joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002f600
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x18003faf0], ebp
je 0x18002f657
cmp rbx, 0x20
jae 0x18002f640
xor ecx, ecx
jmp 0x18002f642
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18003faf0], ebp
jne 0x18002f636
cmp qword [0x18003faf8], r15
je 0x18002f751
test rdi, rdi
jne 0x18002f677
mov ecx, esi
call fcn.18002f0e0
mov ebp, eax
jmp 0x18002f756
mov ecx, dword [0x18003ff3c]
mov ebx, r15d
test ecx, ecx
je 0x18002f69f
mov r8, qword [0x18003ff30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x18002f6a9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18002f690
mov ebp, 4
jmp 0x18002f756
cmp ebx, 0xffffffff
je 0x18002f69f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x18002f748
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18002ee00
mov edx, esi
mov ecx, ebx
call fcn.18002efb0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x18002f756
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18002f732
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18002f728
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x18002f700
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18003faf8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18002f756
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x18002f756
mov ebp, 2
xchg dword [0x18003faf0], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x140011294
Capabilities:
Terminate process

Disassembly:
jmp 0x140013af0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011343
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014e40
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014e60
xor al, al
jmp 0x140014ee1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014e73
xor al, al
jmp 0x140014ee1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014e9d
xor al, al
jmp 0x140014ee1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014eb1
xor al, al
jmp 0x140014ee1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014ec3
xor al, al
jmp 0x140014ee1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014edf
xor al, al
jmp 0x140014ee1
mov al, 1
add rsp, 0x38
ret
Function at 0x180003ad0
Capabilities:
Parse pe header

Disassembly:
jmp 0x180004248
add byte [rax - 0x7d], cl
rol byte [rsi], 0x65
mov rbx, qword [rax]

Function at 0x1800041cc
Capabilities:
Parse pe header

Disassembly:
push rax
xor rax, rax
inc rax
test rax, rax
je entry0
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne entry0
inc rcx
test rcx, rcx
je entry0
pop rcx
push rbx
push rbp
push rdi
push rsi
push r12
push r13
push rax
xor rax, rax
inc rax
test rax, rax
je entry0
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne entry0
inc rcx
test rcx, rcx
je entry0
pop rcx
push r14
push r15
sub rsp, 8
mov rbp, rsp
cmp rdx, 1
jne 0x180006256
mov r13, rdx
sub rsp, 0x20
mov rbx, rcx
xor rax, rax
mov rcx, rbp
sub rcx, rsp
mov rdi, rsp
rep stosb byte [rdi], al
mov rcx, rbx
mov rax, 0x5a
add rax, 6
mov rbx, qword gs:[rax]
mov rax, 0xe
add rax, 0xa
push rax
xor rax, rax
inc rax
test rax, rax
je entry0
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne entry0
inc rcx
test rcx, rcx
je entry0
pop rcx
mov rbx, qword [rbx + rax]
mov rax, 0x16
add rax, 0xa
mov rbx, qword [rbx + rax]
mov r12, rbx
mov rax, 0x34
add rax, 0xc
mov rdx, qword [rbx + rax]
mov r14, 0x33
add r14, 0x18
cmp byte [rdx + 0x28], r14b
je 0x1800042d3
mov r14, 0x3b
add r14, 0x30
cmp byte [rdx + 0x28], r14b
je 0x1800042d3
jmp 0x1800043bb
mov r14, 0xc
add r14, 0x39
cmp byte [rdx + 0x30], r14b
je 0x1800042fa
mov r14, 7
add r14, 0x5e
cmp byte [rdx + 0x30], r14b
je 0x1800042fa
jmp 0x1800043bb
invalid
invalid

Function at 0x18000420c
Capabilities:
Parse pe header

Disassembly:
push rax
xor rax, rax
inc rax
test rax, rax
je entry0
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne entry0
inc rcx
test rcx, rcx
je entry0
pop rcx
push rbx
push rbp
push rdi
push rsi
push r12
push r13
push rax
xor rax, rax
inc rax
test rax, rax
je entry0
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne entry0
inc rcx
test rcx, rcx
je entry0
pop rcx
push r14
push r15
sub rsp, 8
mov rbp, rsp
cmp rdx, 1
jne 0x180006256
mov r13, rdx
sub rsp, 0x20
mov rbx, rcx
xor rax, rax
mov rcx, rbp
sub rcx, rsp
mov rdi, rsp
rep stosb byte [rdi], al
mov rcx, rbx
mov rax, 0x5a
add rax, 6
mov rbx, qword gs:[rax]
mov rax, 0xe
add rax, 0xa
push rax
xor rax, rax
inc rax
test rax, rax
je entry0
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne entry0
inc rcx
test rcx, rcx
je entry0
pop rcx
mov rbx, qword [rbx + rax]
mov rax, 0x16
add rax, 0xa
mov rbx, qword [rbx + rax]
mov r12, rbx
mov rax, 0x34
add rax, 0xc
mov rdx, qword [rbx + rax]
mov r14, 0x33
add r14, 0x18
cmp byte [rdx + 0x28], r14b
je 0x1800042d3
mov r14, 0x3b
add r14, 0x30
cmp byte [rdx + 0x28], r14b
je 0x1800042d3
jmp 0x1800043bb
mov r14, 0xc
add r14, 0x39
cmp byte [rdx + 0x30], r14b
je 0x1800042fa
mov r14, 7
add r14, 0x5e
cmp byte [rdx + 0x30], r14b
je 0x1800042fa
jmp 0x1800043bb
invalid
invalid
Function at 0x180004328
Capabilities:
Parse pe header

Disassembly:
add r14, 3
cmp byte [rdx + 0x36], r14b
je 0x180004337
jmp 0x1800043bb
mov r14, 0x2f
add r14, 0x1d
cmp byte [rdx + 0x3c], r14b
jb 0x180004382
je 0x18000435b
mov r14, 0x1f
add r14, 0x4d
cmp byte [rdx + 0x3c], r14b
je 0x18000435b
jmp 0x1800043bb
mov r14, 0x2e
add r14, 0x1e
cmp byte [rdx + 0x3e], r14b
je 0x18000437f
mov r14, 0x3b
add r14, 0x31
cmp byte [rdx + 0x3e], r14b
je 0x18000437f
jmp 0x1800043bb
mov r14, 5
add r14, 0x1b
mov rbx, qword [rbx + r14]
push rax
xor rax, rax
inc rax
test rax, rax
je entry0
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne entry0
inc rcx
test rcx, rcx
invalid
invalid

Function at 0x180004344
Capabilities:
Parse pe header

Disassembly:
jb 0x180004382
add eax, 0x49000000
add esi, 0x1b

Function at 0x180004380
Capabilities:
Parse pe header

Disassembly:
add r14, 3
cmp byte [rdx + 0x36], r14b
je 0x180004337
jmp 0x1800043bb
mov r14, 0x2f
add r14, 0x1d
cmp byte [rdx + 0x3c], r14b
jb 0x180004382
je 0x18000435b
mov r14, 0x1f
add r14, 0x4d
cmp byte [rdx + 0x3c], r14b
je 0x18000435b
jmp 0x1800043bb
mov r14, 0x2e
add r14, 0x1e
cmp byte [rdx + 0x3e], r14b
je 0x18000437f
mov r14, 0x3b
add r14, 0x31
cmp byte [rdx + 0x3e], r14b
je 0x18000437f
jmp 0x1800043bb
mov r14, 5
add r14, 0x1b
mov rbx, qword [rbx + r14]
push rax
xor rax, rax
inc rax
test rax, rax
je entry0
pop rax
push rcx
xor rcx, rcx
test rcx, rcx
jne entry0
inc rcx
test rcx, rcx
invalid
invalid

Function at 0x1800043cc
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
inc rcx
xor rax, rax
mov eax, dword [rsi + rcx*4]
push rdx
xor rdx, rdx
test rdx, rdx
jne entry0
inc rdx
test rdx, rdx
je entry0
pop rdx
add rax, rbx
cmp qword [rax], r9
jne 0x180004424
xor rsi, rsi
mov r14, 0x16
add r14, 0xe
mov esi, dword [r8 + r14]
add rsi, rbx
mov cx, word [rsi + rcx*2]
xor rsi, rsi
mov r14, 0x18
mov esi, 0x18
add r14, 4
mov esi, dword [r8 + r14]
add rsi, rbx
xor rdx, rdx
mov edx, dword [rsi + rcx*4]
add rdx, rbx
mov qword [rbp - 0x10], rdx
sub rsp, 0x100
mov rdi, rsp
add rdi, 0x10
mov al, 0x42
add al, 0x14

Function at 0x18000440c
Capabilities:
Parse pe header

Disassembly:
leave
movabs r9, 0x2391575ef68e754
movabs rax, 0x3f2a59fc610b7df3
add r9, rax

Function at 0x18000449c
Capabilities:
Parse pe header

Disassembly:
mov byte [rdi], al
mov al, 0x50
add al, 0x19
mov byte [rdi + 1], al
mov al, 0x20
add al, 0x52
mov byte [rdi + 2], al
mov al, 3
add al, 0x71

Function at 0x1800044b0
Capabilities:
Parse pe header

Disassembly:
mov byte [rdi + 3], al
mov al, 0x4d
add al, 0x28
mov byte [rdi + 4], al
push r15
xor r15, r15
inc r15
test r15, r15
je entry0
pop r15
mov al, 0x34
add al, 0x2d
mov byte [rdi + 5], al
mov al, 0x23
add al, 0x49
mov byte [rdi + 6], al
mov al, 0x3b
add al, 6
mov byte [rdi + 7], al
mov al, 0x27
add al, 0x45
mov byte [rdi + 8], al
mov al, 6
add al, 0x66
mov byte [rdi + 9], al
mov al, 0x5e
add al, 0x11
mov byte [rdi + 0xa], al
mov al, 0x2a
add al, 0x39
mov byte [rdi + 0xb], al
mov byte [rdi + 0xc], 0
mov rcx, qword [rbp - 8]
mov rdx, rdi
sub rsp, 0x20
lea rax, [0x18000451b]
push rax
mov rax, qword [rbp - 0x10]
jmp rax
Function at 0x180004588
Capabilities:
Parse pe header

Disassembly:
or byte [rax + 0x14b00147], cl
add al, 0x60
mov byte [rdi + 2], al
mov al, 0x2b
add al, 0x18
mov byte [rdi + 3], al
mov al, 0x71
add al, 4
mov byte [rdi + 4], al
mov al, 0x12
add al, 0x60
mov byte [rdi + 5], al
mov al, 0xa
add al, 0x68
mov byte [rdi + 6], al
mov al, 0x47
add al, 0x1e
mov byte [rdi + 7], al
mov al, 0x29
add al, 0x45
mov byte [rdi + 8], al
mov al, 0xb
add al, 0x69
mov byte [rdi + 9], al
mov al, 0x2e
add al, 0x26
mov byte [rdi + 0xa], al
mov al, 0x14
add al, 0x54
mov byte [rdi + 0xb], al
push r15
xor r15, r15
inc r15
test r15, r15
je entry0
pop r15
mov al, 0x6f
add al, 3
mov byte [rdi + 0xc], al
mov al, 0x1f
add al, 0x46
mov byte [rdi + 0xd], al
mov al, 0x47
add al, 0x1a
mov byte [rdi + 0xe], al
mov al, 0x59
add al, 0xb
mov byte [rdi + 0xf], al
mov al, 0x33
add al, 0x16
mov byte [rdi + 0x10], al
mov al, 0x34
add al, 0x30
mov byte [rdi + 0x11], al
mov byte [rdi + 0x12], 0
mov rcx, qword [rbp - 8]
mov rdx, rdi
sub rsp, 0x20
lea rax, [0x18000462c]
add eax, 7

Function at 0x180004644
Capabilities:
Parse pe header

Disassembly:
inc r15
test r15, r15
je entry0
pop r15
jmp r15

Function at 0x1800047cc
Capabilities:
Parse pe header

Disassembly:
mov edx, edi
sub rsp, 0x20
push r15
xor r15, r15
inc r15
test r15, r15
je entry0
pop r15
lea rax, [0x1800047f3]
push rax
mov rax, qword [rbp - 0x10]
jmp rax

Function at 0x180004808
Capabilities:
Parse pe header

Disassembly:
lea r8, [0x180004853]
mov r9, r14
push 0
push 0
sub rsp, 0x20
push rdx
xor rdx, rdx
test rdx, rdx
jne entry0
inc rdx
test rdx, rdx
je entry0
pop rdx
lea rax, [0x18000483f]
push rax
jmp r15

Function at 0x1800049e0
Capabilities:
Parse pe header

Disassembly:
mov byte [r14 + 7], al
mov al, 0x1b
add al, 0x48
mov byte [r14 + 8], al
mov al, 0x13
add al, 0x58
mov byte [r14 + 9], al
mov byte [r14 + 0xa], 0
mov rcx, r15
mov rdx, r14
sub rsp, 0x20
push rdx
xor rdx, rdx
test rdx, rdx
jne entry0
inc rdx
test rdx, rdx
je entry0
pop rdx
lea rax, [0x180004a14]
push rax
jmp r13
Function at 0x18000570c
Capabilities:
Parse pe header

Disassembly:
mov al, 0x4a
add al, 0x28
mov byte [rdi + 3], al
mov al, 0x51
add al, 0x1b
mov byte [rdi + 4], al
mov al, 1
add al, 0x64
mov byte [rdi + 5], al
mov al, 6
add al, 0x68
mov byte [rdi + 6], al
mov al, 0x26
add al, 0x1b
mov byte [rdi + 7], al
mov byte [rdi + 8], 0
mov rcx, qword [rbp - 0x80]
mov rdx, rdi
sub rsp, 0x20
mov rax, qword [rbp - 0x88]
call rax
add rsp, 0x20
mov qword [rbp - 0xd8], rax
mov al, 0x40
add al, 0x2c
mov byte [rdi], al
mov al, 0x50
add al, 0x23
mov byte [rdi + 1], al
mov al, 0x5b
add al, 0x19
mov byte [rdi + 2], al
mov al, 0x1d
add al, 0x55
mov byte [rdi + 3], al
mov al, 0x1c
add al, 0x50
mov byte [rdi + 4], al
mov al, 0x57
add al, 0xe
mov byte [rdi + 5], al
mov al, 0x2e
add al, 0x40
mov byte [rdi + 6], al
mov al, 0x1a
add al, 0x3d
mov byte [rdi + 7], al
mov byte [rdi + 8], 0
mov rcx, qword [rbp - 0x80]
mov rdx, rdi
sub rsp, 0x20
mov rax, qword [rbp - 0x88]
call rax
add rsp, 0x20
mov qword [rbp - 0xe0], rax
mov al, 0x59
add al, 9
mov byte [rdi], al
mov al, 0x2a
add al, 0x39
mov byte [rdi + 1], al
mov al, 0x38
add al, 0x3a
mov byte [rdi + 2], al
mov al, 0x44
add al, 0x35

Function at 0x1800057c4
Capabilities:
Parse pe header

Disassembly:
mov byte [rdi + 3], al
mov al, 0x21
add al, 0x4f
mov byte [rdi + 4], al
mov al, 0xc
add al, 0x68
mov byte [rdi + 5], al
mov byte [rdi + 6], 0x2e
mov al, 0x35
add al, 0x2f
mov byte [rdi + 7], al
mov al, 0x4b
add al, 0x21
mov byte [rdi + 8], al
mov al, 0x66
add al, 6
mov byte [rdi + 9], al
mov byte [rdi + 0xa], 0
mov rcx, rdi
sub rsp, 0x20
mov rax, qword [rbp - 0xe8]
call rax
add rsp, 0x20
mov r15, rax
mov al, 3
add al, 0x3f
mov byte [rdi], al
mov al, 0x24
add al, 0x1f
mov byte [rdi + 1], al
mov al, 6
add al, 0x6c
mov byte [rdi + 2], al
mov al, 0x43
add al, 0x36
mov byte [rdi + 3], al
mov al, 2
add al, 0x6e
mov byte [rdi + 4], al
mov al, 0x58
add al, 0x1c
mov byte [rdi + 5], al
mov al, 0x15
add al, 0x3a
mov byte [rdi + 6], al

Function at 0x180005914
Capabilities:
Parse pe header

Disassembly:
mov byte [rdi + 6], al
mov al, 3
add al, 0x62
mov byte [rdi + 7], al
mov al, 0x52
add al, 0x22
mov byte [rdi + 8], al
mov al, 0x18
add al, 0x38
mov byte [rdi + 9], al
mov al, 0x69
add al, 9
mov byte [rdi + 0xa], al
mov al, 0x60
add al, 0xf
mov byte [rdi + 0xb], al
mov al, 0x1a
add al, 0x56
mov byte [rdi + 0xc], al
mov al, 0xf
add al, 0x56
mov byte [rdi + 0xd], al
mov al, 0x19
add al, 0x59
mov byte [rdi + 0xe], al
mov al, 0x25
add al, 0x4f
mov byte [rdi + 0xf], al
mov al, 0x20
add al, 0x59
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], 0
mov rcx, r15
mov rdx, rdi
sub rsp, 0x20
mov rax, qword [rbp - 0x88]
call rax
add rsp, 0x20
mov qword [rbp - 0x98], rax
mov al, 0x20
and byte [rdx + riz], al
mov byte [rdi], al
mov al, 0x35
add al, 0xe
mov byte [rdi + 1], al
mov al, 0x12
add al, 0x60
mov byte [rdi + 2], al
mov al, 0x69
add al, 0x10
mov byte [rdi + 3], al
mov al, 0x44
add al, 0x2c
mov byte [rdi + 4], al
mov al, 0x65
add al, 0xf
mov byte [rdi + 5], al
mov al, 0x43
add al, 0x10
mov byte [rdi + 6], al
mov al, 3
add al, 0x62
invalid
Function at 0x180006208
Capabilities:
Parse pe header

Disassembly:
add esp, 0x20
mov r12, rax
mov rcx, 0xffffffffffffffff
xor rdx, rdx
sub rsp, 0x20
push rax
xor rax, rax
Function at 0x140001000
Capabilities:
Create thread
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
nop
lea rdx, str.VimeWorld
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov ecx, 0x1e
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140001020
xor esi, esi
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x40], esi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400010ee
cmp rax, 0xffffffffffffffff
je 0x1400010e5
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea r9d, [rsi + 0x15]
mov qword [rsp + 0x20], rsi
mov rdx, rax
lea r8, str.C:zelkerZelker.dll
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor edx, edx
mov dword [rsp + 0x28], esi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x1400010e5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001740
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1406fc0b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406fc237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406fc0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406fc0c7
add dl, dl
jne 0x1406fc0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406fc14e
xor eax, eax
add dl, dl
jne 0x1406fc0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406fc205
add dl, dl
jne 0x1406fc10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fc11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fc128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fc135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406fc142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406fc0d6
mov eax, 1
add dl, dl
jne 0x1406fc15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406fc16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406fc153
sub eax, ebx
mov ebx, 1
jne 0x1406fc1a4
mov ecx, 1
add dl, dl
jne 0x1406fc186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406fc193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406fc17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406fc0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406fc1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406fc1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406fc1b5
cmp eax, 0x7d00
jae 0x1406fc1f3
cmp eax, 0x500
jb 0x1406fc1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406fc0d6
cmp eax, 0x7f
ja 0x1406fc1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406fc0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406fc22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406fc0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1000014f8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [0x100003110]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor edi, edi
lea rax, [rsp + 0x90]
mov r9d, 0x104
sub rcx, rax
lea r8, [rsp + 0x90]
mov edx, edi
lea rax, [r9 + 0x7ffffefa]
cmp rax, rdi
je 0x100001558
movzx eax, word [rcx + r8]
cmp ax, di
je 0x100001558
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x100001534
cmp r9, rdi
jne 0x100001566
sub r8, 2
mov edx, 0x8007007a
cmp edx, edi
mov word [r8], di
jl 0x10000160a
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov rbx, rax
cmp rax, rdi
je 0x100001591
cmp word [rax], di
je 0x100001591
mov word [rax - 2], di
xor edx, edx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x6c]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
or ecx, 0xffffffff
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x2000300
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x50], 1
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
je 0x1000015ec
mov edx, edi
jmp 0x10000160a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
cmp eax, edi
cmovle edx, eax
mov eax, 0x80004005
cmp edx, edi
cmovge edx, eax
mov eax, edx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.100001ba0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2b0
pop rdi
ret
Function at 0x100001634
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x470
mov rax, qword [0x100003110]
xor rax, rsp
mov qword [rsp + 0x460], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ebp, ebp
mov r8d, 0x208
mov r11, rax
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x50]
sub r11, rax
mov r9d, ebp
lea rcx, [r8 + 0x7ffffdf6]
cmp rcx, rbp
je 0x1000016a6
movzx eax, word [r11 + rdx]
cmp ax, bp
je 0x1000016a6
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x100001683
cmp r8, rbp
jne 0x1000016b5
sub rdx, 2
mov r9d, 0x8007007a
cmp r9d, ebp
mov word [rdx], bp
jl 0x1000017dc
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov rdi, rax
cmp word [rax], bp
je 0x1000017d0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov rbx, rax
cmp word [rax], bp
je 0x1000017dc
mov word [rax - 2], bp
cmp word [rdi], bp
lea r13, [0x100001238]
mov rcx, r13
lea r9, [rsp + 0x30]
mov edx, 0x1a3a
cmovne rcx, rdi
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x38], rcx
xor ecx, ecx
mov dword [rsp + 0x40], 1
lea r8d, [rcx + 2]
call sub.ntdll.dll_WinSqmAddToStream
mov rcx, rbx
call fcn.100001ff8
cmp eax, ebp
je 0x1000017cb
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, ebp
jl 0x1000017dc
lea rdi, [0x1000013f8]
mov rsi, rbp
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
cmp eax, ebp
je 0x10000177f
add rsi, 0x10
add rdi, 0x10
cmp rsi, 0x20
jb 0x10000175f
jmp 0x1000017bb
mov rax, qword [rdi + 8]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
cmp rax, rbp
je 0x100001799
mov qword [rsp + 0x28], rax
cmp word [rax], bp
jne 0x10000179e
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x20]
mov edx, 0x38f
mov r8d, 1
mov dword [rsp + 0x20], 2
call sub.ntdll.dll_WinSqmAddToStream
mov rcx, rbx
call fcn.10000208c
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1000017dc
mov rcx, rbx
jmp 0x1000017d7
lea rcx, [0x100001420]
call fcn.1000014f8
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.100001ba0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x14000290c
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, str.FlsAlloc
xor ecx, ecx
lea r8, [0x1400043e0]
lea rdx, str.FlsAlloc
call fcn.140002734
mov rbx, rax
test rax, rax
je 0x14000294c
mov rcx, rax
call fcn.140001f7c
mov rcx, rdi
call rbx
jmp 0x140002952
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400029b4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, str.FlsSetValue
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140004408]
call fcn.140002734
mov rsi, rax
test rax, rax
je 0x140002a00
mov rcx, rax
call fcn.140001f7c
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x140002a0b
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret