
mov ebx, eax
call qword [sym.imp.USER32.DLL_CloseClipboard]
movsxd rax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14002e2d4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x14002e36a
lea rsi, [0x140096307]
test rdi, rdi
cmovne rsi, rdi
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov ecx, 0x2002
inc eax
movsxd rbp, eax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x14002e364
call qword [sym.imp.USER32.DLL_EmptyClipboard]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14002e364
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [rbx + 1]
mov rdx, rdi
call qword [sym.imp.USER32.DLL_SetClipboardData]
mov rbx, rax
call qword [sym.imp.USER32.DLL_CloseClipboard]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002e7ec
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1400eefe0], eax
add rsp, 0x28
ret

Function at 0x14002e850
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x14002e8c5
mov eax, dword [rcx + 0xf4]
mov dword [rcx + 0x108], eax
mov eax, dword [rcx + 0xf8]
mov dword [rcx + 0x10c], eax
call qword [rcx + 0xb0]
mov rdi, rax
test rax, rax
jne 0x14002e8c5
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x14002e89d
xor edx, edx
mov rcx, rbx
call rax
mov rcx, qword [0x1400ecd08]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1400eefe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1400eeff0], 0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14002e9d8
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x1400eeff0]
test rbx, rbx
je 0x14002ea31
mov rcx, rbx
call qword [rbx + 0xb8]
mov rax, qword [rbx + 0xe0]
test rax, rax
je 0x14002ea09
mov edx, 1
mov rcx, rbx
call rax
mov rcx, qword [0x1400ecd08]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [0x1400eefe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
and qword [0x1400eeff0], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1400300f4
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1400ecd08]
mov edx, 8
mov r8d, 0x1c0
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400eefe0]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [0x1400eeff0], rbx
and dword [rbx + 0x11c], 0
or eax, 0xffffffff
mov dword [rbx + 0x118], 0xffffff
mov dword [rbx + 0xe8], 1
mov dword [rbx + 0x120], eax
mov dword [rbx + 0x124], eax
lea rax, [0x14002ecf0]
mov qword [rbx], rax
lea rax, [0x14002ed20]
mov dword [rbx + 0xec], 7
mov qword [rbx + 8], rax
lea rax, [0x14002fe38]
mov qword [rbx + 0x10], rax
lea rax, [0x14002edc8]
mov qword [rbx + 0x18], rax
lea rax, [0x14002f4a0]
mov qword [rbx + 0x20], rax
lea rax, [0x14002f430]
mov qword [rbx + 0x28], rax
lea rax, [0x14002f478]
mov qword [rbx + 0x30], rax
lea rax, [0x14002f48c]
mov qword [rbx + 0x38], rax
lea rax, [fcn.14002f514]
mov qword [rbx + 0x40], rax
lea rax, [0x14002f038]
mov qword [rbx + 0x48], rax
lea rax, [fcn.14002f050]
mov qword [rbx + 0x50], rax
lea rax, [0x14002eed4]
mov qword [rbx + 0x58], rax
lea rax, [0x14002f398]
mov qword [rbx + 0x60], rax
lea rax, [0x14002f2b4]
mov qword [rbx + 0x68], rax
lea rax, [0x14002f5b0]
mov qword [rbx + 0x70], rax
lea rax, [0x14002f6f4]
mov qword [rbx + 0x78], rax
lea rax, [0x14002f7e0]
mov qword [rbx + 0x80], rax
lea rax, [0x14002f898]
mov qword [rbx + 0x88], rax
lea rax, [0x14002f9e8]
mov qword [rbx + 0x90], rax
lea rax, [0x14002fa68]
mov qword [rbx + 0x98], rax
lea rax, [0x14002fb5c]
mov qword [rbx + 0xa0], rax
lea rax, [0x14002fd48]
mov qword [rbx + 0xa8], rax
lea rax, [0x14002fec0]
mov qword [rbx + 0xb0], rax
lea rax, [0x14002ffa8]
mov qword [rbx + 0xb8], rax
lea rax, [0x140030044]
mov qword [rbx + 0xc0], rax
lea rax, [0x140030098]
mov qword [rbx + 0xc8], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14005a870
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r8, rcx
test rcx, rcx
je 0x14005a93b
mov rdx, qword [rcx]
xor r9d, r9d
mov qword [rsp], rdi
mov eax, r9d
mov r10d, r9d
lea rdi, [0x140097120]
mov byte [rdx + 0x16], al
mov rdx, qword [rcx]
mov byte [rdx + 0x17], al
mov rdx, qword [rcx]
mov byte [rdx + 0x18], al
mov rdx, qword [rcx]
mov byte [rdx + 0x19], al
movsxd r11, dword [rcx + 8]
test r11, r11
jle 0x14005a8e5
mov qword [rsp + 0x10], rbx
mov rbx, qword [rcx]
nop dword [rax]
movzx edx, byte [rbx + r10]
mov ecx, eax
inc r10
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
mov eax, dword [rdi + rdx*4]
shl ecx, 8
xor eax, ecx
cmp r10, r11
jl 0x14005a8c0
mov rbx, qword [rsp + 0x10]
movsxd r10, dword [r8 + 0x18]
test r10, r10
jle 0x14005a912
mov r11, qword [r8 + 0x10]
movzx edx, byte [r11 + r9]
mov ecx, eax
inc r9
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
mov eax, dword [rdi + rdx*4]
shl ecx, 8
xor eax, ecx
cmp r9, r10
jl 0x14005a8f2
mov rcx, qword [r8]
mov rdi, qword [rsp]
mov edx, eax
mov byte [rcx + 0x16], al
mov rcx, qword [r8]
shr edx, 8
mov byte [rcx + 0x17], dl
mov rcx, qword [r8]
mov edx, eax
shr edx, 0x10
shr eax, 0x18
mov byte [rcx + 0x18], dl
mov rcx, qword [r8]
mov byte [rcx + 0x19], al
add rsp, 8
ret
Function at 0x14007ac5c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x1400ecd08]
mov edx, 8
mov r8d, 0x250
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x1400eefe0]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov qword [0x1400eeff0], rdi
and dword [rdi + 0x11c], 0
or eax, 0xffffffff
mov edx, ebx
mov rcx, rdi
mov dword [rdi + 0x118], 0xffffff
mov dword [rdi + 0xe8], 2
mov dword [rdi + 0xec], 0x3f
mov dword [rdi + 0x120], eax
mov dword [rdi + 0x124], eax
call fcn.14007e3b0
mov rbx, qword [rsp + 0x30]
lea rax, [0x14007bce4]
mov qword [rdi + 0xb0], rax
lea rax, [0x14007bd48]
mov qword [rdi + 0xb8], rax
lea rax, [fcn.14007b5c0]
mov qword [rdi + 0x20], rax
lea rax, [0x14007b468]
mov qword [rdi + 0x60], rax
lea rax, [0x14007bdec]
mov qword [rdi + 0xc8], rax
lea rax, [0x14007bd94]
mov qword [rdi + 0xc0], rax
lea rax, [0x14007b0f4]
mov qword [rdi + 0x68], rax
lea rax, [0x14007b098]
mov qword [rdi + 0x48], rax
lea rax, [0x14007b0c4]
mov qword [rdi + 0x50], rax
lea rax, [0x14007af48]
mov qword [rdi + 0x58], rax
lea rax, [0x14007b914]
mov qword [rdi + 0x88], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400829d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r10d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov ebx, r8d
mov r12, rdx
mov r11, rcx
test r10d, r10d
je 0x140082a9f
mov eax, dword [rsp + 0x50]
mov ecx, ebx
mov ebp, ebx
shl eax, 2
imul ecx, dword [rsp + 0x58]
movsxd r13, eax
mov eax, esi
imul eax, r9d
mov r9d, dword [rsp + 0x48]
neg ebp
movsxd rdi, eax
mov qword [rsp + 0x28], rdi
mov eax, dword [r11 + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [r11 + 0x150]
add rdx, rdi
cmp dword [rsp + 0x60], 0
jle 0x140082a84
mov edi, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 4]
xor byte [rdx], al
add rdx, rsi
dec rdi
jne 0x140082a60
mov rdi, qword [rsp + 0x28]
dec r10d
inc r9d
cmp dword [r11 + 0x174], 0
jne 0x140082a98
add ecx, ebp
jmp 0x140082a9a
add ecx, ebx
test r10d, r10d
jne 0x140082a34
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140083840
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
mov r11d, dword [rsp + 0x68]
movsxd rsi, dword [rcx + 0x160]
mov edi, r8d
mov r12, rdx
mov rbx, rcx
test r11d, r11d
je 0x140083909
mov eax, dword [rsp + 0x50]
mov ecx, r8d
mov ebp, r8d
lea r10d, [rax + rax*2]
mov eax, esi
imul ecx, dword [rsp + 0x58]
movsxd r13, r10d
imul eax, r9d
mov r9d, dword [rsp + 0x48]
movsxd r10, eax
mov qword [rsp + 0x28], r10
neg ebp
mov eax, dword [rbx + 0x158]
movsxd r8, ecx
add r8, r13
add r8, r12
imul eax, r9d
movsxd rdx, eax
add rdx, qword [rbx + 0x150]
add rdx, r10
cmp dword [rsp + 0x60], 0
jle 0x1400838ef
mov r10d, dword [rsp + 0x60]
mov al, byte [r8 + 2]
xor byte [rdx + 2], al
mov al, byte [r8 + 1]
xor byte [rdx + 1], al
mov al, byte [r8]
lea r8, [r8 + 3]
xor byte [rdx], al
add rdx, rsi
dec r10
jne 0x1400838cb
mov r10, qword [rsp + 0x28]
dec r11d
inc r9d
cmp dword [rbx + 0x174], 0
jne 0x140083902
add ecx, ebp
jmp 0x140083904
add ecx, edi
test r11d, r11d
jne 0x14008389f
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180001000
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18000103e
jmp 0x1800010eb
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x180001067
jmp 0x1800010eb
xor r9d, r9d
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x38]
mov edx, 0x6610
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
add rsp, 0x58
ret

Function at 0x180001c30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x180001c53
jmp 0x180001c88
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180001100]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x48
ret
Function at 0x18000969c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800096cc
xor eax, eax
jmp 0x18000978f
mov rbp, rbx
cmp word [rax], si
je 0x1800096f1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800096d8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800096d4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800095bc
movsxd r14, eax
test eax, eax
jne 0x18000972f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800096c5
mov rcx, r14
call fcn.18000a92c
mov rdi, rax
test rax, rax
jne 0x180009748
xor ecx, ecx
call fcn.180007bf4
jmp 0x180009724
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800095bc
test eax, eax
jne 0x180009779
mov rcx, rdi
call fcn.180007bf4
jmp 0x180009783
xor ecx, ecx
call fcn.180007bf4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140c3a108
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140c3a28f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c3a139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c3a11f
add dl, dl
jne 0x140c3a146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c3a1a6
xor eax, eax
add dl, dl
jne 0x140c3a155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c3a25d
add dl, dl
jne 0x140c3a166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c3a173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c3a180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c3a18d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c3a19a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c3a12e
mov eax, 1
add dl, dl
jne 0x140c3a1b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c3a1c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c3a1ab
sub eax, ebx
mov ebx, 1
jne 0x140c3a1fc
mov ecx, 1
add dl, dl
jne 0x140c3a1de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c3a1eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c3a1d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3a12e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c3a218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c3a225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c3a20d
cmp eax, 0x7d00
jae 0x140c3a24b
cmp eax, 0x500
jb 0x140c3a246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3a12e
cmp eax, 0x7f
ja 0x140c3a24e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3a12e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c3a282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c3a12e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001c4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c96
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c98
xor al, al
add rsp, 0x28
ret