joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movsxd rax, dword [rcx + 0x3c]
mov ebp, dword [0x180020a84]
lea r11d, [rbp - 1]
imul r11d, ebp
cmp dword [rcx + rax + 0x8c], 0
mov r8d, dword [0x180020a88]
je 0x180001f42
mov eax, dword [rcx + rax + 0x88]
cmp r8d, 0xa
jl 0x180001f02
mov ebp, r11d
and ebp, 1
je 0x180001f02
jmp 0x180001f00
cmp dword [rcx + rax + 0x14], 0
je 0x180001f42
mov r9d, dword [rcx + rax + 0x18]
test r9d, r9d
je 0x180001f42
mov r10d, dword [rcx + rax + 0x1c]
cmp dword [0x180020a8c], 0xa
jl 0x180001f62
mov esi, dword [0x180020a90]
lea edi, [rsi - 1]
imul edi, esi
and edi, 1
je 0x180001f62
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x180001f40
xor ecx, ecx
cmp r8d, 0xa
jl 0x180001fcf
mov eax, r11d
and eax, 1
je 0x180001fcf
nop word cs:[rax + rax]
jmp 0x180001f60
add r10, rcx
mov r15d, dword [rcx + rax + 0x20]
mov r14d, dword [rcx + rax + 0x24]
add r15, rcx
add r14, rcx
xor edi, edi
nop word [rax + rax]
mov esi, dword [r15]
add rsi, rcx
xor eax, eax
nop dword [rax + rax]
movzx ebx, byte [rdx + rax]
movzx ebp, byte [rsi + rax]
test bl, bl
je 0x180001fa5
add rax, 1
cmp bl, bpl
je 0x180001f90
cmp bl, bpl
je 0x180001fc4
add edi, 1
add r15, 4
add r14, 2
cmp edi, r9d
jne 0x180001f80
xor ecx, ecx
cmp r8d, 0xa
jge 0x180001fd5
jmp 0x180001fe2
movzx eax, word [r14]
mov eax, dword [r10 + rax*4]
add rcx, rax
cmp r8d, 0xa
jl 0x180001fe2
and r11d, 1
je 0x180001fe2
nop dword [rax + rax]
jmp 0x180001fe0
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180001ff0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002022
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002022
nop word cs:[rax + rax]
jmp 0x180002020
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
mov edx, dword [0x180020a9c]
lea edi, [rdx - 1]
imul edi, edx
test dil, 1
sete dl
cmp dword [0x180020aa0], 0xa
setl r9b
mov r14, qword [rbx + 0x10]
lea r10, [rbx + 0x10]
cmp r14, r10
je 0x180002118
or r8b, al
or r9b, dl
lea r11, [rcx - 1]
xor eax, eax
mov rsi, r11
test r8b, r8b
je 0x180002100
nop
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002090
test r9b, r9b
je 0x180002110
sub rsi, rcx
je 0x180002112
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop word [rax + rax]
movzx edx, word [r15 + rbx*2]
movsx r13d, byte [rcx + rbx]
lea r12d, [rdx - 0x41]
lea ebp, [rdx + 0x20]
cmp r12w, 0x1a
cmovae ebp, edx
lea r12d, [r13 - 0x41]
lea edi, [r13 + 0x20]
cmp r12b, 0x1a
cmovae edi, r13d
cmp ebp, edi
jne 0x1800020ed
test dx, dx
je 0x180002112
add rbx, 1
cmp rsi, rbx
jne 0x1800020b0
jmp 0x180002112
mov r14, qword [r14]
cmp r14, r10
jne 0x180002087
jmp 0x18000211a
jmp 0x180002100
jmp 0x180002110
mov rax, qword [r14 + 0x30]
jmp 0x18000211a
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002e62
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 0x38], rcx
lea rdi, [rbp - 0x18]
mov edx, 0x104
mov rcx, rdi
mov r8b, 1
call fcn.140002417
cmp qword [rdi], 0
mov rdi, qword [rdi + 8]
jne 0x140003083
mov rbx, qword [rbp - 8]
mov ecx, 0x104
mov rdx, rbx
call sub.kernel32.dll_GetCurrentDirectoryW
mov eax, 0x208
xor esi, esi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], rbx
test rax, rax
je 0x140002eda
cmp word [rbx + rsi*2], 0
je 0x140002edf
inc rsi
add rax, 0xfffffffffffffffe
jmp 0x140002ec5
mov esi, 0x104
and qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 1
and qword [rbp - 8], 0
mov rax, rsi
shr rax, 1
mov r8d, esi
and r8d, 1
add r8, rax
je 0x140002f0e
lea rcx, [rbp - 0x18]
xor edx, edx
call fcn.140033ca8
mov r13, qword [rbp - 0x20]
lea rbx, [rsi*2]
add rbx, r13
xor esi, esi
lea r15, [rbp - 0x18]
test si, si
je 0x140002f2d
mov r14d, edi
jmp 0x140002f3f
cmp r13, rbx
je 0x140003051
movzx r14d, word [r13]
add r13, 2
mov eax, r14d
and eax, 0xf800
cmp ax, 0xd800
jne 0x140002fa8
mov ecx, 0xfffd
cmp r14w, 0xdbff
ja 0x140002fe8
cmp r13, rbx
je 0x140002fec
movzx eax, word [r13]
add r13, 2
mov edx, eax
add edx, 0x2000
cmp dx, 0xfc00
jb 0x140002ff3
movzx eax, ax
mov ecx, 0x3ff
and r14d, ecx
and eax, ecx
shl r14, 0x1a
shl eax, 0x10
or rax, r14
movabs rcx, 0x100000000
add rax, rcx
mov r14, rax
jmp 0x140002fac
shl r14d, 0x10
shr r14, 0x10
cmp r14d, 0x80
jae 0x140002fe1
mov rsi, qword [rbp - 8]
cmp rsi, qword [rbp - 0x18]
jne 0x140002fcb
mov rcx, r15
call fcn.14000dea8
mov rax, qword [rbp - 0x10]
mov byte [rax + rsi], r14b
inc rsi
mov qword [rbp - 8], rsi
xor esi, esi
jmp 0x140002f23
xor esi, esi
mov ecx, r14d
jmp 0x140002ff9
xor esi, esi
jmp 0x140002ff9
xor esi, esi
mov r13, rbx
jmp 0x140002ff9
mov si, 1
mov edi, eax
and dword [rbp - 0x24], 0
lea rdx, [rbp - 0x24]
call fcn.140001ed9
mov r15, rax
mov r14, rdx
mov rax, qword [rbp - 0x18]
mov r12, qword [rbp - 8]
sub rax, r12
cmp rax, rdx
jae 0x14000302f
lea rcx, [rbp - 0x18]
mov rdx, r12
mov r8, r14
call fcn.140033ca8
mov r12, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
add rcx, r12
mov rdx, r15
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, r12
mov qword [rbp - 8], r14
lea r15, [rbp - 0x18]
jmp 0x140002f23
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x38]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rcx], xmm0
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x20]
call fcn.140001ab2
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rdx, qword [rbp - 8]
mov rcx, rdi
call fcn.140033b20
int3
Function at 0x14001ef30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14001efb0
cmp r10, r11
jb 0x14001f027
cmp r10, rdx
ja 0x14001f039
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x14001efb2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14001ef90
jmp 0x14001f014
ja 0x14001efba
mov r11, r10
cmp rax, r8
jne 0x14001ef5e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14001eff0
mov rdi, r8
sub ecx, edx
jns 0x14001f00b
jmp 0x14001f016
cmp r8, rsi
je 0x14001f048
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14001f016
xor al, 1
cmp rdi, rsi
jne 0x14001efd0
jmp 0x14001f016
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400348b0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400345d0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140034920
int3

Function at 0x140023cf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140023d15
cmp rax, rcx
je 0x140023d1b
cmp rdx, 4
jae 0x140023d22
xor eax, eax
xor r8d, r8d
jmp 0x140023dc0
pop rbp
jmp fcn.14001c7a0
xor eax, eax
jmp 0x140023dd7
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400365a0]
movdqa xmm3, xmmword [0x1400365b0]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140023d50
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140023dd7
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140023dc0
pop rbp
ret
Function at 0x140029d60
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi

Function at 0x14002c1b0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
mov r8d, 0xe
call fcn.14002c5d0
mov rax, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
movabs rdi, 0x8000000000000000
cmp rax, rdi

Function at 0x14002d280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi

Function at 0x140031bf0
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
mov r9, rcx
mov ecx, 0xfffffff4
pop rbp
jmp fcn.1400277d0

Function at 0x140033540
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14003358a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003358a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003358a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003358a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003358a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003358c
xor al, al
add rsp, 0x28
ret
Function at 0x180002530
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a8c], 0xa
jl 0x180002562
mov eax, dword [0x180020a90]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002562
nop word cs:[rax + rax]
jmp 0x180002560
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
mov eax, dword [0x180020a78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a74], 0xa
setl r8b
mov edx, dword [0x180020a94]
lea edi, [rdx - 1]
imul edi, edx
test dil, 1
sete dl
cmp dword [0x180020a98], 0xa
setl r9b
mov r14, qword [rbx + 0x10]
lea r10, [rbx + 0x10]
cmp r14, r10
je 0x180002658
or r8b, al
or r9b, dl
lea r11, [rcx - 1]
xor eax, eax
mov rsi, r11
test r8b, r8b
je 0x180002640
nop
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x1800025d0
test r9b, r9b
je 0x180002650
sub rsi, rcx
je 0x180002652
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop word [rax + rax]
movzx edx, word [r15 + rbx*2]
movsx r13d, byte [rcx + rbx]
lea r12d, [rdx - 0x41]
lea ebp, [rdx + 0x20]
cmp r12w, 0x1a
cmovae ebp, edx
lea r12d, [r13 - 0x41]
lea edi, [r13 + 0x20]
cmp r12b, 0x1a
cmovae edi, r13d
cmp ebp, edi
jne 0x18000262d
test dx, dx
je 0x180002652
add rbx, 1
cmp rsi, rbx
jne 0x1800025f0
jmp 0x180002652
mov r14, qword [r14]
cmp r14, r10
jne 0x1800025c7
jmp 0x18000265a
jmp 0x180002640
jmp 0x180002650
mov rax, qword [r14 + 0x30]
jmp 0x18000265a
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140003ff0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
lea rdi, [rcx + 0x10]
mov qword [rsp + 0x40], rdi
mov rcx, qword [rdi]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 7
jb 0x1400041d8
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140004047
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 7
lea r9, str.mkdir__
lea rcx, [rsp + 0x48]
call fcn.140009c10
nop
mov r8d, 1
lea rdx, [0x14000d718]
lea rcx, [rsp + 0x48]
call fcn.140008590
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x80], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400040fe
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b640
lea rcx, [rsp + 0x70]
cmp qword [rsp + 0x88], 0xf
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x88]
cmp rdx, 0xf
jbe 0x14000415c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004156
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004156
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b640
nop
jmp 0x140004168
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000419e
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004199
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400041d1
mov rcx, r8
call fcn.14000b640
mov qword [rdi], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14000b030
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400011d0
nop
int3
Function at 0x140004590
Capabilities:
Execute command

Disassembly:
sub rsp, 0x98
mov rax, qword [0x140012040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, 0x11
jb 0x1400046f5
cmp qword [rcx + 0x18], 0xf
jbe 0x1400045ce
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x11
lea r9, str.taskkill__F__IM__
lea rcx, [rsp + 0x48]
call fcn.140009c10
nop
mov r8d, 5
lea rdx, str.___T
lea rcx, [rsp + 0x48]
call fcn.140008590
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14000467f
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000467a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000467a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b640
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x1400046dd
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400046d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b640
nop
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14000b030
add rsp, 0x98
ret
call fcn.1400011d0
nop
int3
Function at 0x14000a8ec
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14000a926
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14000a92b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14000a974
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14000d410]
cmp byte [rcx + rax], 0
je 0x14000a974
dec r8
sub rdx, 1
jne 0x14000a95a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14000bcc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bd0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bd0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bd0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bd0a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bd0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000bd0c
xor al, al
add rsp, 0x28
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x180002bd0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002c02
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002c02
nop word cs:[rax + rax]
jmp 0x180002c00
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002cd8
mov rsi, r10
test r8b, r8b
je 0x180002cf0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002c70
test r9b, r9b
je 0x180002d00
sub rsi, rcx
je 0x180002cd4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002cd0
test ebp, ebp
jne 0x180002cd0
add rbx, 1
cmp rsi, rbx
jne 0x180002c90
jmp 0x180002cd4
test ebp, ebp
jne 0x180002c5c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002cf0
jmp 0x180002d00
Function at 0x1800022b0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800022e2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800022e2
nop word cs:[rax + rax]
jmp 0x1800022e0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x1800023b8
mov rsi, r10
test r8b, r8b
je 0x1800023d0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002350
test r9b, r9b
je 0x1800023e0
sub rsi, rcx
je 0x1800023b4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800023b0
test ebp, ebp
jne 0x1800023b0
add rbx, 1
cmp rsi, rbx
jne 0x180002370
jmp 0x1800023b4
test ebp, ebp
jne 0x18000233c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1800023d0
jmp 0x1800023e0
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
xor esi, esi
lea rdx, [0x14002b874]
mov r15d, esi
mov rdi, r8
mov rbx, rcx
mov r13d, 0xffffffff
call fcn.140004460
mov r12, rax
test rax, rax
jne 0x1400010a9
lea rdx, [r14 + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002700
jmp 0x1400011ca
mov edx, dword [r14 + 4]
xor r8d, r8d
add rdx, qword [rbx + 0x1000]
mov rcx, r12
call fcn.1400100b4
test eax, eax
jns 0x1400010e6
call fcn.1400148e8
lea r9, [r14 + 0x12]
lea r8, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
mov edx, dword [rax]
call fcn.140002900
jmp 0x1400011ac
mov ecx, dword [r14 + 0xc]
call fcn.140014924
mov r15, rax
test rax, rax
jne 0x140001122
mov ebx, dword [r14 + 0xc]
call fcn.1400148e8
lea r9, [r14 + 0x12]
mov dword [rsp + 0x20], ebx
lea r8, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
mov edx, dword [rax]
call fcn.140002900
jmp 0x1400011ac
cmp byte [r14 + 0x10], 1
jne 0x14000113c
mov r9, r15
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call fcn.140001210
jmp 0x14000119d
mov ebx, dword [r14 + 0xc]
mov qword [rsp + 0x60], rbp
mov rbp, r15
test rbx, rbx
je 0x140001191
mov eax, 0x2000
nop dword [rax]
nop word [rax + rax]
cmp rbx, rax
mov rdi, rbx
mov r9, r12
mov r8d, 1
cmova rdi, rax
mov rcx, rbp
mov rdx, rdi
call fcn.14000fd7c
cmp rax, 1
jb 0x1400011ed
add rbp, rdi
mov eax, 0x2000
sub rbx, rdi
jne 0x140001160
mov eax, esi
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
test eax, eax
je 0x1400011ac
mov rcx, r15
call fcn.140014910
mov r15, rsi
mov rcx, r12
call fcn.14000fa2c
mov rsi, r15
test r15, r15
je 0x1400011ca
mov rdx, rdi
mov rcx, r15
call fcn.140004590
mov r13d, eax
mov rcx, rsi
call fcn.140014910
mov rbx, qword [rsp + 0x68]
mov eax, r13d
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400148e8
lea r9, [r14 + 0x12]
lea r8, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov edx, dword [rax]
call fcn.140002900
mov eax, r13d
jmp 0x140001193