joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e499b5f6
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x2a], 0x26003f
mov word [rsp + 0x2e], 0
cmp dx, 0x19
jne 0x2e499b621
push r10
emms
push rdx
nop
xadd r10d, edx
pop rdx
emms
pop r10
jmp 0x2e499b638
push r8
rol r8w, 2
push r14
packuswb mm3, mm6
emms
pop r14
shl r8w, 0x17
pop r8
push rcx
punpcklbw mm1, mm3
push r15
addps xmm6, xmm9
nop
pop r15
punpckhbw mm5, mm3
pop rcx
lea rbx, [rsp + 0x2a]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
cmp rax, 5
jne 0x2e499b675
push r15
rcpps xmm0, xmm11
nop
push r10
inc r15d
pop r10
movaps xmm2, xmm1
psrld mm6, 0x20
pop r15
jmp 0x2e499b6c7
mov rax, rbx
lea rdx, [rsp + 0x2e]
push r9
rol r9w, 0xa
push r10
pslld mm3, 0x21
pop r10
nop
pop r9
xor word [rax], 0x15
push r9
nop
rcl r9d, 7
shl r9b, 0x10
rcr r9, 2
psrlq mm5, 0x66
emms
sar r9b, 0x10
mulss xmm1, xmm12
nop
comiss xmm5, xmm9
nop
mulss xmm15, xmm13
pop r9
add rax, 2
cmp rax, rdx
jne 0x2e499b67d
push r10
subss xmm14, xmm9
pmullw mm0, mm1
push r15
mulss xmm3, xmm2
xor r10, r15
push r14
nop
pcmpgtd mm3, mm7
push rax
psrlw mm4, 0x4e
andps xmm8, xmm10
push r9
pxor mm7, mm3
pcmpgtb mm1, mm4
pop r9
sbb r10d, 0x14
dec r15
pop rax
cmp r10d, r15d
maxps xmm4, xmm7
pop r14
nop
add r10, r15
pop r15
sub r10w, 6
pxor mm1, mm7
pop r10
push rax
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x40]
pop rax
push r10
emms
psrlw mm3, 0x3a
pcmpgtd mm4, mm0
emms
xorps xmm0, xmm12
push rcx
rcr r10w, 0x16
rcr r10b, 6
movss xmm0, xmm2
emms
push r14
emms
paddsb mm4, mm1
inc rcx
push rbx
shl r10d, 8
mov cl, 0x11
push r9
cmp r9d, ebx
pop r9
emms
psraw mm3, 0x67
pop rbx
neg r14b
or cl, r14b
nop
pop r14
inc ecx
ucomiss xmm5, xmm1
movss xmm7, xmm12
neg r10d
pop rcx
emms
not r10b
sbb r10b, 0x10
minps xmm10, xmm12
pmullw mm1, mm5
pop r10
mov ecx, 0x10
call sub.msvcrt.dll_malloc
mov rcx, rax
push rcx
ror cx, 8
push r12
psrld mm1, 0x34
dec r12
pop r12
emms
pop rcx
mov edx, 0x90
call sub.msvcrt.dll_realloc
mov rcx, rax
push r8
shl r8b, 0xd
nop
pcmpeqb mm5, mm1
shl r8b, 0x10
punpckhwd mm6, mm7
pcmpeqd mm5, mm7
nop
emms
psraw mm5, 0x3c
emms
movaps xmm13, xmm0
dec r8d
pop r8
call sub.msvcrt.dll_free
cmp dx, r12w
jne 0x2e499b800
push rbx
psrlq mm5, 0x67
push r14
psrad mm7, 0xa
rcl bx, 4
pop r14
movhlps xmm3, xmm8
pop rbx
jmp 0x2e499b812
push rcx
shr rcx, 0xf
push r8
sub r8d, 0x16
emms
pop r8
emms
pop rcx
push r11
minps xmm6, xmm11
push r9
paddw mm3, mm7
movlhps xmm3, xmm14
pop r9
subss xmm9, xmm10
pop r11
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x2e499dc44
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov rdi, rdx
mov ebx, r8d
mov esi, r9d
push rdx
sar edx, 9
emms
shl rdx, 1
push rbx
maxps xmm0, xmm13
por mm7, mm6
push r10
emms
pop r10
pmaxub mm7, mm4
nop
pop rbx
nop
pcmpgtb mm3, mm6
punpcklbw mm1, mm6
pop rdx
call fcn.2e49b25ed
mov qword [rsp + 0x48], rdi
push r12
pandn mm6, mm3
paddusw mm1, mm2
push r11
dec r12
pop r11
rcpss xmm15, xmm12
pmullw mm4, mm0
pop r12
mov ecx, 4
mov edx, 4
call sub.msvcrt.dll_calloc
mov rcx, rax
xor eax, eax
push rdx
emms
push r8
punpcklbw mm3, mm4
nop
pop r8
emms
pop rdx
xor dword [rcx + rax*4], 0x25
push rdx
not rdx
movups xmm3, xmm15
push r13
nop
pop r13
not dx
rol dl, 0x14
pop rdx
inc rax
cmp rax, 4
jne 0x2e499dcb4
call sub.msvcrt.dll_free
push r13
emms
packsswb mm1, mm2
psllq mm2, 0x5e
psllq mm0, 4
push r8
inc r13d
emms
pandn mm1, mm2
emms
pop r8
nop
nop
dec r13d
inc r13
pop r13
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x48]
xor r8d, r8d
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x70]
call fcn.2e49aff89
mov dword [rsp + 0x3f], 0x747e4a
push r10
nop
dec r10
nop
emms
not r10
inc r10d
emms
pop r10
mov dword [rsp + 0x43], 0x65705f32
mov byte [rsp + 0x47], 0
push r8
psllq mm0, 4
push r15
neg r8w
push r14
minps xmm4, xmm13
push r12
mov r12w, r15w
push r9
emms
push r13
adc r13, r15
pop r13
comiss xmm10, xmm5
pop r9
add r12d, r15d
pop r12
mulss xmm7, xmm10
pop r14
nop
pop r15
nop
pop r8
lea rbx, [rsp + 0x43]
lea rcx, [rsp + 0x3f]
mov rdx, rbx
call sub.msvcrt.dll__mbscmp
test eax, eax
jne 0x2e499ddc1
push rdx
mov rdx, 1
push r15
push r11
pop r11
pop r15
dec rdx
jne 0x2e499ddae
pop rdx
jmp 0x2e499de93
mov rax, rbx
lea rdx, [rsp + 0x47]
push rcx
pandn mm0, mm4
paddd mm6, mm4
psrlq mm0, 0x17
pcmpgtw mm0, mm7
push r14
pslld mm3, 0x5f
mov r14, rcx
ror r14b, 0x14
push r9
psrad mm2, 0x1c
sbb ecx, 0x14
push r15
por mm3, mm0
pop r15
emms
dec r14d
pop r9
movss xmm7, xmm15
pxor mm5, mm7
not r14
pop r14
emms
emms
emms
emms
pop rcx
xor byte [rax], 0x55
push r9
andnps xmm0, xmm12
paddsb mm0, mm7
addps xmm11, xmm1
psrlw mm0, 0x60
pcmpeqb mm7, mm6
push rcx
psrad mm1, 0x5a
subps xmm6, xmm9
emms
xadd r9b, cl
push r14
emms
rol r14w, 0x11
mov r14, 0x12
push r13
punpcklwd mm5, mm0
psllq mm1, 0x2b
push r12
pmullw mm6, mm2
pop r12
dec r13
emms
pop r13
psllq mm0, 0x29
nop
psraw mm4, 0x55
pop r14
or r9w, cx
emms
sub ecx, 2
pmaxsw mm5, mm6
pop rcx
psubsb mm5, mm4
nop
pmullw mm6, mm1
shr r9d, 2
orps xmm10, xmm15
pop r9
inc rax
cmp rax, rdx
jne 0x2e499ddc9
cmp dl, r12b
jne 0x2e499df09
push r14
pslld mm3, 0x21
push r8
pcmpgtb mm1, mm2
push r15
shr r8d, 0xb
push rdx
sub r8, r15
push r11
nop
push rbx
emms
pop rbx
xorps xmm2, xmm4
pop r11
nop
pop rdx
sar r8w, 3
pop r15
psrld mm5, 0x45
pop r8
movlhps xmm14, xmm6
pop r14
jmp 0x2e499df49
push r10
not r10w
push r8
nop
push r12
psrlw mm6, 0x2e
push rax
emms
push r9
sbb r12d, 0xe
push r13
shr r10w, 0xb
push rcx
emms
pop rcx
mov r12, r13
pop r13
psrlw mm2, 0xf
pop r9
emms
pop rax
subss xmm10, xmm6
pop r12
maxps xmm2, xmm7
pop r8
nop
pop r10
push rbx
emms
pop rbx
mov rax, qword [rsp + 0x70]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
Function at 0x2e499df5a
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x40], rcx
mov rbx, rdx
push r12
pandn mm6, mm3
paddusw mm1, mm2
push r11
dec r12
pop r11
rcpss xmm15, xmm12
pmullw mm4, mm0
pop r12
mov ecx, 4
mov edx, 4
call sub.msvcrt.dll_calloc
mov rcx, rax
xor eax, eax
push rdx
emms
push r8
punpcklbw mm3, mm4
nop
pop r8
emms
pop rdx
xor dword [rcx + rax*4], 0x25
push rdx
not rdx
movups xmm3, xmm15
push r13
nop
pop r13
not dx
rol dl, 0x14
pop rdx
inc rax
cmp rax, 4
jne 0x2e499df94
call sub.msvcrt.dll_free
push r13
emms
packsswb mm1, mm2
psllq mm2, 0x5e
psllq mm0, 4
push r8
inc r13d
emms
pandn mm1, mm2
emms
pop r8
nop
nop
dec r13d
inc r13
pop r13
mov qword [rsp + 0x28], rbx
push rbx
shr ebx, 2
pminsw mm0, mm4
mov ebx, 0x16
shl ebx, 0x10
push r10
emms
sbb bl, 0x10
pcmpeqw mm4, mm3
push r9
punpckldq mm7, mm4
psrlw mm2, 0x11
push r12
nop
pop r12
emms
paddusw mm7, mm5
pop r9
pminsw mm3, mm1
not bx
psadbw mm2, mm3
pop r10
emms
addss xmm1, xmm9
psrad mm1, 0x56
psrld mm5, 0x18
pop rbx
call fcn.2e49b240e
mov r9d, 0x8000
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x40]
or rcx, 0xffffffffffffffff
call fcn.2e49a68be
push r10
emms
rol r10d, 9
emms
shl r10w, 0x13
shr r10d, 5
andnps xmm4, xmm5
pcmpgtd mm4, mm3
pop r10
test eax, eax
jne 0x2e499e104
push r12
sbb r12w, 5
neg r12w
rol r12b, 0x12
subss xmm0, xmm13
nop
push r13
psrld mm7, 3
ror r13, 1
psrad mm6, 0x12
psraw mm0, 0x20
push r11
dec r11d
orps xmm2, xmm0
maxss xmm8, xmm13
push r15
psllq mm5, 0x24
sbb r11b, r12b
push r10
inc r12d
pop r10
psllq mm4, 0x37
pandn mm5, mm2
pop r15
emms
subss xmm5, xmm10
nop
pop r11
emms
psllq mm5, 0x6a
nop
psubusw mm6, mm2
pop r13
ror r12, 0x17
psrld mm1, 0xf
andps xmm6, xmm8
sbb r12d, 0xa
packuswb mm7, mm3
pop r12
call fcn.2e49b27d0
mov eax, 1
jmp 0x2e499e227
push r15
movlhps xmm0, xmm7
push r8
nop
push r14
not r14
push rdx
pslld mm4, 0x47
push rbx
mulps xmm1, xmm3
push rax
emms
pop rax
shl bx, 0xe
pop rbx
punpckhwd mm5, mm0
pop rdx
nop
pop r14
rcpss xmm13, xmm7
pop r8
sar r15, 5
pop r15
mov edx, 8
mov ecx, 3
call sub.msvcrt.dll_calloc
mov rcx, rax
push r9
andnps xmm13, xmm1
andnps xmm8, xmm6
emms
nop
pslld mm4, 0x45
push r12
add r9b, r12b
psrad mm3, 0x5a
neg r9w
paddusw mm2, mm4
push r8
pmaxsw mm1, mm5
nop
dec r12
push rdx
psrlw mm1, 0x61
movups xmm10, xmm0
push rbx
pcmpgtd mm7, mm5
pop rbx
movaps xmm13, xmm8
pcmpeqd mm4, mm1
pop rdx
adc r9, r12
inc r8d
maxss xmm13, xmm7
pop r8
emms
emms
and r12d, r9d
xadd r12w, r9w
pop r12
andps xmm12, xmm5
inc r9d
not r9
psrad mm1, 0xf
not r9b
pop r9
mov edx, 0xc0
call sub.msvcrt.dll_realloc
mov rcx, rax
push r9
nop
dec r9
emms
nop
push rdx
sbb rdx, r9
pmaddwd mm0, mm1
emms
push r12
nop
rol r9b, 4
push rax
nop
pop rax
sar r9, 0x10
test dx, r9w
pop r12
andnps xmm11, xmm14
dec rdx
maxss xmm10, xmm0
pop rdx
psubw mm4, mm2
maxss xmm1, xmm14
psrlw mm5, 0x58
shl r9, 0xb
pop r9
call sub.msvcrt.dll_free
push rdx
pcmpgtb mm4, mm1
rol rdx, 0xb
push r15
sbb dl, 0xc
pop r15
orps xmm10, xmm13
sub edx, 0x11
pop rdx
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x2e49aeb62
Capabilities:
Encode data using xor

Disassembly:
push r8
addps xmm8, xmm14
psrlw mm0, 0x46
push r10
rcpps xmm6, xmm13
pop r10
rcr r8w, 0xd
shl r8, 8
pop r8
mov qword [rsp + 8], rcx
push r14
nop
emms
subps xmm7, xmm15
nop
por mm4, mm3
push r8
emms
nop
nop
emms
and r8d, r14d
pop r8
not r14d
nop
nop
nop
pcmpgtb mm3, mm1
nop
pop r14
mov qword [rsp + 0x10], rdx
push rcx
psrad mm3, 0x32
push rax
psrad mm5, 0x16
push r10
psrld mm7, 0x59
push r14
punpcklwd mm0, mm7
pop r14
maxps xmm8, xmm6
pop r10
orps xmm0, xmm11
pop rax
mulps xmm11, xmm9
pop rcx
mov qword [rsp + 0x18], r8
push r9
psraw mm7, 0x68
push r15
psrld mm4, 0x31
push rdx
sbb r9w, r15w
push r12
xchg r15w, r12w
pop r12
sar r15b, 0xb
pop rdx
addps xmm7, xmm3
pop r15
emms
pop r9
mov qword [rsp + 0x20], r9
cmp dx, ax
jne 0x2e49aec15
push r10
por mm0, mm3
pop r10
jmp 0x2e49aec1a
push r13
nop
pop r13
push rbx
emms
pop rbx
sub rsp, 0x64
cmp dl, 0x23
jne 0x2e49aec39
push rbx
neg rbx
push r9
add r9, rbx
dec r9d
pop r9
nop
pop rbx
jmp 0x2e49aec4e
push r13
mov r13w, 8
push r12
nop
paddsb mm3, mm0
pop r12
psrad mm1, 0x45
pop r13
push rcx
neg cl
push r14
nop
emms
pop r14
shr ecx, 2
pop rcx
mov rcx, 0x3c965b5d
push r13
mov r13, 3
push r10
pop r10
dec r13
jne 0x2e49aec6c
pop r13
call fcn.2e49a31b3
push rbx
nop
pop rbx
mov r15, rax
push r13
mov r13, 2
push rax
not ax
nop
emms
maxps xmm15, xmm11
emms
push rbx
emms
nop
andps xmm1, xmm2
paddusw mm4, mm0
psrld mm6, 9
pop rbx
neg ax
punpckhbw mm7, mm0
xorps xmm4, xmm2
rcr eax, 5
dec rax
nop
pop rax
dec r13
jne 0x2e49aec8b
pop r13
mov rcx, 0x3c965b5d
push rbx
nop
push r15
sub r15b, bl
nop
push r8
emms
mulss xmm8, xmm6
rcr r8w, 0x16
pop r8
xchg bl, r15b
ucomiss xmm4, xmm14
pop r15
pmullw mm5, mm6
pop rbx
call fcn.2e49a335a
push rdx
paddusw mm1, mm0
punpckhwd mm6, mm5
movlhps xmm8, xmm5
emms
push rbx
dec rdx
emms
psrlq mm1, 0x36
nop
pop rbx
inc rdx
emms
psrad mm4, 0x28
nop
pop rdx
add rsp, 0x64
push r15
not r15b
push r11
nop
nop
push r10
nop
neg r10d
not r11
pop r10
dec r11d
emms
pop r11
not r15
pop r15
mov rcx, qword [rsp + 8]
push r14
inc r14
emms
pslld mm1, 0xd
psrld mm7, 6
nop
mov r14d, 5
rcl r14w, 0x10
pop r14
mov rdx, qword [rsp + 0x10]
cmp edx, r8d
jne 0x2e49aed7a
push r14
pxor mm2, mm5
push r11
pcmpgtd mm6, mm2
emms
pop r11
psraw mm4, 0x41
pop r14
jmp 0x2e49aed8c
push r12
nop
push rdx
neg rdx
rol dx, 7
pop rdx
subps xmm11, xmm6
pop r12
push r9
pandn mm4, mm2
push rbx
pmaddwd mm1, mm2
psrlq mm0, 0x3f
pop rbx
psrlw mm4, 3
pop r9
mov r8, qword [rsp + 0x18]
cmp dx, 0x4a
jne 0x2e49aedb1
push rdx
emms
pop rdx
jmp 0x2e49aedb7
push r9
emms
pop r9
push rax
comiss xmm3, xmm14
pop rax
mov r9, qword [rsp + 0x20]
cmp dx, r9w
jne 0x2e49aedd6
push r9
emms
pop r9
jmp 0x2e49aedde
push r13
psrad mm1, 0x2f
pop r13
push rdx
rcl rdx, 0xa
pop rdx
mov r10, rcx
push rax
mov rax, 3
push rbx
pop rbx
dec rax
jne 0x2e49aedef
pop rax
jmp r15
Function at 0x2e49b2d75
Capabilities:
Encode data using xor

Disassembly:
push rbx
emms
inc rbx
push rax
nop
pop rax
not ebx
maxss xmm7, xmm0
pop rbx
push r15
mov r15, 2
push r10
not r10
push r15
not r15d
shl r15, 0x11
push r9
pminsw mm6, mm0
mov r10w, 0x14
neg r10d
push r11
emms
psllq mm1, 0x63
not r9d
not r11b
push rbx
inc r10d
sar r11b, 0xe
addps xmm13, xmm6
pslld mm3, 0x35
and r11b, r10b
pop rbx
rcr r11b, 0x17
pcmpgtw mm2, mm4
orps xmm4, xmm1
nop
pop r11
emms
psllq mm4, 0x1e
paddw mm3, mm0
pop r9
psrlq mm5, 0x2b
psrld mm5, 0xd
pop r15
pandn mm4, mm7
pop r10
dec r15
jne 0x2e49b2d8e
pop r15
push r14
emms
movlhps xmm4, xmm12
nop
nop
addss xmm12, xmm11
push rcx
psllq mm3, 0x5e
psllq mm6, 0x4c
rcpss xmm14, xmm15
psubw mm5, mm6
push rbx
pand mm6, mm7
nop
rcr r14d, 8
push r12
paddsw mm3, mm2
sub bx, cx
push r11
emms
pop r11
inc ebx
pslld mm3, 0x12
pop r12
packuswb mm3, mm6
orps xmm8, xmm15
pcmpeqw mm5, mm2
pop rbx
nop
emms
nop
and r14, rcx
pop rcx
movhlps xmm2, xmm10
emms
emms
punpcklbw mm1, mm3
emms
pop r14
push r11
subss xmm8, xmm15
push r9
neg r9w
pop r9
not r11
pop r11
push r12
mov r12, 3
push r9
pop r9
dec r12
jne 0x2e49b2e77
pop r12
push r12
sbb r12b, 0xf
push rdx
punpckhbw mm3, mm1
paddusb mm4, mm0
push r10
neg dl
emms
sub r10w, r12w
pop r10
emms
xchg r12, rdx
pop rdx
not r12b
pop r12
push r11
movlhps xmm11, xmm6
pop r11
push r12
mov r12, 3
push r14
pxor mm1, mm3
push rax
neg r14b
paddsw mm7, mm0
push r8
xchg r8d, r14d
not r14w
nop
push r10
neg r10w
emms
pcmpgtb mm6, mm7
nop
push rdx
psraw mm4, 0x2b
nop
emms
pslld mm3, 0xc
inc r10
pop rdx
test r14b, r10b
emms
ucomiss xmm6, xmm15
psrlw mm6, 0x28
pop r10
nop
sar r8w, 0xb
movups xmm2, xmm7
pop r8
sbb eax, r14d
test ax, r14w
pop rax
dec r14d
pop r14
dec r12
jne 0x2e49b2eb7
pop r12
ret
Function at 0x140001470
Capabilities:
Create thread
Persist via run registry key
Set registry value

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x140026040]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x104
call fcn.140016ae0
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000159a
xorps xmm0, xmm0
lea rdx, str.SOFTWAREMicrosoftwindowscurrentVersionRun
xorps xmm1, xmm1
lea rcx, [rsp + 0x38]
mov r8d, 0x2d
movups xmmword [rsp + 0x38], xmm0
movdqu xmmword [rsp + 0x48], xmm1
call fcn.140001670
cmp qword [rsp + 0x50], 0xf
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmova rdx, qword [rsp + 0x38]
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001550
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x30]
lea rdx, str.AutoRun
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14000159a
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001595
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001595
call fcn.14000e0cc
int3
call fcn.140007394
xor ebx, ebx
lea r8, [0x140002270]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400015c7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rbx
lea r8, [0x140003210]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400015f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x64
jmp 0x1400015f7
Function at 0x1400047a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x140026040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [0x140027e70]
mov r12, r9
mov qword [rsp + 0x30], 0
mov r15, r8
mov r14, rdx
mov rbp, rcx
test rax, rax
jne 0x1400048b2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140004884
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140004884
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14000487f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140004860
cmp edx, 0x6e2a0391
je 0x1400048e8
test r8d, r8d
jne 0x140004840
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x14000489a
cmp qword [rax + 0x30], 0
jne 0x140004810
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov qword [0x140027e70], rax
lea rcx, [rsp + 0x30]
mov r9, r12
mov qword [rsp + 0x20], rcx
mov r8, r15
mov rcx, rbp
mov rdx, r14
call rax
not eax
shr eax, 0x1f
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140007330
add rsp, 0x58
pop r15
pop r14
pop r12
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14000489c
Function at 0x140007d40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007d8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007d8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007d8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007d8a
cmp dword [rcx + 0x84], 0xe
jbe 0x140007d8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007d8c
xor al, al
add rsp, 0x28
ret

Function at 0x14000f27c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000f078
Function at 0x1400132f8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001337f
mov rsi, rbx
cmp word [rax], bp
je 0x14001333e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140013328
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140013324
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140010768
mov rdi, rax
test rax, rax
je 0x14001336c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140016ea0
mov rbp, rdi
xor ecx, ecx
call fcn.14000fc20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016800
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140016828
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140016828
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x23a4cd0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x23a4cdd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x23a4ced
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x23a4cd5
lea eax, [rcx + 1]
jmp 0x23a4cfb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x23a4d0e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x23a4cf4
sub eax, 3
jb 0x23a4d2e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x23a4d7d
sar eax, 1
movsxd rbp, eax
jb 0x23a4d64
jmp 0x23a4d3c
add ebx, ebx
jne 0x23a4d3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x23a4d64
inc ecx
add ebx, ebx
jne 0x23a4d4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x23a4d64
call r11
adc ecx, ecx
add ebx, ebx
jne 0x23a4d5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x23a4d4c
add ecx, 2
jmp 0x23a4d69
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.023a4c92
jmp 0x23a4cdd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1f8f000]
mov eax, dword [rdi]
or eax, eax
je 0x23a4dd9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1fa4000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x23a4d89
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x23a4dd3
mov qword [rbx], rax
add rbx, 8
jmp 0x23a4da9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x23a4e1d
cmp al, 0xef
ja 0x23a4e05
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x23a4de5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x23a4df4
mov eax, dword [rdi]
add rdi, 4
jmp 0x23a4df4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x23a4e71
sub rsp, 0xffffffffffffff80
jmp 0x4685c0
Function at 0x140878058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408781df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140878089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14087806f
add dl, dl
jne 0x140878096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408780f6
xor eax, eax
add dl, dl
jne 0x1408780a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408781ad
add dl, dl
jne 0x1408780b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408780c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408780d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408780dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408780ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14087807e
mov eax, 1
add dl, dl
jne 0x140878106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140878113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408780fb
sub eax, ebx
mov ebx, 1
jne 0x14087814c
mov ecx, 1
add dl, dl
jne 0x14087812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14087813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140878123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140878168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140878175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14087815d
cmp eax, 0x7d00
jae 0x14087819b
cmp eax, 0x500
jb 0x140878196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087807e
cmp eax, 0x7f
ja 0x14087819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408781d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14087807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20