joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401bd170
Capabilities:
Delete file

Disassembly:
jmp 0x1401bd170
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.1401c58e0
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x1401bd1d0
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.1401c74a0
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x1401bd1dc
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x1401bd206
test rdi, rdi
je 0x1401bd232
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.14001bb10
xor eax, eax
jmp 0x1401bd1d3
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x1401bd1d3
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.14001bb10
jmp 0x1401bd1d0
xor eax, eax
jmp 0x1401bd1d3

Function at 0x1401bd8d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140282748]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x1401bd908
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1401bd966
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x1401bd993
test eax, eax
js 0x1401bd972
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x1401bd989
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x1402827b0]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.1401b4770
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1401ac8e0
mov ecx, 7
int 0x29
ud2
Function at 0x1401bd9f0
Capabilities:
Create udp socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov edi, edx
cmp word [rcx], 0
mov eax, 2
mov r14d, 0x17
cmove r14d, eax
mov dword [rsp + 0x28], 0x81
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, r14d
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401bdad1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x1401bda58
mov esi, eax
cmp eax, 0x2726
jne 0x1401bdac4
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
mov ecx, r14d
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_WSASocketW]
cmp rax, 0xffffffffffffffff
je 0x1401bdabc
mov rsi, rax
xor ebx, ebx
mov rcx, rax
mov edx, 1
xor r8d, r8d
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
jne 0x1401bdad1
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov ebx, 1
mov rsi, rdi
jmp 0x1401bdad1
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov ebx, 1
mov rax, rbx
mov rdx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1401be5c0
Capabilities:
Set current directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
add rdx, rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], rdx
mov word [rbp - 0x28], 0
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x38]
call fcn.1401b1390
mov rdi, qword [rbp - 0x10]
cmp rdi, qword [rbp - 0x20]
jne 0x1401be605
lea rcx, [rbp - 0x20]
call fcn.1401b0ef0
mov rsi, qword [rbp - 0x18]
mov word [rsi + rdi*2], 0
mov rcx, rsi
call qword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1401be643
xor edi, edi
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x1401be638
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.14001bb10
mov rax, rdi
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rdx, qword [rbp - 0x20]
test rdx, rdx
jne 0x1401be627
jmp 0x1401be638
Function at 0x1401c4f10
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1402f0f41]
mov ecx, 0x10
mov edx, 8
call fcn.14001bb00
test rax, rax
je 0x1401c4ffb
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1401c50b0]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne case.0x1401b6b0d.496
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
call 0x12079d8dc
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x1401c4faa
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
or byte [rax - 0x7b], cl
invalid
je 0x1401c4fc4
mov r8, qword [rax + 0x10]
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
adc byte [rax], al
add byte [rax], al

Function at 0x1401c7f10
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x186], ax
mov rax, qword [0x1402f10c0]
cmp rax, 3
jne 0x1401c8042
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
ja 0x1401c8068
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
inc rdi
lea rcx, [rbp + 0x158]
mov rdx, rbx
mov r8, rdi
call fcn.1401d40e0
cmp qword [rbp + 0x158], 0
je 0x1401c7fb1
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1401c8033
mov rcx, qword [rbp + 0x160]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x178], 0
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x178]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401c8014
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401c802c
mov rax, qword [rbp + 0x178]
movzx ecx, word [rbp + 0x186]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rbx, rdx
call fcn.1401ecfa0
mov rdx, rbx
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
jbe 0x1401c7f67
lea r9, [rbp + 0x170]
mov rcx, rsi
mov r8, rdi
call fcn.1401ed010
jmp 0x1401c8033
Function at 0x1401c81b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
mov dword [rbp + 0x34], 0x80
lea rdx, [rbp - 0x60]
lea r8, [rbp + 0x34]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1401c823a
mov eax, dword [rbp + 0x34]
movzx ecx, word [rbp - 0x60]
cmp ecx, 0x17
je 0x1401c824a
cmp ecx, 2
jne 0x1401c8288
cmp eax, 0xf
jbe 0x1401c82a2
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
jmp 0x1401c8298
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x1401c828f
cmp eax, 0x1b
jbe 0x1401c82ba
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov edx, dword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x24], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rbp + 0x22]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rbp + 0x32]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
jmp 0x1401c8298
lea rax, str.invalid_argumentp4__
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb8
pop rsi
pop rbp
ret
lea rcx, [0x1402833c2]
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len___mem::size_of::_c::sockaddr_in___
mov edx, 0x39
call fcn.1401ee220
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in6___
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len___mem::size_of::_c::sockaddr_in___
mov edx, 0x3a
call fcn.1401ee220
int3
Function at 0x1401db8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x1401db93a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1401db930
cmp r11, r10
ja 0x1401db9b6
cmp r10, rdx
ja 0x1401db9c8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x1401db932
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1401db910
jmp 0x1401db997
ja 0x1401db93a
mov r11, r10
cmp rax, r8
jne 0x1401db8d7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x1401db99b
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1401db970
mov r8, r10
sub ecx, r9d
jns 0x1401db98e
jmp 0x1401db99d
cmp r10, rdx
je 0x1401db9aa
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1401db99d
xor al, 1
cmp r8, rdx
jne 0x1401db950
jmp 0x1401db99d
xor eax, eax
jmp 0x1401db99d
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1401ee0e0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1401ee6c0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1401ee650
int3

Function at 0x1401de4d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1401de522
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401de522
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401de522
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401de522
cmp dword [rcx + 0x84], 0xe
jbe 0x1401de522
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401de524
xor al, al
add rsp, 0x28
ret
Function at 0x1401ebfc0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, [0x14024889d]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ec021
mov rdi, rax
lea rdx, [0x1402488be]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1401ec021
mov rsi, rax
lea rdx, [0x1402488cc]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1401ec021
mov rdi, rax
xor ebx, ebx
jmp 0x1401ec0a7
lea rcx, [0x140248858]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ec11b
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1401ec11b
mov rdi, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1401ec11b
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1401ec11b
mov rsi, rax
lea rcx, [rbp - 0x18]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x1401ec11b
mov rdi, qword [rbp - 0x18]
movzx eax, byte [0x1402f0f41]
mov ecx, 0x18
mov edx, 8
call fcn.14001bb00
test rax, rax
je 0x1401ec120
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
xor eax, eax
lock cmpxchg qword [0x1402f0fd8], rcx
je 0x1401ec10f
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
je 0x1401ec0f8
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.14001bb10
mov rcx, rsi
mov rax, rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.1401ebd00
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov ecx, 8
mov edx, 0x18
call fcn.1401edf10
ud2
Function at 0x1401ed010
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov r14, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.1401cfd20
mov rdx, qword [rbp - 0x28]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x1401ed099
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401ed0cc
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401ed0e0
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x1401ed100
mov rcx, qword [rbp - 0x20]
mov r8d, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.14001bb10
mov rcx, qword [r14]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x1401ed100
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.14001bb10
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400aeb98
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400aebae
mov al, 1
jmp 0x1400aec0e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400aebbf
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400aec0c
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400963cc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400aec0c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400aec0c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400aec0c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400aec0e
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400d4210
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140175040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 1
je 0x1400d4239
mov rcx, qword [rsi]
jmp 0x1400d4242
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400d428b
mov dil, 1
test bl, bl
je 0x1400d4274
cmp byte [rsi + 8], 1
je 0x1400d4260
mov rcx, qword [rsi]
jmp 0x1400d4269
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140084ac0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 1
jne 0x1400d42a2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400d42a5
mov rcx, qword [rsi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400d42b8
xor edi, edi
jmp 0x1400d4274
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 1
jne 0x1400d42d1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400d42d4
mov rcx, qword [rsi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x1400d4274
Function at 0x14010f6c0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x14010f6d0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x14010f6f1
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14010f715
cmp byte [r14 + 0x50], 1
jne 0x14010f70f
or edi, 0x80000000
jmp 0x14010f715
or edi, 0x20000000
test dil, 8
je 0x14010f730
cmp byte [r14 + 0x68], 1
je 0x14010f72a
or edi, 0x10000000
jmp 0x14010f730
or edi, 0x40000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x14010f744
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x14010f755
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
jne 0x14010f768
lea rcx, [r14 + 0x20]
call fcn.1400e39c0
mov r15, rax
cmp byte [r14 + 0x18], 1
je 0x14010f78d
xor r9d, r9d
jmp 0x14010f798
xor edx, edx
jmp 0x14010f7b4
mov edx, 4
jmp 0x14010f7b4
mov edx, 1
jmp 0x14010f7b4
mov edx, 6
jmp 0x14010f7b4
mov rcx, r14
call fcn.1400e39c0
mov r9, rax
cmp ebx, 4
ja case.default.0x14010f7ad
mov eax, ebx
lea rcx, [0x1401605a4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
je 0x14010f7dd
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14010f800
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x14010f83c
cmp byte [r14 + 0x50], 1
je 0x14010f836
or edi, 0x20000000
jmp 0x14010f83c
or edi, 0x80000000
test dil, 8
je 0x14010f857
cmp byte [r14 + 0x68], 1
je 0x14010f851
or edi, 0x10000000
jmp 0x14010f857
or edi, 0x40000000
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x14010f86b
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x14010f87c
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
jne 0x14010f88f
lea rcx, [r14 + 0x20]
call fcn.1400e39c0
mov r15, rax
cmp byte [r14 + 0x18], 1
je 0x14010f8b4
xor r9d, r9d
jmp 0x14010f8bf
xor edx, edx
jmp 0x14010f8db
mov edx, 1
jmp 0x14010f8db
mov edx, 4
jmp 0x14010f8db
mov edx, 6
jmp 0x14010f8db
mov rcx, r14
call fcn.1400e39c0
mov r9, rax
cmp ebx, 4
ja case.default.0x14010f8d4
mov eax, ebx
lea rcx, [0x1401605b8]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, 7
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
je 0x14010f904
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140113670
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rax, qword [0x140175040]
xor rax, rsp
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [0x14014c6c0]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
mov r8d, 6
call fcn.14011c6e0
test eax, eax
je 0x1401137a3
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movzx eax, byte [0x140160e95]
cmp rsi, rax
jne 0x1401136e7
lea rbx, [0x140160e88]
test al, al
je 0x1401137a5
lea rdx, [0x140160e8c]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
movzx eax, byte [0x1401610cd]
cmp rsi, rax
jne 0x14011371c
lea rbx, [0x1401610c0]
test al, al
je 0x1401137a5
lea rdx, [0x1401610c4]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
movzx eax, byte [0x140160fad]
cmp rsi, rax
jne 0x140113749
lea rbx, [0x140160fa0]
test al, al
je 0x1401137a5
lea rdx, [0x140160fa4]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
movzx eax, byte [0x1401611ad]
cmp rsi, rax
jne 0x140113776
lea rbx, [0x1401611a0]
test al, al
je 0x1401137a5
lea rdx, [0x1401611a4]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
movzx eax, byte [0x140161295]
cmp rsi, rax
jne 0x1401137a3
lea rbx, [0x140161288]
test al, al
je 0x1401137a5
lea rdx, [0x14016128c]
mov rcx, rdi
mov r8, rsi
call fcn.1400b6a20
test eax, eax
je 0x1401137a5
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140084ac0
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x181a32058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x181a321df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x181a32089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181a3206f
add dl, dl
jne 0x181a32096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181a320f6
xor eax, eax
add dl, dl
jne 0x181a320a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181a321ad
add dl, dl
jne 0x181a320b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181a320c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181a320d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181a320dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x181a320ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x181a3207e
mov eax, 1
add dl, dl
jne 0x181a32106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181a32113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181a320fb
sub eax, ebx
mov ebx, 1
jne 0x181a3214c
mov ecx, 1
add dl, dl
jne 0x181a3212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181a3213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181a32123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181a3207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x181a32168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181a32175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181a3215d
cmp eax, 0x7d00
jae 0x181a3219b
cmp eax, 0x500
jb 0x181a32196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181a3207e
cmp eax, 0x7f
ja 0x181a3219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181a3207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x181a321d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x181a3207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011537
Capabilities:
Terminate process

Disassembly:
jmp 0x140022770
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret