joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movzx eax, r8b
mov r10, rdx
xor r11b, r11b
mov rbx, rcx
lea edi, [rax*4]
movzx r8d, r11b
inc r11b
lea eax, [rdi + r8]
shl eax, 2
mov edx, eax
mov al, byte [rax + r10]
xor byte [rbx], al
inc rbx
mov al, byte [rdx + r10 + 1]
xor byte [r8 + rcx + 4], al
mov al, byte [rdx + r10 + 2]
xor byte [r8 + rcx + 8], al
mov al, byte [rdx + r10 + 3]
xor byte [r8 + rcx + 0xc], al
cmp r11b, 4
jb 0x18000115e
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x180001424
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180035008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rcx
mov rbp, r8
mov ecx, 0x10
mov r15, rdx
call fcn.1800028a8
mov rbx, rax
xor r8b, r8b
movzx r10d, r8b
xor r9b, r9b
lea r11d, [r10*4]
movzx ecx, r9b
inc r9b
lea eax, [r10 + rcx*4]
add ecx, r11d
mov al, byte [rax + rdi]
mov byte [rcx + rbx], al
cmp r9b, 4
jb 0x18000146b
inc r8b
cmp r8b, 4
jb 0x18000145c
mov dil, byte [0x180036d58]
mov rdx, rbp
mov r8b, dil
mov rcx, rbx
call fcn.180001140
dec dil
lea rsi, [0x180021570]
cmp dil, 1
jb 0x180001582
mov dword [rsp + 0x20], 0xb0d090e
mov rcx, rbx
call fcn.1800011a8
xor r8b, r8b
xor r9b, r9b
movzx ecx, r9b
inc r9b
add rcx, rbx
movzx edx, r8b
movzx eax, byte [rcx + rdx*4]
mov al, byte [rax + rsi]
mov byte [rcx + rdx*4], al
cmp r9b, 4
jb 0x1800014cd
inc r8b
cmp r8b, 4
jb 0x1800014ca
mov r8b, dil
mov rdx, rbp
mov rcx, rbx
call fcn.180001140
xor sil, sil
xor dl, dl
movzx r14d, sil
lea r8, [rsp + 0x24]
movzx eax, dl
inc dl
lea ecx, [r14 + rax*4]
mov cl, byte [rcx + rbx]
mov byte [r8], cl
inc r8
cmp dl, 4
jb 0x180001510
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x20]
call fcn.180001040
xor r8b, r8b
lea r9, [rsp + 0x28]
movzx eax, r8b
inc r8b
lea ecx, [r14 + rax*4]
mov al, byte [r9]
inc r9
mov byte [rcx + rbx], al
cmp r8b, 4
jb 0x180001543
inc sil
cmp sil, 4
jb 0x180001505
add dil, 0xff
lea rsi, [0x180021570]
cmp dil, 1
jae 0x1800014bf
lea rsi, [0x180021570]
mov rcx, rbx
call fcn.1800011a8
xor r9b, r9b
xor r10b, r10b
movzx ecx, r10b
inc r10b
add rcx, rbx
movzx r8d, r9b
movzx eax, byte [rcx + r8*4]
mov al, byte [rax + rsi]
mov byte [rcx + r8*4], al
cmp r10b, 4
jb 0x180001590
inc r9b
cmp r9b, 4
jb 0x18000158d
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.180001140
xor r9b, r9b
movzx r10d, r9b
xor r8b, r8b
lea r11d, [r10*4]
movzx ecx, r8b
inc r8b
lea eax, [r11 + rcx]
mov al, byte [rax + rbx]
lea ecx, [r10 + rcx*4]
mov byte [rcx + r15], al
cmp r8b, 4
jb 0x1800015d9
inc r9b
cmp r9b, 4
jb 0x1800015ca
mov rcx, rbx
call fcn.1800028a0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180002880
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001d90
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
test edx, edx
je 0x180001dfb
cmp edx, 1
jne 0x180001e1c
mov ecx, 0x160
call fcn.1800028b0
mov rbx, rax
mov qword [rsp + 0x58], rax
xor edx, edx
mov r8d, 0x160
mov rcx, rax
call fcn.180004cf0
mov rcx, rbx
call fcn.180001e84
mov rbx, rax
mov qword [0x180036d60], rax
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180002354]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x140], rax
jmp 0x180001e1c
mov rbx, qword [0x180036d60]
test rbx, rbx
je 0x180001e1c
mov rcx, rbx
call fcn.180002830
mov edx, 0x160
mov rcx, rbx
call fcn.1800028a0
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180010d1c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180010d4c
xor eax, eax
jmp 0x180010e0f
mov rbp, rbx
cmp word [rax], si
je 0x180010d71
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180010d58
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180010d54
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180010c6c
movsxd r14, eax
test eax, eax
jne 0x180010daf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180010d45
mov rcx, r14
call fcn.18000c60c
mov rdi, rax
test rax, rax
jne 0x180010dc8
xor ecx, ecx
call fcn.18000cfa0
jmp 0x180010da4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180010c6c
test eax, eax
jne 0x180010df9
mov rcx, rdi
call fcn.18000cfa0
jmp 0x180010e03
xor ecx, ecx
call fcn.18000cfa0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180017b30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180017b58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180017b58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140e06058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140e061df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e06089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e0606f
add dl, dl
jne 0x140e06096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e060f6
xor eax, eax
add dl, dl
jne 0x140e060a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e061ad
add dl, dl
jne 0x140e060b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e060c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e060d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e060dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e060ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e0607e
mov eax, 1
add dl, dl
jne 0x140e06106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e06113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e060fb
sub eax, ebx
mov ebx, 1
jne 0x140e0614c
mov ecx, 1
add dl, dl
jne 0x140e0612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e0613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e06123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e0607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e06168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e06175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e0615d
cmp eax, 0x7d00
jae 0x140e0619b
cmp eax, 0x500
jb 0x140e06196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e0607e
cmp eax, 0x7f
ja 0x140e0619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e0607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e061d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e0607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001050
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
test rax, rax
jne 0x140001096
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r8, rax
test rax, rax
je 0x140001126
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor eax, eax
mov qword [rsp + 0x30], r9
sub rbx, qword [0x140005758]
lea r10, [0x140005780]
mov dword [rsp + 0x20], eax
mov ecx, r9d
mov byte [rsp + 0x24], al
nop
mov edx, ecx
mov eax, dword [r10 + rdx*8]
cmp rbx, rax
je 0x1400010d4
inc ecx
cmp ecx, 0x62
jbe 0x1400010c0
jmp 0x1400010d9
mov r9d, dword [r10 + rdx*8 + 4]
lea rax, [0x140005154]
mov dword [rsp + 0x30], r9d
lea rdx, str.SystemFunction032
mov qword [rsp + 0x28], rax
mov rcx, r8
mov dword [rsp + 0x20], 5
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001126
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call rax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001e20
add rsp, 0x50
pop rbx
ret
mov eax, 0xc0000001
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001e20
add rsp, 0x50
pop rbx
ret
Function at 0x14001e810
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.140048150
sub rsp, rax
mov rax, qword [0x140060040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov word [rsp + 0x30], bp
lea edi, [rbp + 0x28]
test al, al
je 0x14001e8c2
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003bcdc
cmp rax, 1
jne 0x14001e91e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001e89f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x14001e893
cmp rcx, 1
jb 0x14001e91e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14001e860
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14001e8f3
lea rcx, [rsp + 0x80]
call fcn.14003d21c
jmp 0x14001e8f5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14002c3e0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400309d0
int3

Function at 0x14001e930
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140060040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], bp
lea rbx, [rsp + 0x30]
mov al, 0x4e
lea edi, [rbp + 0x28]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003bcdc
cmp rax, 1
jne 0x14001ea05
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001e9ac
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x14001e9a0
cmp rcx, 1
jb 0x14001ea05
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14001e971
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14002c3e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400309d0
int3
Function at 0x1400273b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14006543a], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x140027431
mov edx, 3
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140065028], rax
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x140065028], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x140065028], rdx
call fcn.140025820
cmp eax, ebx
jne 0x14002759d
mov byte [0x14006543a], 1
lea rdx, [0x1400535e8]
mov rcx, rsi
call fcn.140048310
test eax, eax
je 0x1400274bc
cmp byte [0x14006543b], 1
je 0x1400274bc
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140065888], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140065d40], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1400655b0], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140065528], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140065da0], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140065640], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140065d48], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140065d60], rax
mov byte [0x14006543b], 1
mov r8, qword [0x140065028]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
nop dword [rax]
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x1400274e7
inc rax
test cl, cl
jne 0x1400274d0
mov ecx, r9d
jmp 0x1400274ec
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x1400274f3
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x140027558
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x140027535
inc rax
test cl, cl
jne 0x140027520
mov ecx, r9d
jmp 0x14002753a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x140027541
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x140027510
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x140027588
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140026430
add rdi, 8
sub rbx, 1
jne 0x140027570
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.14003880c
call fcn.1400309d0
int3

Function at 0x14002cdb4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002cdfe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002cdfe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002cdfe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002cdfe
cmp dword [rcx + 0x84], 0xe
jbe 0x14002cdfe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002ce00
xor al, al
add rsp, 0x28
ret
Function at 0x140030d30
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140030b9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140030b9b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140030b9b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140030b9b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140030b9b
cmp dword [rcx + 0x84], 0xe
jbe 0x140030b9b
cmp dword [rcx + 0xf8], 0
je 0x140030b9b
mov ecx, ebx
call fcn.140030c4c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140030a28
nop
cmp dword [rbp + 0x20], 0
je 0x140030be9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140030bf4
int3
xor r8d, r8d
xor edx, edx
jmp 0x140030b2c
Function at 0x140041c30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140041cb7
mov rsi, rbx
cmp word [rax], bp
je 0x140041c76
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140041c60
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140041c5c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14003f838
mov rdi, rax
test rax, rax
je 0x140041ca4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400487b0
mov rbp, rdi
xor ecx, ecx
call fcn.14003d888
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400443bc
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400443d2
mov al, 1
jmp 0x140044432
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400443e3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140044430
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400423d4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140044430
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140044430
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140044430
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140044432
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140048060
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140048088
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140048088
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18c2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.018c21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18c2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18c206f
add dl, dl
jne 0x18c2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18c20f6
xor eax, eax
add dl, dl
jne 0x18c20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18c21ad
add dl, dl
jne 0x18c20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18c20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18c20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18c20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18c20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18c207e
mov eax, 1
add dl, dl
jne 0x18c2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18c2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18c20fb
sub eax, ebx
mov ebx, 1
jne 0x18c214c
mov ecx, 1
add dl, dl
jne 0x18c212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18c213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18c2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18c207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18c2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18c2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18c215d
cmp eax, 0x7d00
jae 0x18c219b
cmp eax, 0x500
jb 0x18c2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18c207e
cmp eax, 0x7f
ja 0x18c219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18c207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18c21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18c207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14011b710
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x14011b755
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov al, byte [0x140569a20]
test al, al
je 0x14011b89a
cmp byte [0x140569a08], 0
je 0x14011b77d
cmp dword [0x140569a18], 0
jne 0x14011b7a8
mov sil, 1
jmp 0x14011b85f
lea rcx, [0x140569a08]
lea rdx, [0x140569a09]
lea r8, [0x1401238b0]
call fcn.1401b8a70
mov dword [0x140569a18], 1
mov byte [0x140569a08], 1
mov bl, byte [0x140569849]
mov byte [0x140569849], 0
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [0x140569849], bl
test ax, ax
js 0x14011b7d2
xor esi, esi
jmp 0x14011b85f
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x14011b810
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
nop dword [rax]
mov rdi, rsi
test byte [rsi + 0x5b], 0x40
jne 0x14011b822
mov rsi, qword [rdi + 0x30]
test rsi, rsi
jne 0x14011b810
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x14011b853
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
call fcn.14011ba70
cmp rdi, rax
sete sil
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x14011b890
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140569a20]
call fcn.14035f9c4
test eax, eax
je 0x14011b763
mov word [0x140569a08], 0
mov qword [0x140569a10], 0
lea rcx, [0x140569a20]
call fcn.14035fa9b
jmp 0x14011b763
Function at 0x14012f5e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov bpl, byte [0x140569849]
mov byte [0x140569849], 0
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
call rdi
mov esi, eax
and esi, 0x8000
shl esi, 9
mov byte [0x140569849], 0
mov ecx, 0x11
call rdi
lea ebx, [rsi + 0x400000]
test ax, ax
cmovns ebx, esi
mov byte [0x140569849], 0
mov ecx, 0x10
call rdi
lea esi, [rbx + 0x800000]
test ax, ax
cmovns esi, ebx
cmp byte [0x14056ad2c], 0
jne 0x14012f66e
mov byte [0x140569849], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14012f66e
cmp byte [0x140569bb4], 0
jne 0x14012f691
jmp 0x14012f67a
or esi, 8
cmp byte [0x140569bb4], 0
jne 0x14012f691
mov byte [0x140569849], 0
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14012f694
or esi, 4
mov byte [0x140569849], 0
mov ecx, 4
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [0x140569849], bpl
mov ecx, esi
or ecx, 2
test ax, ax
cmovns ecx, esi
mov eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x14012f730
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov al, 1
cmp byte [0x14056ad2c], 0
jne 0x14012f764
mov bl, byte [0x140569849]
mov byte [0x140569849], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
mov byte [0x140569849], bl
shr eax, 0xf
add rsp, 0x20
pop rbx
ret

Function at 0x14012f770
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov al, 1
cmp byte [0x140569bb4], 0
je 0x14012f786
add rsp, 0x20
pop rbx
ret
mov bl, byte [0x140569849]
mov byte [0x140569849], 0
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
mov byte [0x140569849], bl
shr eax, 0xf
add rsp, 0x20
pop rbx
ret

Function at 0x14012f7b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov bl, byte [0x140569849]
mov byte [0x140569849], 0
mov ecx, 4
call qword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
mov byte [0x140569849], bl
shr eax, 0xf
add rsp, 0x20
pop rbx
ret