joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14074a080
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14074a207
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14074a0b1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14074a097
add dl, dl
jne 0x14074a0be
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14074a11e
xor eax, eax
add dl, dl
jne 0x14074a0cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14074a1d5
add dl, dl
jne 0x14074a0de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14074a0eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14074a0f8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14074a105
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14074a112
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14074a0a6
mov eax, 1
add dl, dl
jne 0x14074a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14074a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14074a123
sub eax, ebx
mov ebx, 1
jne 0x14074a174
mov ecx, 1
add dl, dl
jne 0x14074a156
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14074a163
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14074a14b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14074a0a6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14074a190
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14074a19d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14074a185
cmp eax, 0x7d00
jae 0x14074a1c3
cmp eax, 0x500
jb 0x14074a1be
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14074a0a6
cmp eax, 0x7f
ja 0x14074a1c6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14074a0a6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14074a1fa
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14074a0a6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400b4e04
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1400b4e32
xor eax, eax
jmp 0x1400b4f18
cmp qword [rcx + 0x68], 0
je 0x1400b4e43
call fcn.1400b4f34
jmp 0x1400b4f18
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400b4e5a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400b4e5c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400b4e8e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400b7700
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1400b4f12
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400b4ec5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400b4eee
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400c2978
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1400b4f12
cmp rsi, rbx
ja 0x1400b4ecc
test rsi, rsi
je 0x1400b4f12
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400c2978
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400b65d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b6622
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b6622
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b6622
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b6622
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b6622
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b6624
xor al, al
add rsp, 0x28
ret

Function at 0x1400c4e60
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400c4c5c
Function at 0x1400cd2b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400b5930
sub rsp, rax
mov rax, qword [0x1400ea038]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400c9cf4
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400cd2ff
mov rax, rbp
jmp 0x1400cd407
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xec440]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400ce3d0
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0xec440]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400cd403
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400cd403
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400ce3d0
test rax, rax
js 0x1400cd403
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400cd403
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400cd3f5
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400cd3f5
cmp byte [rcx], 0xd
jne 0x1400cd3db
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400cd3ea
cmp byte [rcx + 1], 0xa
jne 0x1400cd3ea
inc rcx
jmp 0x1400cd3ea
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xea440]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400cd3bd
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400cd407
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400b5990
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400cd628
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400cd63e
mov al, 1
jmp 0x1400cd69e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400cd64f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400cd69c
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400d09bc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400cd69c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400cd69c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400cd69c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400cd69e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400cd770
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400ec440]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400cd7c7
cmp word [rdx], r13w
jne 0x1400cd7c7
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400cd7cc
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400cd8f1
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400cd912
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400cd805
mov rdx, r9
mov word [rbx], cx
jmp 0x1400cd82c
cmp r9, r8
jae 0x1400cd83c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400cd7e6
jmp 0x1400cd8f1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400cd8e6
cmp dword [rsp + 0x80], esi
je 0x1400cd8e6
lea r8, [0x1400ec440]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400cd8be
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400cd88e
mov word [rbx], r13w
jmp 0x1400cd8ee
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400cd89b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400cd8ee
cmp word [rsp + 0x70], r13w
jne 0x1400cd8cb
cmp rbx, r14
je 0x1400cd888
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400ce3d8
cmp word [rsp + 0x70], r13w
je 0x1400cd8f1
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400ec440]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400cd8eb
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400cd8f1
Function at 0x1400d0154
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400d0184
xor eax, eax
jmp 0x1400d0247
mov rbp, rbx
cmp word [rax], si
je 0x1400d01a9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400d0190
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400d018c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400ce988
movsxd r14, eax
test eax, eax
jne 0x1400d01e7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400d017d
mov rcx, r14
call fcn.1400c8084
mov rdi, rax
test rax, rax
jne 0x1400d0200
xor ecx, ecx
call fcn.1400c8048
jmp 0x1400d01dc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400ce988
test eax, eax
jne 0x1400d0231
mov rcx, rdi
call fcn.1400c8048
jmp 0x1400d023b
xor ecx, ecx
call fcn.1400c8048
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400d2f10
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400c7aa4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400d2fb1
cmp ebx, dword [rsp + 0x30]
je 0x1400d2faa
test esi, esi
je 0x1400d2faa
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400d2f85
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400d2f92
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400d2f6f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400d2f96
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400d2fb3
mov eax, 1
jmp 0x1400d2fb3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d5e04
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400bc20c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400d5e8e
cmp byte [rbp - 0x21], r15b
je 0x1400d5e89
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400d5ec4
call fcn.1400ca3c4
test eax, eax
jne 0x1400d5eb0
cmp byte [rbp - 0x21], r15b
je 0x1400d5ea8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400d5ec4
cmp byte [rbp - 0x21], r15b
je 0x1400d5ec1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400c3b04
test eax, eax
jne 0x1400d5f64
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400bc20c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400d5f03
cmp byte [rbp - 0x21], r15b
je 0x1400d5f38
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400d5f38
call fcn.1400ca3c4
test eax, eax
jne 0x1400d5f24
cmp byte [rbp - 0x21], r15b
je 0x1400d5f1d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400d5f38
cmp byte [rbp - 0x21], r15b
je 0x1400d5f35
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400c3b04
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400d5f64
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400d5f67
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400d5f75
mov rcx, rdi
call fcn.1400c8048
cmp byte [rbp + 0x3f], r15b
je 0x1400d5f84
mov rcx, qword [rbp + 0x27]
call fcn.1400c8048
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400d7b80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400d7ba8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400d7ba8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1406b4108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406b428f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406b4139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b411f
add dl, dl
jne 0x1406b4146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b41a6
xor eax, eax
add dl, dl
jne 0x1406b4155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406b425d
add dl, dl
jne 0x1406b4166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b4173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b4180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b418d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406b419a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406b412e
mov eax, 1
add dl, dl
jne 0x1406b41b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406b41c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b41ab
sub eax, ebx
mov ebx, 1
jne 0x1406b41fc
mov ecx, 1
add dl, dl
jne 0x1406b41de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b41eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b41d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b412e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406b4218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406b4225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406b420d
cmp eax, 0x7d00
jae 0x1406b424b
cmp eax, 0x500
jb 0x1406b4246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b412e
cmp eax, 0x7f
ja 0x1406b424e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406b412e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406b4282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406b412e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
lahf
push 0x2c
invalid
Function at 0x14000d970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov edi, edx
and edi, 7
je 0x14000d9cd
cmp edx, edi
jge 0x14000d9c3
mov r9, qword [rcx + 8]
mov r10d, dword [rcx + 0x14]
mov rax, qword [rbx]
cmp rax, r9
jb 0x14000d99f
xor cl, cl
jmp 0x14000d9a8
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
mov ecx, edx
shl eax, cl
add edx, 8
or eax, r10d
mov dword [rbx + 0x10], edx
mov dword [rbx + 0x14], eax
mov r10d, eax
cmp edx, 0x18
jle 0x14000d993
mov ecx, edi
shr dword [rbx + 0x14], cl
sub edx, edi
mov dword [rbx + 0x10], edx
xor r9d, r9d
mov ecx, edx
test edx, edx
jle 0x14000da0e
mov eax, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r10d, al
nop dword [rax]
nop word [rax + rax]
shr eax, 8
inc r9d
mov byte [rdx], r10b
lea rdx, [rdx + 1]
sub ecx, 8
mov dword [rbx + 0x14], eax
movzx r10d, al
test ecx, ecx
jg 0x14000d9f0
mov dword [rbx + 0x10], ecx
movsxd rcx, r9d
cmp rcx, 4
jge 0x14000da42
mov r8, qword [rbx + 8]
nop dword [rax + rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14000da2c
xor dl, dl
jmp 0x14000da35
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14000da20
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
je 0x14000da8a
lea rax, str.zlib_corrupt
mov qword [0x1400a4630], rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14000dab4
lea rax, str.read_past_buffer
mov qword [0x1400a4630], rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x14000dace
mov rcx, rbx
call fcn.14000d0a0
test eax, eax
je 0x14000da7d
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret