joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023090
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov rcx, qword [0x14012b3b8]
test rcx, rcx
jne 0x1400230e1
mov rcx, qword [0x140129f18]
mov qword [rsp + 0x20], 0
lea r9, [0x1400230f0]
mov edx, 0x6e
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov qword [0x14012b3b8], rax
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14012b3b8]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_SetActiveWindow]

Function at 0x14002c540
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov rbx, rdx
mov edi, ecx
cmp qword [0x14012c520], 0
jne 0x14002c58d
lea rcx, [0x14002c7a0]
call fcn.1400443e0
mov qword [0x14012c520], rax
lea rcx, [0x14002c800]
call fcn.1400443e0
mov qword [0x14012c528], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012c518], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012c518], eax
test edi, edi
mov esi, 1
cmovne esi, edi
add esi, eax
mov ecx, 1
mov edx, 0x18
xor r8d, r8d
call fcn.140042eb0
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], r14
mov dword [rax + 0x10], esi
mov eax, dword [0x14012c518]
mov dword [rdi + 0x14], eax
mov rcx, qword [0x14012c520]
mov rdx, rdi
call fcn.1400444c0
cmp rdi, rax
je 0x14002c5eb
mov rcx, rdi
call fcn.140042f50
jmp 0x14002c5fb
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14012c528]
call fcn.1400444c0
mov rcx, qword [0x14012c520]
xor edx, edx
call fcn.140044c30
cmp rax, rdi
jne 0x14002c616
mov ecx, dword [rdi + 0x10]
call fcn.140007000
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002c640
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
cmp qword [0x14012c520], 0
jne 0x14002c686
lea rcx, [0x14002c7a0]
call fcn.1400443e0
mov qword [0x14012c520], rax
lea rcx, [0x14002c800]
call fcn.1400443e0
mov qword [0x14012c528], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012c518], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012c518], eax
mov rcx, qword [0x14012c520]
xor ebx, ebx
xor edx, edx
call fcn.140044c30
test rax, rax
je 0x14002c72c
mov rdi, rax
jmp 0x14002c6de
mov rcx, qword [0x14012c520]
xor edx, edx
call fcn.140045290
mov rcx, rdi
call fcn.140042f50
mov rcx, qword [0x14012c520]
xor ebx, ebx
xor edx, edx
call fcn.140044c30
mov rdi, rax
test rax, rax
je 0x14002c72c
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14012c528]
xor r8d, r8d
call fcn.1400451a0
test rax, rax
je 0x14002c6b0
mov ecx, dword [0x14012c518]
mov ebx, dword [rdi + 0x10]
mov edx, dword [rdi + 0x14]
add edx, 0xfffffff6
sub ecx, edx
mov eax, ebx
sub eax, edx
cmp ecx, eax
jbe 0x14002c728
mov rcx, qword [0x14012c520]
xor edx, edx
call fcn.140045290
mov edx, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call qword [rdi]
jmp 0x14002c6be
mov dword [rsi], ebx
mov bl, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400369a0
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x3a
call fcn.140040eb0
cmp byte [rax], 0
je 0x1400369c4
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.140049d50
mov rcx, rsi
mov edx, 0x3b
call fcn.140040c60
test al, al
je 0x1400369df
add rsp, 0x20
pop rsi
jmp fcn.140078e30
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140038a10
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ebp, dword [rsp + 0x70]
mov rcx, r8
mov edx, r9d
call fcn.140040d20
cmp eax, 1
je 0x140038a7c
cmp eax, 2
je 0x140038a85
cmp eax, 3
jne 0x140038a8e
mov rcx, rbx
mov edx, ebp
call fcn.140040eb0
lea rcx, str.custom:
mov rdx, rax
xor r8d, r8d
call fcn.140041fd0
mov rbx, rax
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14003c650
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140042f50
lea r8, str.implicit
jmp 0x140038a95
lea r8, str.explicit
jmp 0x140038a95
lea r8, str.none
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14003c650

Function at 0x14003c650
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003c65d
mov rcx, qword [rcx]
jmp fcn.1400461f0
ret

Function at 0x14003c660
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003c66d
mov rcx, qword [rcx]
jmp fcn.1400460a0
ret

Function at 0x14003c720
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14003c72d
mov rcx, qword [rcx]
jmp fcn.140046100
xor eax, eax
ret

Function at 0x14003ca00
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003ca10
mov r8, qword [r8]
mov rcx, qword [rcx]
jmp fcn.1400461f0
ret

Function at 0x14003ca50
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140129050]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp dword [0x14012ce30], 6
jb 0x14002aa92
jne 0x14002aa47
cmp dword [0x14012ce34], 0
je 0x14002aa92
call fcn.14003d9f0
test eax, eax
je 0x14002aaa5
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400ee1d0]
lea r9, [0x1400ee1c0]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14002aa92
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b8cc0
nop
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b8cc0
nop
add rsp, 0x38
jmp 0x14002a5d0
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea r8, str.SoftwareSimonTathamPuTTYSessions
xor ecx, ecx
mov rdx, 0xffffffff80000001
xor r9d, r9d
call fcn.140045e20
test rax, rax
je 0x14003cab7
mov rdi, rax
call fcn.140043580
mov rbx, rax
mov rcx, rsi
mov rdx, rax
call fcn.140079030
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rbx
call fcn.140043680
mov rcx, rdi
call sub.ADVAPI32.dll_RegCloseKey
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x14002aa20
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14004a610
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
sub rsp, 0x28
cmp byte [0x14012cec8], 0
jne 0x14004a73e
lea rcx, str.winspool.drv
call fcn.140045c80
mov rsi, rax
lea rcx, str.spoolss.dll
call fcn.140045c80
test rsi, rsi
je 0x14004a6e1
lea rdx, str.EnumPrintersA
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
call rdi
mov qword [0x14012cec0], rax
lea rdx, str.OpenPrinterA
mov rcx, rsi
call rdi
mov qword [0x14012ce88], rax
lea rdx, str.ClosePrinter
mov rcx, rsi
call rdi
mov qword [0x14012ceb0], rax
lea rdx, str.StartDocPrinterA
mov rcx, rsi
call rdi
mov qword [0x14012ce90], rax
lea rdx, str.EndDocPrinter
mov rcx, rsi
call rdi
mov qword [0x14012cea8], rax
lea rdx, str.StartPagePrinter
mov rcx, rsi
call rdi
mov qword [0x14012ce98], rax
lea rdx, str.EndPagePrinter
mov rcx, rsi
call rdi
mov qword [0x14012cea0], rax
lea rdx, str.WritePrinter
mov rcx, rsi
call rdi
jmp 0x14004a730
mov qword [0x14012cec0], 0
mov qword [0x14012ce88], 0
mov qword [0x14012ceb0], 0
mov qword [0x14012ce90], 0
mov qword [0x14012cea8], 0
mov qword [0x14012ce98], 0
mov qword [0x14012cea0], 0
xor eax, eax
mov qword [0x14012ceb8], rax
mov byte [0x14012cec8], 1
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400561e0
Capabilities:
Get common file path
Set current directory

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov ebx, r9d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140129050]
xor rax, rsp
mov qword [rsp + 0x130], rax
test r8b, r8b
je 0x140056229
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xffffffff
cmp eax, 0x103
setb bpl
jmp 0x14005622b
xor ebp, ebp
mov dword [rdi], 0x88
xor eax, eax
test rsi, rsi
je 0x14005623f
cmp byte [rsi], 0
cmovne rax, rsi
mov qword [rdi + 0x50], rax
mov rcx, rdi
test bl, bl
je 0x140056252
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x140056258
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov edi, eax
test rsi, rsi
je 0x14005627c
mov ecx, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
add eax, 0xfffffefc
cmp eax, 0xfffffefc
ja 0x14005627c
mov byte [rsi], 0
test bpl, bpl
je 0x14005628c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test edi, edi
setne bl
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400b8cc0
mov eax, ebx
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140087490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r10, qword [rcx]
mov r9, qword [rdx]
jmp 0x1400874b1
cmp bl, byte [r9]
jne 0x1400875fd
add r10, 1
add r9, 1
mov bl, byte [r10]
test bl, bl
je 0x140087607
cmp bl, 0x2a
je 0x140087607
cmp r9, r8
jae 0x140087601
cmp bl, 0x3f
je 0x1400874a9
cmp bl, 0x5b
je 0x140087500
cmp bl, 0x5c
jne 0x1400874a0
mov al, byte [r10 + 1]
test al, al
je 0x14008761b
cmp al, byte [r9]
jne 0x1400875fd
add r10, 2
add r9, 1
jmp 0x1400874b1
lea rax, [r10 + 1]
mov r11b, byte [r10 + 1]
add r10, 2
cmp r11b, 0x5e
cmovne r10, rax
xor esi, esi
jmp 0x140087531
add r10, 1
cmp byte [r9], bl
sete al
and sil, 1
or sil, al
movzx ebx, byte [r10]
cmp bl, 0x5c
je 0x140087550
cmp bl, 0x5d
jne 0x140087559
jmp 0x1400875e7
movzx ebx, byte [r10 + 1]
add r10, 1
mov eax, 0xfffffffe
test bl, bl
je 0x140087620
cmp byte [r10 + 1], 0x2d
jne 0x140087520
movzx edi, byte [r10 + 2]
cmp dil, 0x5c
je 0x1400875a0
mov r14d, 2
cmp dil, 0x5d
je 0x140087614
test dil, dil
jne 0x1400875b0
jmp 0x140087620
movzx edi, byte [r10 + 3]
mov r14d, 3
test dil, dil
je 0x140087620
add r10, r14
add r10, 1
movzx eax, byte [r9]
cmp bl, dil
movzx ebx, bl
movzx edi, dil
mov ebp, edi
cmovb ebp, ebx
cmova edi, ebx
cmp dil, al
movzx edi, sil
mov esi, 1
cmovb esi, edi
cmp bpl, al
cmova esi, edi
jmp 0x140087531
cmp r11b, 0x5e
sete al
test sil, 1
sete bl
xor bl, al
je 0x1400874a9
xor eax, eax
jmp 0x140087620
xor eax, eax
test bl, bl
jne 0x140087620
mov qword [rcx], r10
mov qword [rdx], r9
mov eax, 1
jmp 0x140087620
mov eax, 0xfffffffd
jmp 0x140087620
mov eax, 0xffffffff
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14008f810
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov r9, qword [rdx + 8]
test r9, r9
je 0x14008f883
mov r8, qword [rdx]
xor r10d, r10d
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ecx, byte [r8 + r10]
xor ecx, eax
mov eax, ecx
and eax, 0xf
shr ecx, 4
imul edx, eax, 0x11111044
xor edx, ecx
imul r11d, eax, 0x8840020
imul ecx, eax, 0x4220000
xor ecx, r11d
xor ecx, edx
and edx, 0xf
shr ecx, 4
imul eax, edx, 0x11111044
imul r11d, edx, 0x8840020
xor r11d, eax
imul eax, edx, 0x4220000
xor eax, ecx
xor eax, r11d
add r10, 1
cmp r9, r10
jne 0x14008f830
ret

Function at 0x14008f890
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rcx + 8]
test r9, r9
je 0x14008f904
mov r8, qword [rcx]
xor r10d, r10d
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx edx, byte [r8 + r10]
xor edx, eax
mov eax, edx
and eax, 0xf
shr edx, 4
imul ecx, eax, 0x11111044
xor ecx, edx
imul r11d, eax, 0x8840020
imul edx, eax, 0x4220000
xor edx, r11d
xor edx, ecx
and ecx, 0xf
shr edx, 4
imul eax, ecx, 0x11111044
imul r11d, ecx, 0x8840020
xor r11d, eax
imul eax, ecx, 0x4220000
xor eax, edx
xor eax, r11d
add r10, 1
cmp r9, r10
jne 0x14008f8b0
ret
xor eax, eax
ret
Function at 0x1400a2d70
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movaps xmm0, xmmword [str.expand_32_byte_k]
movups xmmword [rcx], xmm0
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
mov dword [rcx + 0x80], 0x40
ret

Function at 0x1400a8040
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc28
mov rsi, rcx
mov rax, qword [0x140129050]
xor rax, rsp
mov qword [rsp + 0xc20], rax
xor eax, eax
mov rcx, qword [r8 + rax*8]
xor rcx, qword [rdx + rax*8]
mov qword [rsp + rax*8 + 0x820], rcx
add rax, 1
cmp rax, 0x80
jne 0x1400a8060
lea rdi, [rsp + 0x420]
lea r8, [rsp + 0x820]
mov rcx, rdi
mov edx, 2
mov r9d, 2
call fcn.1400a82e0
lea r8, [rsp + 0x8a0]
lea rcx, [rsp + 0x4a0]
mov edx, 2
mov r9d, 2
call fcn.1400a82e0
lea r8, [rsp + 0x920]
lea rcx, [rsp + 0x520]
mov edx, 2
mov r9d, 2
call fcn.1400a82e0
lea r8, [rsp + 0x9a0]
lea rcx, [rsp + 0x5a0]
mov edx, 2
mov r9d, 2
call fcn.1400a82e0
lea r8, [rsp + 0xa20]
lea rcx, [rsp + 0x620]
mov edx, 2
mov r9d, 2
call fcn.1400a82e0
lea r8, [rsp + 0xaa0]
lea rcx, [rsp + 0x6a0]
mov edx, 2
mov r9d, 2
call fcn.1400a82e0
lea r8, [rsp + 0xb20]
lea rcx, [rsp + 0x720]
mov edx, 2
mov r9d, 2
call fcn.1400a82e0
lea r8, [rsp + 0xba0]
lea rcx, [rsp + 0x7a0]
mov edx, 2
mov r9d, 2
call fcn.1400a82e0
lea rcx, [rsp + 0x20]
mov edx, 0x10
mov r8, rdi
mov r9d, 0x10
call fcn.1400a82e0
lea r8, [rsp + 0x430]
lea rcx, [rsp + 0x30]
mov edx, 0x10
mov r9d, 0x10
call fcn.1400a82e0
lea r8, [rsp + 0x440]
lea rcx, [rsp + 0x40]
mov edx, 0x10
mov r9d, 0x10
call fcn.1400a82e0
lea r8, [rsp + 0x450]
lea rcx, [rsp + 0x50]
mov edx, 0x10
mov r9d, 0x10
call fcn.1400a82e0
lea r8, [rsp + 0x460]
lea rcx, [rsp + 0x60]
mov edx, 0x10
mov r9d, 0x10
call fcn.1400a82e0
lea r8, [rsp + 0x470]
lea rcx, [rsp + 0x70]
mov edx, 0x10
mov r9d, 0x10
call fcn.1400a82e0
lea r8, [rsp + 0x480]
lea rcx, [rsp + 0x80]
mov edx, 0x10
mov r9d, 0x10
call fcn.1400a82e0
lea r8, [rsp + 0x490]
lea rcx, [rsp + 0x90]
mov edx, 0x10
mov r9d, 0x10
call fcn.1400a82e0
xor eax, eax
nop word [rax + rax]
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, qword [rsp + rax*8 + 0x820]
xor qword [rsi + rax*8], rcx
add rax, 1
cmp rax, 0x80
jne 0x1400a8270
lea rcx, [rsp + 0x820]
mov edx, 0x400
call fcn.1400778a0
lea rcx, [rsp + 0x420]
mov edx, 0x400
call fcn.1400778a0
lea rcx, [rsp + 0x20]
mov edx, 0x400
call fcn.1400778a0
mov rcx, qword [rsp + 0xc20]
xor rcx, rsp
call fcn.1400b8cc0
nop
add rsp, 0xc28
pop rdi
pop rsi
ret
Function at 0x1400ce950
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x1400ce96d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400ce9c8
test al, 7
jne 0x1400ce960
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400ce981
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400ce9f2
test dh, dh
je 0x1400ce9ec
shr rdx, 0x10
test dl, dl
je 0x1400ce9e6
test dh, dh
je 0x1400ce9e0
shr rdx, 0x10
test dl, dl
je 0x1400ce9da
test dh, dh
je 0x1400ce9d4
shr edx, 0x10
test dl, dl
je 0x1400ce9ce
test dh, dh
jne 0x1400ce981
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400d8fec
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400d901c
xor eax, eax
jmp 0x1400d90df
mov rbp, rbx
cmp word [rax], si
je 0x1400d9041
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400d9028
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400d9024
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400d8f3c
movsxd r14, eax
test eax, eax
jne 0x1400d907f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400d9015
mov rcx, r14
call fcn.1400d3340
mov rdi, rax
test rax, rax
jne 0x1400d9098
xor ecx, ecx
call fcn.1400d27b4
jmp 0x1400d9074
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400d8f3c
test eax, eax
jne 0x1400d90c9
mov rcx, rdi
call fcn.1400d27b4
jmp 0x1400d90d3
xor ecx, ecx
call fcn.1400d27b4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x462dc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00c5dca0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00c5d6ce], 0
je 0x462df6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00c5dfa0]
aesenc xmm0, xmmword [0x00c5dfb0]
aesenc xmm0, xmmword [0x00c5dfc0]
movq rax, xmm0
ret
jmp 0x409d80

Function at 0x140e89318
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140e8949f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e89349
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e8932f
add dl, dl
jne 0x140e89356
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e893b6
xor eax, eax
add dl, dl
jne 0x140e89365
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e8946d
add dl, dl
jne 0x140e89376
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e89383
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e89390
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e8939d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e893aa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e8933e
mov eax, 1
add dl, dl
jne 0x140e893c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e893d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e893bb
sub eax, ebx
mov ebx, 1
jne 0x140e8940c
mov ecx, 1
add dl, dl
jne 0x140e893ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e893fb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e893e3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e8933e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e89428
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e89435
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e8941d
cmp eax, 0x7d00
jae 0x140e8945b
cmp eax, 0x500
jb 0x140e89456
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e8933e
cmp eax, 0x7f
ja 0x140e8945e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e8933e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e89492
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e8933e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add dword [rdi], 0xffffffa3
sbb byte [rdi + rcx*2 + 0x31], al
xchg ah, cl
call 0xc58ae011
invalid
jp case.0x140007272.2
xor bl, cl
xor dh, byte [rdi + 0x4e36b126]
sub eax, dword es:[rbx - 0x29]
fnstenv [rdx]
mov bh, 0x26
mov cl, 0x36
sub eax, dword es:[rbx - 0x29]
cmp r12d, r11d
stosd dword [rdi], eax
ret
jae 0x14003f697
invalid
call 0x18259d5ec
clc
xlatb
nop
xor al, 0xda
mov ebp, 0x731531d6
invalid
leave
cdq
jae 0x14003f654
stc
xchg esi, eax
invalid
rcr dword [rbx - 0x490510], cl
and bl, bh
adc ch, byte [rbx - 0x2b05c064]
in al, 0x38
and al, 0xcb
retf
sti
jnp 0x14003f67f
retf
xchg dword [rdi], ebx
invalid
stc
adc esp, dword [rcx + 0x4a7cf62d]
cmp bh, byte [rdi + rax*4 + 0x23ebc749]
mov esp, 0xebc74987
and edi, dword [rdi + 0x4ec54b61]
mov esp, 0xebc74987
and edi, dword [rdi + 0x4ec54b61]
xchg dword [rcx - 0x39], ecx
jmp 0x14003f71b
mov edi, 0x37718540
jno 0x14003f739
push rcx
movsb byte [rdi], byte es:[rsi]
lea esi, [rbx + 0x17df0f96]
pandn mm2, qword [rdi]
pandn mm2, qword [rdi]
xor eax, dword [rax + 0x43]
invalid
jle 0x14003f6f3
loopne 0x14003f75b
jp 0x14003f77e
jrcxz 0x14003f739
sbb eax, 0x36bb57b7
outsb dx, byte ss:[rsi]
in ax, 0xbb
mov bh, 0x57
mov ebx, 0x66646e36
outsb dx, byte ss:[rsi]
in ax, 0xbb
movabs eax, dword [0xb4643c6dd9b958c4]
xchg ebp, eax
invalid
cmp dword [rax + 0x259dbda9], edi
xor edx, edx
invalid
cli
insb byte [rdi], dx
jge 0x14003f78b
idiv byte [rsi + rsi]
cmp al, 0x36
and al, 0x33
xor bl, byte [rax - 0x7b]
invalid
movsb byte [rdi], byte [rsi]
pop rbx
retf 0xbcb3
pop rax
out dx, eax
nop
xchg edx, eax
xchg ecx, eax
mov dl, 0xd1
invalid
Function at 0x140002e84
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002ece
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002ece
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002ece
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002ece
cmp dword [rcx + 0x84], 0xe
jbe 0x140002ece
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002ed0
xor al, al
add rsp, 0x28
ret
Function at 0x140001663
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401902c0
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14019001f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14019001f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14019001f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14019001f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14019001f
cmp dword [rcx + 0x84], 0xe
jbe 0x14019001f
cmp dword [rcx + 0xf8], 0
je 0x14019001f
mov ecx, ebx
call fcn.140190188
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14018fcf4
nop
cmp dword [rbp + 0x20], 0
je 0x14019006d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401900a8
int3
xor r8d, r8d
xor edx, edx
jmp 0x14018ffb0