joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov edi, edx
mov dword [rbp - 0x1b], 0x64616572
mov word [rbp - 0x13], 0x6972
mov word [rbp - 0x10], 0x79
mov word [rbp - 0x16], 0x6972
mov byte [rbp - 0x11], 0x74
mov byte [rbp - 0x17], 0x50
mov dword [rbp - 0x20], 0x54746553
mov byte [rbp - 0x14], 0x6f
mov byte [rbp - 0x1c], 0x68
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000f436
mov edx, edi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180012c90
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x18000f460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov rdi, rdx
mov dword [rbp - 0x1d], 0x33646165
mov word [rbp - 0x17], 0x7269
mov word [rbp - 0x14], 0x74
mov word [rbp - 0x19], 0x4632
mov word [rbp - 0x1f], 0x7268
mov byte [rbp - 0x20], 0x54
mov byte [rbp - 0x15], 0x73
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000f4ef
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180012c90
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret

Function at 0x18000f510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x30]
mov rdi, rdx
mov word [rbp - 0x19], 0x4e32
mov word [rbp - 0x1c], 0x6461
mov dword [rbp - 0x17], 0x747865
mov byte [rbp - 0x1a], 0x33
mov word [rbp - 0x1f], 0x7268
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0x20], 0x54
mov dword [rbp - 0x29], 0x6c642e32
mov word [rbp - 0x25], 0x6c
mov dword [rbp - 0x2f], 0x656e7265
mov word [rbp - 0x2b], 0x336c
mov byte [rbp - 0x30], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000f59d
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180012c90
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x18000f5c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
lea rcx, [rbp - 0x20]
mov esi, r8d
mov rdi, rdx
mov word [rbp - 0x2a], 0x466c
mov word [rbp - 0x2d], 0x7574
mov dword [rbp - 0x28], 0x656572
mov word [rbp - 0x30], 0x6956
mov byte [rbp - 0x2e], 0x72
mov byte [rbp - 0x2b], 0x61
mov dword [rbp - 0x19], 0x6c642e32
mov word [rbp - 0x15], 0x6c
mov dword [rbp - 0x1f], 0x656e7265
mov word [rbp - 0x1b], 0x336c
mov byte [rbp - 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000f64c
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180012c90
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000f670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x58]
mov rbx, rcx
lea rcx, [rbp - 0x38]
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
mov dword [rbp - 0x26], 0x61757472
mov dword [rbp - 0x1b], 0x784574
mov dword [rbp - 0x21], 0x746f7250
mov word [rbp - 0x28], 0x6956
mov word [rbp - 0x1d], 0x6365
mov byte [rbp - 0x22], 0x6c
mov dword [rbp - 0x31], 0x6c642e32
mov word [rbp - 0x2d], 0x6c
mov dword [rbp - 0x37], 0x656e7265
mov word [rbp - 0x33], 0x336c
mov byte [rbp - 0x38], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000f710
mov r9d, r14d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], r15
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1800102b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.18000e930
test rax, rax
je 0x180010318
lea rdx, [rsp + 0x20]
mov rcx, rax
mov word [rsp + 0x25], 0x6957
mov dword [rsp + 0x20], 0x6e697242
mov dword [rsp + 0x27], 0x776f646e
mov dword [rsp + 0x2d], 0x706f54
mov byte [rsp + 0x24], 0x67
mov word [rsp + 0x2b], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x48
ret
Function at 0x180010330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.18000e930
test rax, rax
je 0x180010396
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x2b], 0x776f646e
mov dword [rsp + 0x25], 0x65766974
mov dword [rsp + 0x20], 0x41746553
mov word [rsp + 0x29], 0x6957
mov byte [rsp + 0x2f], 0
mov byte [rsp + 0x24], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x48
ret

Function at 0x1800103b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.18000e930
test rax, rax
je 0x180010427
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x23], 0x65726f46
mov dword [rsp + 0x2f], 0x776f646e
mov dword [rsp + 0x2a], 0x57646e75
mov word [rsp + 0x20], 0x6553
mov word [rsp + 0x27], 0x7267
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x2e], 0x69
mov byte [rsp + 0x29], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x48
ret

Function at 0x180010440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rsp + 0x30], rax
call fcn.18000e930
test rax, rax
je 0x1800104a3
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x21], 0x69577465
mov dword [rsp + 0x28], 0x736f5077
mov word [rsp + 0x25], 0x646e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x27], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x48
ret

Function at 0x180010a90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180010ac3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180010b09
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180010b04
nop
cmp rbx, rcx
jae 0x180010b09
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x180010af0
cmp rbx, rcx
jb 0x180010b0d
xor eax, eax
jmp 0x180010b19
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180010b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x158
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp edx, 1
jne 0x180010c2e
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call fcn.18000ec10
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.180014644
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x26], 0x75732074
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.18001434c
test rax, rax
jne 0x180010c62
lea rdx, [sym.gphelper.dll_HookSetWindowPos]
lea rcx, [0x180072ae8]
call fcn.180011a70
test eax, eax
je 0x180010c62
lea rdx, [sym.gphelper.dll_HookSetForegroundWindow]
lea rcx, [0x180072ab8]
call fcn.180011a70
test eax, eax
je 0x180010c62
lea rdx, [sym.gphelper.dll_HookSetActiveWindow]
lea rcx, [0x180072bc0]
call fcn.180011a70
test eax, eax
je 0x180010c62
lea rdx, [sym.gphelper.dll_HookBringWindowToTop]
lea rcx, [0x180072b38]
call fcn.180011a70
jmp 0x180010c62
test edx, edx
jne 0x180010c62
lea rcx, [0x180072ae8]
call fcn.180011ed0
lea rcx, [0x180072ab8]
call fcn.180011ed0
lea rcx, [0x180072bc0]
call fcn.180011ed0
lea rcx, [0x180072b38]
call fcn.180011ed0
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x158
ret
Function at 0x180011760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
lea rcx, [rbp - 0x30]
xor ebx, ebx
mov r12, r9
mov r15, r8
mov r14d, edx
mov word [rbp - 0x2c], 0x3233
mov dword [rbp - 0x2a], 0x6c6c642e
mov word [rbp - 0x2f], 0x6573
mov byte [rbp - 0x26], bl
mov byte [rbp - 0x30], 0x55
mov byte [rbp - 0x2d], 0x72
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x18000ea4f
lea rdx, [rbp - 0x20]
mov rcx, rax
mov word [rbp - 0x14], 0x7845
mov byte [rbp - 0x12], bl
mov dword [rbp - 0x19], 0x6f6f4874
mov dword [rbp - 0x1d], 0x78654e6c
mov word [rbp - 0x1f], 0x6c61
mov byte [rbp - 0x15], 0x6b
mov byte [rbp - 0x20], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ea46
mov r9, r12
mov r8, r15
mov edx, r14d
mov rcx, rsi
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180012c90
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
xor ecx, ecx
jmp 0x18000e9a0

Function at 0x180012150
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x500
mov rax, qword [0x1800713f0]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov ebp, r8d
mov rsi, rdx
mov r8d, ecx
mov ecx, 0x1fffff
xor edx, edx
call fcn.18000efa0
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180012225
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
cmp eax, 0xffffffff
je 0x180012257
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x518], rdi
mov dword [rsp + 0x50], 0x100001
xor edi, edi
call fcn.18000ed70
test eax, eax
je 0x18001221a
nop
mov rcx, qword [rsp + 0x118]
cmp rcx, rsi
jb 0x18001221a
lea rax, [rsi + rbp]
cmp rcx, rax
jae 0x18001221a
mov rcx, rbx
call fcn.18000f300
cmp edi, 3
jge 0x18001224a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rsp + 0x20]
mov rcx, rbx
inc edi
call fcn.18000ed70
test eax, eax
jne 0x1800121d0
mov rax, rbx
mov rdi, qword [rsp + 0x518]
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.180012c90
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18001221d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x180012225
Function at 0x140001720
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x130
mov ebp, ecx
test ecx, ecx
je 0x1400017bb
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x1400017bb
mov r14d, 0x104
nop
movzx eax, word [rbx + 0x48]
test ax, ax
je 0x1400017bb
cmp ax, r14w
jae 0x1400017bb
mov rax, qword [rbx + 0x50]
xor edi, edi
cmp word [rax], di
je 0x1400017a0
xor esi, esi
xor ecx, ecx
nop
movzx ecx, byte [rcx + rax]
call fcn.1400019a0
inc edi
mov byte [rsp + rsi + 0x20], al
mov rax, qword [rbx + 0x50]
mov esi, edi
lea rcx, [rdi + rdi]
cmp word [rcx + rax], 0
jne 0x140001780
lea rcx, [rsp + 0x20]
mov byte [rsp + rdi + 0x20], 0
call fcn.140001e30
cmp eax, ebp
je 0x1400017db
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140001760
xor eax, eax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400017bd
Function at 0x1400017f0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov ebp, edx
mov rdi, rcx
test rcx, rcx
je 0x140001925
test edx, edx
je 0x140001925
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001925
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001925
movups xmm0, xmmword [rax + 0x18]
lea rcx, [rsp + 0x20]
xor ebx, ebx
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm1
mov r14d, dword [rsp + 0x90]
add r14, rdi
mov r15d, dword [r14 + 0x20]
mov r12d, dword [r14 + 0x1c]
add r15, rdi
mov r13d, dword [r14 + 0x24]
add r12, rdi
add r13, rdi
cmp dword [r14 + 0x14], ebx
jbe 0x140001925
nop dword [rax + rax]
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r15 + rbx*4]
add rcx, rdi
mov esi, dword [r12 + rax*4]
add rsi, rdi
call fcn.140001e30
cmp ebp, eax
je 0x140001948
inc ebx
cmp ebx, dword [r14 + 0x14]
jb 0x140001900
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x140001927
Function at 0x140001e30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x140001edc
movsx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140001e43
not eax
ret
Function at 0x140a6e370
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140a6e4f7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a6e3a1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a6e387
add dl, dl
jne 0x140a6e3ae
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a6e40e
xor eax, eax
add dl, dl
jne 0x140a6e3bd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a6e4c5
add dl, dl
jne 0x140a6e3ce
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6e3db
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6e3e8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6e3f5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a6e402
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a6e396
mov eax, 1
add dl, dl
jne 0x140a6e41e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6e42b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a6e413
sub eax, ebx
mov ebx, 1
jne 0x140a6e464
mov ecx, 1
add dl, dl
jne 0x140a6e446
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a6e453
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a6e43b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a6e396
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a6e480
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a6e48d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a6e475
cmp eax, 0x7d00
jae 0x140a6e4b3
cmp eax, 0x500
jb 0x140a6e4ae
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a6e396
cmp eax, 0x7f
ja 0x140a6e4b6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a6e396
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a6e4ea
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a6e396
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140006d50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140006db1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140006d70
mov ecx, dword [r9]
jmp 0x140006e98
cmp ecx, 0x4e0
jb 0x140006e98
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140006dd0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140006e20
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140008bf4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008c3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008c3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008c3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008c3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140008c3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008c40
xor al, al
add rsp, 0x28
ret

Function at 0x140012938
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140012734
Function at 0x140016e54
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140016e6a
mov al, 1
jmp 0x140016eca
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140016e7b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140016ec8
mov ecx, dword [rcx + 0x18]
nop
call fcn.14001cefc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140016ec8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140016ec8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140016ec8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140016eca
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400189b4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140008490
sub rsp, rax
mov rax, qword [0x140035080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400153fc
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140018a03
mov rax, rbp
jmp 0x140018b0b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x7d9a0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140018e9c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x7d9a0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140018b07
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140018b07
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140018e9c
test rax, rax
js 0x140018b07
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140018b07
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140018af9
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140018af9
cmp byte [rcx], 0xd
jne 0x140018adf
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140018aee
cmp byte [rcx + 1], 0xa
jne 0x140018aee
inc rcx
jmp 0x140018aee
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x35b90]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140018ac1
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140018b0b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140007d60
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret