joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d9c9f
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x18], r10d
neg dword [rsp + 0x10]
lea rax, [rax + 1]
mov rdi, r10
not r10w
jae 0x140022b4d
lea r10, [rdi + r10*8 - 0x5cd99adf]
seto r10b
add qword [rsp + 0x28], 0xfffffffffffc39fb
push rdx
call fcn.14000f1f1
sub qword [rsp + r14*2 - 0x65d3691a], 0xffffffffe426c7b1
movabs rcx, 0x97389a91c29bcca5
call fcn.1400603ad
push r12
jns 0x140014ed4
shl r9w, 0x82
push rdx
jne 0x1400d55b2
jle fcn.140013b00
xchg ebx, eax
adc al, 0x25
jbe 0x140014ef7
pop rbx
test eax, esi
sbb al, 2
int3
xlatb
invalid
movabs r11, 0x8b93650f4192b9bb
movsxd rdx, r9d
jbe 0x1400b6399
add qword [rsp + 0x18], 0xfffffffffffdbdcc
neg qword [rsp + 0x38]
mov rdx, r9
call fcn.1400a6baf
call fcn.1400dfd90
scasd eax, dword [rdi]
xchg esp, eax
mov dl, 0x30
sub dword [rax + 0x1a], 0x1a
mov qword [rsp + 0x18], 0x3cbc6096
jl 0x14000d2f2
push rbx
push rdx
xchg qword [rsp + 0x48], rax
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x48]

Function at 0x1400db0a6
Capabilities:
Encode data using base64

Disassembly:
mov rdi, qword [rsp + 0x28]
shr r12d, 0x84
add qword [rsp + r12*4 - 0x2f2e800c], 0xffffffffbff5e5f1
mov qword [rsp + 0x38], 0xffffffffca99758a
neg r12d
xor qword [rsp + 0x38], 0xfffffffffcb740a8
or dword [rsp + 0x38], 0x76a52a3f
mov r12, qword [rsp + 0x18]
add byte [rsp + 0x38], r8b
call fcn.1400510ec

Function at 0x1400db64a
Capabilities:
Enumerate process modules

Disassembly:
movsxd r12, r12d
test r12, r12
mov rsi, qword [rsp + r12 - 0x56c410d8]
not r12
jbe fcn.14000caac
push rdi
cmp r12d, 0x75beb1a0
jae 0x1400534a9
invalid

Function at 0x1400dc2bc
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + 0x38], rax
mov rcx, qword [rsp]
call fcn.14000afca
push rcx
movabs rcx, 0x381b8d1a2c1d3e80
mov dword [rsp + 0x28], 0x2b09fa17
ja 0x140094ea4

Function at 0x1400ddb12
Capabilities:
Authenticate hmac

Disassembly:
mov rbp, qword [rsp + 0x30]
jne 0x14009a15a
js 0x14008127c
Function at 0x1400e1549
Capabilities:
Enumerate process modules
Packed with generic packer

Disassembly:
add qword [rsp + 0x10], 0x2c024
or r14, 0x6a1a501f
mov rbx, qword [rsp]
mov rbx, qword [rbx]
setl r8b
call fcn.1400a159b
ja 0x1400e32fa
not dword [rsp + 0x68]
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x78]
ret
mov rbx, r8
shr bl, 0x98
jns 0x14006b861
mov ecx, 0x5c9bd5ba
sal cx, 0xe
sub cx, cx
movzx ecx, byte [r10 + rcx - 0x5c9b0000]
jp 0x1400e3e2d
shl dx, cl
call fcn.1400e7118
lea rdx, [rdx + rdx*4 - 0x69642ce3]
mov edx, dword [rdi]
mov r11d, dword [rdi + 4]
call fcn.1400e3914
xor r8b, bpl
lea rbp, [rsp + rbp + 0x18]
jmp 0x1400e3e6f
mov qword [rbp + riz], rdx
not word [rsp + 0xe]
lea rsp, [rsp + 0x18]
jmp fcn.1400e4185

Function at 0x1400e3051
Capabilities:
Encode data using xor

Disassembly:
cmp r14d, dword [rsp + rsi - 0x5f1c9c3c]
js 0x14001e279
je 0x1400daa7e
jno 0x1400211b4
invalid
neg word [rsp + 0x28]
and byte [rsp + 0x28], 0x94
xchg qword [rsp + 0x30], rbp
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
ret
jae 0x1400d3693
add bp, 0x8592
setge r15b
mov qword [rsp + 0x48], rbx
test byte [rsp + 0x30], r15b
push r14
call fcn.140078bd2
int3
xchg byte [rax + 0x66fff606], bh
movsx ebp, byte [rsp + r12 + 8]
mov rax, qword [rsp + r12*2 + 8]
test al, r13b
jle 0x140093366
rol dword [rax - 0x26f55eaf], 1
out dx, al
idiv ch
xchg ebp, eax
movabs eax, dword [0xf209adda54b24c7e]
mov al, 0x7b
jmp 0x1400b120f
mov rdx, qword [rsp + rsi - 0x5f1c9c30]
mov rdx, qword [rdx + rsi - 0x5f1c9c68]
ja 0x1400126a0
push r14
cmp byte [rsp], r10b
jo 0x1400b121e
xor r14b, r13b
call fcn.14007f841
test qword [rsp + 0x20], rdi
mov qword [rsp + 0x38], rbx
jae 0x14007a414
lea rbp, [rbp + 0x5cacf01d]
mov word [rsp + 0x28], 0x7a11
xor qword [rsp + 0x28], 0x7bbfa123
ja 0x14001c95a

Function at 0x140247719
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsx r11w, r11b
xor edi, edi
movsx r11d, r14w
movzx ebx, r8b
mov r11, rcx
dec r8w
movsx r9, si
movsxd r8, ebp
mov r8, rdi
cmovb r9w, r10w
nop
mov r9b, 0x84
xchg r10b, r10b
movzx r9d, byte [r11]
movzx r10d, bp
movzx r10d, byte [rdx]
inc r11
jmp 0x140247763
inc rdx
cmp spl, r13b
test bl, bl
jmp 0x140247770
je 0x14024779b
mov ecx, r8d
mov eax, 0xc600262e
stc
rol eax, cl
jmp 0x140247789
add al, r8b
clc
xor r9b, al
jmp 0x140247795
inc r8
cmp r10, rcx
test r9b, r9b
je 0x1402477ad
cmp r9b, r10b
je 0x14024774f
cmp r9b, r10b
jmp 0x1402477b5
jae 0x1402477d2
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
setb dil
mov rdi, qword [rsp + 0x10]
jmp 0x1402477d1
ret
mov rbx, qword [rsp + 8]
bswap eax
seta dil
mov eax, edi
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140001db4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001dfe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001dfe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001dfe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001dfe
cmp dword [rcx + 0x84], 0xe
jbe 0x140001dfe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e00
xor al, al
add rsp, 0x28
ret
Function at 0x140001320
Capabilities:
Create directory

Disassembly:
mov eax, 0x14d8
call fcn.140018d80
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rsp + 0x14c0], rax
cmp byte [0x140028fd0], 0
je 0x1400014cb
cmp qword [0x140028fd8], 0
jne 0x1400014cb
mov qword [rsp + 0x14d0], rbx
xor ebx, ebx
mov qword [rsp + 0x58], rbx
lea edx, [rbx + 0x10]
call fcn.140008160
movups xmm0, xmmword [str.DebugLogs]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], 0xf
mov qword [rsp + 0x60], 9
movups xmmword [rax], xmm0
movzx ecx, word [0x140021f30]
mov word [rax + 0x10], cx
lea rcx, [rsp + 0x50]
mov word [rax + 0x12], bx
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400013e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1400013e2
cmp eax, 0xb7
je 0x1400013e2
mov edx, eax
lea rcx, str.Failed_to_create_log_directory
call fcn.140001250
jmp 0x140001485
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x4a]
movzx edx, word [rsp + 0x48]
movzx eax, word [rsp + 0x4c]
movzx r10d, word [rsp + 0x46]
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x40]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], edx
lea rdx, str.DebugLogs_04d_02d_02d__02d_02d_02d_upd.txt
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x70]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140028fd8], rax
cmp rax, 0xffffffffffffffff
jne 0x140001485
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_log_file
call fcn.140001250
mov qword [0x140028fd8], rbx
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x14d0]
cmp rdx, 8
jb 0x1400014cb
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400014e3
call fcn.14000a160
mov rcx, qword [rsp + 0x14c0]
xor rcx, rsp
call fcn.140009c10
add rsp, 0x14d8
ret
call fcn.1400105b4
int3
Function at 0x140001ca0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rbp + 0x47], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
mov edx, 0x10
call fcn.140008160
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x37], 0xe
mov qword [rbp + 0x3f], 0xf
movups xmm0, xmmword [str.tupdates_ready]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140022120]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140022128]
mov dword [rax + 0x18], ecx
xor ebx, ebx
mov word [rax + 0x1c], bx
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
lea edx, [rbx + 0x10]
call fcn.140008160
mov qword [rbp + 7], rax
mov qword [rbp + 0x17], 0xd
mov qword [rbp + 0x1f], 0xf
movups xmm0, xmmword [str.tupdates_temp]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140022140]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140022148]
mov word [rax + 0x18], cx
mov word [rax + 0x1a], bx
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rbx
mov qword [rbp - 1], 7
lea edx, [rbx + 0x10]
call fcn.140008160
mov qword [rbp - 0x19], rax
mov qword [rbp - 9], 8
mov qword [rbp - 1], 0xf
movups xmm0, xmmword [str.tupdates]
movups xmmword [rax], xmm0
mov word [rax + 0x10], bx
lea rcx, [rbp + 0x27]
call fcn.140001980
lea rcx, [rbp + 7]
call fcn.140001980
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x140001df8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001df3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001ea4
call fcn.14000a160
mov qword [rbp - 9], rbx
mov qword [rbp - 1], 7
mov word [rbp - 0x19], bx
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140001e45
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001eaa
call fcn.14000a160
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x140001e81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e9e
call fcn.14000a160
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140009c10
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
call fcn.1400105b4
nop
call fcn.1400105b4
nop
call fcn.1400105b4
int3
Function at 0x140006c50
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x3d80
call fcn.140018d80
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rsp + 0x3d70], rax
mov rbx, rcx
lea rdx, str._stdata_
mov r8, rcx
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140006cad
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140006ce6
mov r8, rbx
lea rdx, str._sdumps_
lea rcx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140006ced
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140006ced
xor eax, eax
jmp 0x140006dea
lea r8, str.Updater.exe
mov edx, 0xa28
lea rcx, [rsp + 0x14d0]
call fcn.140010140
mov edx, 0x2e
lea rcx, [rsp + 0x14d0]
call fcn.14000b868
test rax, rax
je 0x140006d2d
lea rdx, [0x1400220cc]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [rsp + 0x7c]
movzx edx, word [rsp + 0x7a]
movzx r8d, word [rsp + 0x78]
movzx r9d, word [rsp + 0x76]
movzx r10d, word [rsp + 0x72]
movzx r11d, word [rsp + 0x70]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], eax
lea rax, str.0.1.0
mov dword [rsp + 0x50], ecx
lea rcx, [rsp + 0x2920]
mov dword [rsp + 0x48], edx
lea rdx, str._s_s__s__04d_02d_02d__02d_02d_02d__ld__ld.dmp
mov dword [rsp + 0x40], r8d
lea r8, [rsp + 0x80]
mov dword [rsp + 0x38], r9d
lea r9, [rsp + 0x14d0]
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
lea rcx, [rsp + 0x2920]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x3d70]
xor rcx, rsp
call fcn.140009c10
add rsp, 0x3d80
pop rbx
ret
Function at 0x140006e10
Capabilities:
Query environment variable

Disassembly:
push rdi
mov eax, 0x2900
call fcn.140018d80
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rsp + 0x28f0], rax
mov rdi, rcx
mov rcx, qword [0x140028fd8]
test rcx, rcx
je 0x140006e51
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140028fd8], 0
lea rcx, str.DBGHELP.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140006fc5
lea rdx, str.MiniDumpWriteDump
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140029030], rax
test rax, rax
je 0x140006fc5
mov qword [rsp + 0x2920], rsi
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0xa28
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140006fbd
mov eax, eax
lea rdx, str.Updater.exe
mov qword [rsp + 0x2918], rbx
lea rbx, [rsp + rax*2 + 0x3a]
mov rcx, rbx
call fcn.14000ffc4
test eax, eax
jne 0x140006f01
lea rdx, [0x1400220cc]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x50]
call fcn.140006c50
mov rsi, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x140006f57
mov r8d, 0xa28
lea rdx, [rsp + 0x14a0]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140006f52
mov eax, eax
lea rcx, [rsp + 0x14a0]
lea r8, str.Telegram_Desktop
lea rdx, str._s_
lea rcx, [rcx + rax*2]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x14a0]
call fcn.140006c50
mov rsi, rax
test rsi, rsi
je 0x140006fb5
cmp rsi, 0xffffffffffffffff
je 0x140006fb5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0x44], rdi
mov rdi, qword [0x140029030]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x4c], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov r9d, 1
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov rcx, rax
mov edx, ebx
call rdi
mov rbx, qword [rsp + 0x2918]
mov rsi, qword [rsp + 0x2920]
mov rcx, qword [rsp + 0x28f0]
xor rcx, rsp
call fcn.140009c10
add rsp, 0x2900
pop rdi
ret
Function at 0x1400095b4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14000962c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14000962c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14000962c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140009620
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14000963e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14000960e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14000962e

Function at 0x14000a8a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a8ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a8ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a8ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a8ea
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a8ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000a8ec
xor al, al
add rsp, 0x28
ret

Function at 0x140010b98
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140010994
Function at 0x140013cf0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140013d77
mov rsi, rbx
cmp word [rax], bp
je 0x140013d36
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140013d20
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140013d1c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140012918
mov rdi, rax
test rax, rax
je 0x140013d64
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000f490
mov rbp, rdi
xor ecx, ecx
call fcn.140012a54
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140018cb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140018cd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140018cd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call fcn.100169000
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100002960
add rsp, 0x28
jmp 0x100002454
Function at 0xaf4fe0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xaf4fed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xaf4ffd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xaf4fe5
lea eax, [rcx + 1]
jmp 0xaf500b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xaf501e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xaf5004
sub eax, 3
jb 0xaf503e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xaf508d
sar eax, 1
movsxd rbp, eax
jb 0xaf5074
jmp 0xaf504c
add ebx, ebx
jne 0xaf504a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xaf5074
inc ecx
add ebx, ebx
jne 0xaf505a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xaf5074
call r11
adc ecx, ecx
add ebx, ebx
jne 0xaf506d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xaf505c
add ecx, 2
jmp 0xaf5079
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00af4fa2
jmp 0xaf4fed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2f8a00
mov dl, 0x4f
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xaf50d9
cmp rsi, rcx
jae 0xaf50e1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xaf50c0
cmp al, 0x8f
ja 0xaf50c0
cmp byte [rsi - 2], 0xf
je 0xaf50c6
sub al, 0xe8
cmp al, 1
ja 0xaf50aa
cmp rsi, rcx
jae 0xaf50e1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xaf50b0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xaf50e1
lodsb al, byte [rsi]
jmp 0xaf50c0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x6eb000]
mov eax, dword [rdi]
or eax, eax
je 0xaf513e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6f5000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xaf50ee
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xaf5138
mov qword [rbx], rax
add rbx, 8
jmp 0xaf510e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xaf5182
cmp al, 0xef
ja 0xaf516a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xaf514a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xaf5159
mov eax, dword [rdi]
add rdi, 4
jmp 0xaf5159
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xaf51d6
sub rsp, 0xffffffffffffff80
jmp 0x469220