joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a680
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg rbx, r12
xchg rsi, rdi
mov qword [rsp + 0x18], rdi
xchg rdi, rsi
xchg rdx, rdi
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x30
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
add rcx, 0xd8a3289
sub rcx, 0xd8a31c1
xchg rbx, r15
mov qword [rsp + 0x28], r15
xchg r15, rbx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.140029d00
test eax, eax
js 0x14002a721
cmp qword [rsp + 0x40], rbx
je 0x14002a721
lea eax, [rbx + 1]
jmp 0x14002a7ae
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002a742
mov eax, 2
jmp 0x14002a7ae
cmp dword [rcx + 0x74], ebx
jbe 0x14002a755
mov eax, 3
jmp 0x14002a7ae
cmp byte [rdi + 2], bl
je 0x14002a768
mov eax, 4
jmp 0x14002a7ae
cmp r14d, 0xa
jb 0x14002a791
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002a791
mov eax, 8
jmp 0x14002a7ae
lea rcx, [rsi + 0xb8]
mov edx, 0x99999999
call fcn.14002a150
jmp 0x14002a7ac
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xchg rdi, r11
mov r11, qword [rsp + 0x58]
xchg r11, rdi
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r14
ret
Function at 0x14005c990
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0xffffffff
test rcx, rcx
je 0x14005ca09
cmp byte [rcx], 0
je 0x14005ca09
test rdx, rdx
jne 0x14005c9be
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14005c9b0
test rdx, rdx
je 0x14005ca06
xor r10d, r10d
lea r11, [0x140002db0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
xor rcx, rax
shr r8d, 5
shr r8d, 2
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14005c9d0
not r8d
mov eax, r8d
ret

Function at 0x14005fed0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
mov rdx, rcx
test rax, rax
jne 0x14005fee3
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14005ff0d
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14005ff0a
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14005fef1
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret

Function at 0x14005ffa0
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rax
mov rbp, qword [rcx + 0x10]
xchg rbp, rax
xchg rdx, rcx
mov rcx, rdx
xchg rcx, rdx
test rax, rax
jne 0x14005ffb7
ret
cmp byte [rcx], 0
jne 0x14005ffe9
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14005ffe6
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14005ffca
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret
Function at 0x1400d4910
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rsi
mov qword [rsp], rbp
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
sub rsp, 0x30
xchg rsi, r14
mov rsi, r8
xchg rsi, r14
mov r12, rdx
test rdx, rdx
je 0x1400d4b1c
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400d4b1c
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400d4b1c
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1400d4b1c
xor r15d, r15d
mov r13d, r15d
mov ebp, r15d
cmp r15w, word [rdi + 6]
jae 0x1400d4b11
nop dword [rax]
mov eax, ebp
lea rbx, [rax + rax*4]
shl rbx, 2
shl rbx, 1
mov eax, dword [rdi + rbx + 0x12c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x1400d4b03
mov ecx, 0x60
call fcn.14014e768
mov rsi, rax
xchg r10, rax
mov qword [rsp + 0x20], r10
xchg r10, rax
test rax, rax
lea rax, [rdi + 0x114]
je 0x1400d4a32
lea r15, [rdi + 0x118]
add r15, rbx
mov r8d, dword [r15]
add rax, rbx
xchg r12, rax
mov qword [rsp + 0x88], r12
xchg r12, rax
mov edx, dword [rax]
add rdx, r12
xchg rsi, r14
mov rcx, r14
xchg rsi, r14
call fcn.1400d9630
lea rax, [0x140003e48]
mov qword [rsi], rax
jmp 0x1400d4a4e
mov rsi, r15
lea r15, [rdi + 0x118]
add r15, rbx
add rax, rbx
xchg rcx, rax
mov qword [rsp + 0x88], rcx
xchg rcx, rax
mov r12d, dword [r15]
mov ecx, r12d
call fcn.14014e7ac
mov rbx, rax
test rax, rax
je 0x1400d4a7d
mov r8d, r12d
xor edx, edx
xchg rcx, rdi
mov rdi, rax
xchg rdi, rcx
call fcn.14014f7e6
jmp 0x1400d4a7f
xor ebx, ebx
mov r8d, dword [r15]
xchg r13, rax
mov r13, qword [rsp + 0x88]
xchg r13, rax
mov edx, dword [rax]
xchg r12, r10
mov r10, qword [rsp + 0x78]
xchg r12, r10
add rdx, r12
mov rcx, rbx
call fcn.14014f810
mov rax, qword [rsi]
xchg r14, rbx
mov rdx, r14
xchg rbx, r14
mov rcx, rsi
call qword [rax + 0x10]
xchg rsi, r15
mov qword [rsp + 0x88], r15
xchg r15, rsi
xchg r9, rdx
mov r9, qword [r14 + 8]
xchg rdx, r9
cmp rdx, qword [r14 + 0x10]
je 0x1400d4ae7
mov qword [rdx], rsi
add qword [r14 + 8], 8
jmp 0x1400d4afd
lea r8, [rsp + 0x88]
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
call fcn.1400d3cd0
inc r13d
xor r15d, r15d
inc ebp
movzx eax, word [rdi + 6]
cmp ebp, eax
jb 0x1400d49aa
test r13d, r13d
setne al
jmp 0x1400d4b1e
xor al, al
xchg rbx, r9
mov r9, qword [rsp + 0x70]
xchg r9, rbx
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
mov r13, qword [rsp]
add rsp, 8
push rcx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x20], r12
pop rdx
pop rdx
pop rcx
pop rcx
add rsp, 8
push rax
push rbx
push rcx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
xchg qword [rsp], rbp
add rsp, 8
ret
Function at 0x1400d4e70
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xchg rbp, r9
mov qword [rsp + 0x20], rbp
xchg r9, rbp
mov qword [rsp + 0x18], r8
xchg rcx, r15
mov qword [rsp + 8], r15
xchg r15, rcx
nop
sub rsp, 8
mov qword [rsp], rbx
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
push 0x47aceae8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x58
xchg r9, rbx
mov r9, rbx
xchg rbx, r9
xchg rdx, rbp
mov rsi, rbp
xchg rbp, rdx
xchg r14, rcx
mov r9, r14
xchg r14, rcx
xor ebp, ebp
test rdx, rdx
jne 0x1400d4ef9
mov eax, ebp
jmp 0x1400d4f26
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400d4f15
xchg rbp, rbx
mov rax, rbx
xchg rbx, rbp
jmp 0x1400d4f26
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1400d5030
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1400d5030
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1400d5006
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1400d4ffa
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
xchg rdx, rcx
mov rdx, qword [rbx + 0x38]
xchg rdx, rcx
test rcx, rcx
je 0x1400d50bd
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1400d5006
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400d4f73
xchg rcx, rsi
mov rsi, qword [rbx + 0x38]
xchg rsi, rcx
test rcx, rcx
je 0x1400d5029
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 1
jmp 0x1400d505f
xchg rdx, rcx
mov rdx, qword [rbx + 0x38]
xchg rdx, rcx
test rcx, rcx
je 0x1400d505d
xchg rbx, rax
mov rbx, qword [rcx]
xchg rbx, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg rbp, rdx
mov qword [rbx + 0x38], rdx
xchg rbp, rdx
xor al, al
add rsp, 0x58
nop
mov r15, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], r14
add rsp, 8
push rdx
push rax
push rdx
push rdx
push rbx
push rcx
push rdx
xchg qword [rsp + 0x38], r13
add rsp, 0x40
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
add rsp, 8
xchg qword [rsp - 8], rbp
push rax
push rcx
push rcx
push rcx
push rdx
push rax
push rdx
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
ret
call fcn.14014f59c
nop
int3
Function at 0x1400d9720
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg rdi, rdx
mov r11, rdi
xchg rdi, rdx
xchg r11, r10
mov r11, rcx
xchg r10, r11
test rdx, rdx
je 0x1400d979e
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1400d9791
movzx eax, byte [r10]
test bl, bl
je 0x1400d9773
lea rcx, [r9 - 1]
xchg rdx, r9
mov r9, rdx
xchg r9, rdx
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1400d9762
jmp 0x1400d9791
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1400d9782
inc r10
sub r11, 1
jne 0x1400d9744
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x1400db850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, r9
mov qword [rsp + 0x10], r9
xchg rsi, r9
mov qword [rsp + 0x18], rdi
nop
push r13
mov qword [rsp], rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xchg r8, r13
mov rdi, r13
xchg r8, r13
xchg rcx, rbx
mov rcx, rdx
xchg rbx, rcx
mov rsi, rcx
test r8, r8
je 0x1400db9fb
nop
mov dword [rbp - 0x29], 0xf6f6f6f6
mov dword [rbp + 0x16], 0x3d3c3b3a
mov dword [rbp - 0x25], 0xf6f6f6f6
mov dword [rbp + 0x1a], 0x41403f3e
mov dword [rbp - 0x21], 0xf6f6f6f6
mov dword [rbp + 0x1e], 0x4c4b4342
mov dword [rbp - 0x1d], 0xf6f6f6f6
mov dword [rbp + 0x22], 0x504f4e4d
mov dword [rbp - 0x19], 0xf6f6f6f6
mov dword [rbp + 0x26], 0x54535251
mov dword [rbp - 0x15], 0xf6f6f6f6
mov dword [rbp + 0x2a], 0x58575655
mov dword [rbp - 0x11], 0xf6f6f6f6
mov dword [rbp + 0x2e], 0x5c5b5a59
mov dword [rbp - 0xd], 0xf6f6f6f6
mov dword [rbp + 0x32], 0x605f5e5d
mov dword [rbp - 9], 0xf6f6f6f6
mov dword [rbp + 0x36], 0x64636261
mov dword [rbp - 5], 0xf6f6f6f6
mov dword [rbp + 0x3a], 0x6e6d6c6b
mov dword [rbp - 1], 0xf6f6f6f6
mov dword [rbp + 0x3e], 0x7271706f
mov dword [rbp + 3], 0xf6f6f6f6
mov dword [rbp + 0x42], 0x76757473
mov dword [rbp + 7], 0xf6f6f6f6
mov dword [rbp + 0x46], 0x7a797877
mov dword [rbp + 0xb], 0xf6f6f6f6
mov dword [rbp + 0x4a], 0x7e7d7c7b
mov dword [rbp + 0xf], 0xf6f6f6f6
mov dword [rbp + 0x4e], 0x8281807f
mov word [rbp + 0x13], 0xf6f6
mov word [rbp + 0x52], 0x8483
xor eax, eax
mov byte [rbp + 0x54], al
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x16]
movzx edx, byte [rbp + rax - 0x29]
add dl, cl
mov byte [rbp + rax + 0x16], dl
mov byte [rbp + rax - 0x29], 0
inc rax
cmp rax, 0x3e
jb 0x1400db988
mov edx, 0x3e
xor ecx, ecx
call fcn.1400dc0b0
movsxd rcx, eax
movzx edx, byte [rbp + rcx + 0x16]
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + rax + 0x16], 0
inc rax
cmp rax, 0x3e
jb 0x1400db9cc
mov byte [rbx], dl
inc rbx
sub rdi, 1
jne 0x1400db898
xchg rdi, rbx
mov qword [rsi], rdi
xchg rdi, rbx
jmp 0x1400db9fe
mov qword [rcx], rdx
xchg r14, rsi
mov rax, r14
xchg r14, rsi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
xchg rdi, rbp
mov rbp, qword [r11 + 0x20]
xchg rbp, rdi
mov rsp, r11
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400dc340
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400dc3a9
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400dc364
mov ecx, dword [r9]
jmp 0x1400dc49e
cmp ecx, 0x4e0
jb 0x1400dc49e
lea r10, [r9 + 0x9c4]
xchg r8, rbx
mov qword [rsp], r8
xchg rbx, r8
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400dc3ce
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400dc422
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 5
shr ecx, 5
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 6
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xc
shl eax, 2
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14014f16c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rbp
call 0x140874df6
test rax, rax
je 0x14014f1b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14014f1b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14014f1b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14014f1b6
cmp dword [rcx + 0x84], 0xe
jbe 0x14014f1b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14014f1b8
xor al, al
add rsp, 0x28
ret

Function at 0x14017d570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14017d59d
xor al, al
jmp 0x14017d6ff
mov rax, qword [0x14019c6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14019c6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14019c6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14019c6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14019c6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14019c6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14019c6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14019c6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14019c700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14017d6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14017d649
mov r11d, 2
jmp 0x14017d66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14017d663
mov r11d, 1
jmp 0x14017d66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14017d715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14017d6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14017d6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14017d6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14017d6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14017d630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14017d6fa
Function at 0x14071a318
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14071a49f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14071a349
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071a32f
add dl, dl
jne 0x14071a356
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071a3b6
xor eax, eax
add dl, dl
jne 0x14071a365
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14071a46d
add dl, dl
jne 0x14071a376
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071a383
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071a390
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071a39d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14071a3aa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14071a33e
mov eax, 1
add dl, dl
jne 0x14071a3c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14071a3d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071a3bb
sub eax, ebx
mov ebx, 1
jne 0x14071a40c
mov ecx, 1
add dl, dl
jne 0x14071a3ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071a3fb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071a3e3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071a33e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14071a428
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14071a435
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14071a41d
cmp eax, 0x7d00
jae 0x14071a45b
cmp eax, 0x500
jb 0x14071a456
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071a33e
cmp eax, 0x7f
ja 0x14071a45e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14071a33e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14071a492
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14071a33e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001410
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call fcn.18000cfc0
mov r9, rax
cmp qword [rax + 0x60], 0
je 0x180001540
xor esi, esi
lea rbp, str.win32u.dll
mov rdi, qword [r9 + 0x30]
xor r10b, r10b
mov r11, qword [r9 + 0x60]
mov r9, qword [r9]
test rdi, rdi
je 0x180001536
movzx ebx, word [r9 + 0x58]
mov ecx, esi
test ebx, ebx
je 0x180001536
mov rax, rbp
sub r11, rbp
nop dword [rax]
movzx edx, word [r11 + rax]
test dx, dx
je 0x18000152d
movzx r8d, word [rax]
test r8w, r8w
je 0x18000152d
cmp dx, r8w
jne 0x180001536
inc ecx
add rax, 2
mov r10b, 1
cmp ecx, ebx
jl 0x180001470
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x180001540
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x180001540
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x180001540
mov r11d, dword [rdi + rcx + 0x1c]
lea rax, [rdi + rcx]
mov r9d, dword [rax + 0x20]
add r11, rdi
mov ebx, dword [rax + 0x24]
add r9, rdi
mov r10d, dword [rax + 0x18]
add rbx, rdi
test r10d, r10d
je 0x180001540
nop
mov eax, dword [r9]
xor dl, dl
add rax, rdi
cmp byte [rax], dl
je 0x18000155b
lea r8, str.NtUserGetAsyncKeyState
sub r8, rax
movzx ecx, byte [rax + r8]
test cl, cl
je 0x180001557
cmp byte [rax], cl
jne 0x18000155b
inc rax
mov dl, 1
cmp byte [rax], 0
jne 0x180001506
movsxd rax, esi
movzx ecx, word [rbx + rax*2]
mov eax, dword [r11 + rcx*4]
add rax, rdi
jmp 0x180001542
test r10b, r10b
jne 0x1800014a3
cmp qword [r9 + 0x60], rsi
jne 0x180001440
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test dl, dl
jne 0x18000151d
inc esi
add r9, 4
cmp esi, r10d
jb 0x1800014f0
jmp 0x180001540
Function at 0x180001990
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180036010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r14d, r14d
mov eax, 0x5a4d
mov rdi, rcx
mov esi, r14d
cmp word [rcx], ax
je 0x1800019c9
mov ebx, r14d
jmp 0x1800019da
movsxd rbx, dword [rcx + 0x3c]
add rbx, rdi
cmp dword [rbx], 0x4550
cmovne rbx, r14
mov ebp, dword [rbx + 0x50]
lea rcx, [rsp + 0x28]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
call fcn.180001870
mov r10, qword [rsp + 0x30]
mov r9d, r14d
mov r11, qword [rsp + 0x28]
sub r10, r11
sar r10, 2
sub rbp, r10
je 0x180001a4f
mov rbx, r14
mov eax, r14d
test r10, r10
je 0x180001a40
mov rcx, r14
nop dword [rax]
mov r8d, dword [r11 + rcx*4]
lea ecx, [rax + r9]
movzx ecx, byte [rcx + rdi]
cmp ecx, r8d
je 0x180001a37
cmp r8d, 0xffffffff
jne 0x180001a44
inc eax
mov ecx, eax
cmp rcx, r10
jb 0x180001a20
lea rsi, [rbx + rdi]
inc r9d
mov ebx, r9d
cmp rbx, rbp
jb 0x180001a12
inc dword [0x1800369fc]
test r11, r11
je 0x180001a8f
mov rdx, qword [rsp + 0x38]
mov rax, r11
sub rdx, r11
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x180001a87
mov r11, qword [r11 - 8]
add rdx, 0x27
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001ab5
mov rcx, r11
call fcn.18000d900
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000d1b0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call fcn.180016168
int3
Function at 0x180002b90
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x180036010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rcx]
mov rsi, rdx
mov rdx, qword [0x18003a6e0]
mov rbp, r8
mov rdi, rcx
mov r14, qword [rax + 0x208]
test rdx, rdx
jne 0x180002c99
mov rax, qword gs:[0x60]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x4c], 0x7865742e
mov byte [rsp + 0x50], 0x74
mov rbx, qword [rax + 0x10]
movsxd rcx, dword [rbx + 0x3c]
movzx eax, word [rcx + rbx + 0x14]
lea r8, [rcx + rbx]
add rax, 0x18
add r8, rax
movzx eax, word [rcx + rbx + 6]
lea rcx, [rax + rax*4]
lea r11, [r8 + rcx*8]
cmp r8, r11
je 0x180002c53
lea r9, [rsp + 0x4c]
sub r9, r8
nop dword [rax]
lea r10, [r8 + 5]
mov rax, r8
cmp r8, r10
je 0x180002c53
nop dword [rax]
movsx edx, byte [r9 + rax]
movzx ecx, byte [rax]
cmp ecx, edx
jne 0x180002c46
inc rax
cmp rax, r10
jne 0x180002c30
jmp 0x180002c53
add r8, 0x28
sub r9, 0x28
cmp r8, r11
jne 0x180002c20
mov eax, dword [r8 + 8]
mov ecx, dword [r8 + 0xc]
add rcx, rbx
mov word [rsp + 0x48], 0x26ff
mov rbx, qword [rsp + 0x60]
lea rdx, [rax + rcx]
cmp rax, 2
jb 0x180002c92
movzx eax, word [rsp + 0x48]
lea r8, [rdx - 2]
nop dword [rax]
cmp ax, word [rcx]
je 0x180002c8f
cmp rcx, r8
je 0x180002c92
inc rcx
jmp 0x180002c80
mov rdx, rcx
mov qword [0x18003a6e0], rdx
xor eax, eax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov r8, rbp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.18000cf80
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000d1b0
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000cfc0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
ret

Function at 0x18000cfe0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov rax, rdx
syscall
ret