joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401faa80
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1401faabd
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.1401f99d4
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1401fabbc
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1401f99d4
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x1401fab30
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.14002b430
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x1401fabfb
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401fabfb
call fcn.1401f99dc
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x1401fabe2
mov rcx, r14
call fcn.1401f99dc
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x14087f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14087f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14087f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14087f06f
add dl, dl
jne 0x14087f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14087f0f6
xor eax, eax
add dl, dl
jne 0x14087f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14087f1ad
add dl, dl
jne 0x14087f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14087f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14087f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14087f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14087f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14087f07e
mov eax, 1
add dl, dl
jne 0x14087f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14087f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14087f0fb
sub eax, ebx
mov ebx, 1
jne 0x14087f14c
mov ecx, 1
add dl, dl
jne 0x14087f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14087f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14087f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14087f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14087f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14087f15d
cmp eax, 0x7d00
jae 0x14087f19b
cmp eax, 0x500
jb 0x14087f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087f07e
cmp eax, 0x7f
ja 0x14087f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14087f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14087f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002340
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400059c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000235f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002368
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002520
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r8d, 0x2c
mov ecx, 2
lea rdx, str._stack_smashing_detected_:_terminated_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x140002550
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x140002b80
Capabilities:
Get local ipv4 addresses

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, qword [0x140005a90]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rbp]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rsi, [rsp + 0x3c]
xor eax, eax
mov rdi, rcx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov dword [rsp + 0x3c], eax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
je 0x140002bca
xor eax, eax
jmp 0x140002c4c
mov edx, dword [rsp + 0x3c]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rbx, rax
je 0x140002bc3
mov qword [rsp + 0x20], rsi
mov r9, rax
xor r8d, r8d
xor edx, edx
lea r12, [rsp + 0x42]
xor ecx, ecx
mov rsi, rbx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp dword [rsi + 0x58], 6
jne 0x140002c35
mov eax, dword [rsi + 0x50]
mov r8d, 3
mov rdx, r12
mov rcx, rdi
mov dword [rsp + 0x42], eax
mov ax, word [rsi + 0x54]
mov word [rsp + 0x46], ax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x140002c35
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
jmp 0x140002c4c
mov rsi, qword [rsi + 8]
test rsi, rsi
jne 0x140002bfd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002bc3
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rbp]
je 0x140002c5c
call fcn.140002520
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140002d00
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [0x140005a90]
mov rsi, qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rcx, [rsp + 0x28]
call rsi
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x30]
call rsi
mov edx, dword [rsp + 0x30]
xor eax, eax
cmp dword [rsp + 0x28], edx
jne 0x140002d4e
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x2c], eax
sete al
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rbx]
je 0x140002d5d
call fcn.140002520
add rsp, 0x48
pop rbx
pop rsi
ret
Function at 0x140002d70
Capabilities:
Enumerate processes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x160
mov rdi, qword [0x140005a90]
xor edx, edx
mov rax, qword [rdi]
mov qword [rsp + 0x158], rax
xor eax, eax
mov rsi, rcx
mov ecx, 2
mov dword [rsp + 0x28], 0x238
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rbp, [rsp + 0x28]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32First
lea r12, [rsp + 0x54]
test eax, eax
jne 0x140002dc8
xor eax, eax
jmp 0x140002dea
mov rdx, rbp
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140002dc4
mov rdx, rsi
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
test eax, eax
jne 0x140002dc8
mov eax, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x158]
sub rdx, qword [rdi]
je 0x140002dfc
call fcn.140002520
add rsp, 0x160
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140002e10
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [0x140005a90]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x48], 1
setbe al
mov rdx, qword [rsp + 0x58]
sub rdx, qword [rbx]
je 0x140002e48
call fcn.140002520
add rsp, 0x60
pop rbx
ret

Function at 0x140002e50
Capabilities:
Get local ipv4 addresses

Disassembly:
sub rsp, 0x28
lea rcx, [0x140005090]
call fcn.140002b80
test al, al
jne 0x140002ec4
lea rcx, [0x140005094]
call fcn.140002b80
test al, al
jne 0x140002ec4
lea rcx, [0x140005098]
call fcn.140002b80
test al, al
jne 0x140002ec4
lea rcx, [0x14000509c]
call fcn.140002b80
test al, al
jne 0x140002ec4
lea rcx, [0x1400050a0]
call fcn.140002b80
test al, al
jne 0x140002ec4
lea rcx, [0x1400050a4]
call fcn.140002b80
test al, al
jne 0x140002ec4
lea rcx, [0x1400050a8]
add rsp, 0x28
jmp fcn.140002b80
mov al, 1
add rsp, 0x28
ret

Function at 0x140002ed0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, qword [0x140005a90]
mov rax, qword [rbx]
mov qword [rsp + 0x68], rax
xor eax, eax
mov dword [rsp + 0x28], 0x40
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rsp + 0x30], 0x7fffffff
setbe al
mov rdx, qword [rsp + 0x68]
sub rdx, qword [rbx]
je 0x140002f14
call fcn.140002520
add rsp, 0x70
pop rbx
ret
Function at 0x140003140
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rbx, qword [0x140005a90]
lea rsi, section..rdata
mov rax, qword [rbx]
mov qword [rsp + 0x248], rax
xor eax, eax
lea rdi, [rsp + 0x28]
mov r9, rcx
mov ecx, 8
rep movsd dword [rdi], dword [rsi]
lea r10, [rsp + 0x148]
mov r11, rdx
lea rbp, [rsp + 0x48]
mov rdx, rax
mov byte [rax + r10], al
inc rax
and edx, 0x1f
mov dl, byte [rsp + rdx + 0x28]
mov byte [rax + rbp - 1], dl
cmp rax, 0x100
jne 0x14000318b
mov r12, r10
xor esi, esi
xor r13d, r13d
mov edi, 0x100
movzx eax, byte [r12]
movzx edx, byte [rbp + rsi]
inc rsi
add eax, r13d
add eax, edx
cdq
idiv edi
movsxd rcx, edx
mov rdx, r12
inc r12
mov r13, rcx
add rcx, r10
call fcn.140002af0
cmp rsi, 0x100
jne 0x1400031b5
lea rdi, [r9 + r11]
xor ebp, ebp
xor r12d, r12d
cmp rdi, r9
je 0x140003245
lea eax, [rbp + 1]
cdq
idiv esi
movsxd r13, edx
movzx eax, byte [rsp + r13 + 0x148]
lea rcx, [r10 + r13]
mov rbp, r13
add eax, r12d
cdq
idiv esi
movsxd r14, edx
lea rdx, [r10 + r14]
mov r12, r14
call fcn.140002af0
mov cl, byte [rsp + r14 + 0x148]
add cl, byte [rsp + r13 + 0x148]
movzx ecx, cl
mov al, byte [rsp + rcx + 0x148]
xor byte [r9], al
inc r9
jmp 0x1400031f0
mov rax, qword [rsp + 0x248]
sub rax, qword [rbx]
je 0x140003257
call fcn.140002520
mov rax, r11
add rsp, 0x250
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140003400
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x20]
mov rsi, rcx
test rbx, rbx
je 0x140003443
cmp word [rbx + 0x48], 0
je 0x140003441
mov rcx, qword [rbx + 0x50]
mov rdx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsicmp
test eax, eax
jne 0x14000343c
mov rbx, qword [rbx + 0x20]
jmp 0x140003443
mov rbx, qword [rbx]
jmp 0x14000341a
xor ebx, ebx
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140003450
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor eax, eax
cmp word [rcx], 0x5a4d
mov rbx, rcx
mov rbp, rdx
jne 0x1400034d1
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400034d1
mov edi, dword [rdx + 0x88]
xor esi, esi
add rdi, rcx
mov r12d, dword [rdi + 0x20]
mov r13d, dword [rdi + 0x14]
add r12, rcx
cmp esi, r13d
jae 0x1400034cf
mov edx, dword [r12 + rsi*4]
mov rcx, rbp
add rdx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov edx, eax
lea rax, [rsi + 1]
test edx, edx
jne 0x1400034ca
mov eax, dword [rdi + 0x24]
add rsi, rsi
add rsi, rbx
movzx edx, word [rsi + rax]
mov eax, dword [rdi + 0x1c]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
jmp 0x1400034d1
mov rsi, rax
jmp 0x140003490
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1400106f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x140010721
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1400107c2
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140010794
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14001078f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001086b
mov rcx, r8
call fcn.140016628
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400160f0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140010807
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140010803
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400107fe
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001086b
mov rcx, r8
call fcn.140016628
xor al, al
jmp 0x140010796
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0xb0000
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400300c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140010854
cmp rax, 7
jbe 0x140010803
lea rdx, [rax*2 + 2]
jmp 0x1400107da
cmp rax, 7
jbe 0x140010794
lea rdx, [rax*2 + 2]
jmp 0x140010767
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140010880
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x1400108b1
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140010952
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140010924
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14001091f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400109fb
mov rcx, r8
call fcn.140016628
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400160f0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140010997
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140010993
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14001098e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400109fb
mov rcx, r8
call fcn.140016628
xor al, al
jmp 0x140010926
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x3f38
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400e00c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x1400109e4
cmp rax, 7
jbe 0x140010993
lea rdx, [rax*2 + 2]
jmp 0x14001096a
cmp rax, 7
jbe 0x140010924
lea rdx, [rax*2 + 2]
jmp 0x1400108f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140011e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
lea r8, [rbp + 0x47]
lea rcx, [0x1400e4738]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
jne 0x140011e74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp dword [rbp + 0x47], 0
je 0x140011eb2
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x72657375
mov dword [rbp - 0x15], 0x642e3233
mov word [rbp - 0x11], 0x6c6c
mov byte [rbp - 0xf], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
lea rcx, [0x1400e4738]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x140011f2d
movdqa xmm0, xmmword [0x140020830]
lea rcx, [rbp - 0x19]
movdqa xmm1, xmmword [0x1400208a0]
mov word [rbp + 0x3f], 0x7363
movzx eax, word [rbp + 0x3f]
mov word [rbp + 0x17], ax
movups xmmword [rbp - 9], xmm0
mov byte [rbp + 0x19], 0
movups xmmword [rbp + 7], xmm1
mov dword [rbp - 0x19], 0x336e6977
mov dword [rbp - 0x15], 0x642e7532
mov word [rbp - 0x11], 0x6c6c
mov byte [rbp - 0xf], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
call rax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400160f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
call fcn.1400160d0
int3

Function at 0x140012890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9, qword [rcx + 8]
mov r8, qword [r9 + 0x48]
test r8, r8
je 0x1400128ae
mov r9, qword [r9 + 0x70]
mov edx, 0x11
lea ecx, [rdx - 8]
jmp fcn.1400131a0
mov r8, qword [r9 + 0x50]
test r8, r8
je 0x1400128c8
mov r9, qword [r9 + 0x70]
mov edx, 0x12
lea ecx, [rdx - 9]
jmp fcn.1400131a0
mov r8, qword [r9 + 0x58]
test r8, r8
je 0x1400128e2
mov r9, qword [r9 + 0x70]
mov edx, 0x13
lea ecx, [rdx - 0xa]
jmp fcn.1400131a0
mov r8, qword [r9 + 0x60]
test r8, r8
je 0x1400128fc
mov r9, qword [r9 + 0x70]
mov edx, 0x14
lea ecx, [rdx - 0xb]
jmp fcn.1400131a0
mov r8, qword [rcx]
mov eax, dword [r8]
cmp eax, 0x80000003
jne 0x140012910
mov edx, 0x15
jmp 0x14001292a
cmp eax, 0x80000004
jne 0x14001291e
mov edx, 0x16
jmp 0x14001292a
cmp eax, 0x80000001
jne 0x14001293c
mov edx, 0x17
mov r9, qword [r8 + 0x28]
mov ecx, 9
mov r8, qword [r8 + 0x10]
jmp fcn.1400131a0
ret
Function at 0x140012a60
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x140012a7e
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x140012a82
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movaps xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movaps xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movaps xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movaps xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movaps xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movaps xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret

Function at 0x140012ac0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x140012b04
nop word [rax + rax]
cmp qword [rax + 0x30], rcx
je 0x140012aef
mov rax, qword [rax]
test rax, rax
jne 0x140012ae0
ret
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
ret

Function at 0x140012b10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x140012b21
mov ecx, edx
jmp 0x140012b66
mov ecx, 1
call fcn.140012970
mov rcx, rax
call fcn.140012b90
mov rcx, rax
mov rdx, rbx
call fcn.140012c20
test rax, rax
jne 0x140012b83
lea ecx, [rax + 3]
call fcn.140012970
mov rcx, rax
call fcn.140012b90
mov rcx, rax
mov rdx, rbx
call fcn.140012c20
test rax, rax
jne 0x140012b83
lea ecx, [rax + 2]
call fcn.140012970
mov rcx, rax
call fcn.140012b90
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.140012c20
add rsp, 0x20
pop rbx
ret

Function at 0x140012c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r11, rcx
mov rbx, rdx
mov ecx, dword [rax + rcx + 0x88]
add rcx, r11
mov esi, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x24]
add rsi, r11
add rbp, r11
cmp rdx, 0xffff
ja 0x140012c74
sub bx, word [rcx + 0x10]
movzx eax, bx
cmp eax, dword [rcx + 0x14]
jae 0x140012cae
movzx eax, bx
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140012cb0
mov r10d, dword [rcx + 0x20]
xor r9d, r9d
mov edi, dword [rcx + 0x18]
add r10, r11
test edi, edi
je 0x140012cae
nop word [rax + rax]
mov edx, dword [r10]
mov rcx, rbx
add rdx, r11
call 0x140015090
test eax, eax
je 0x140012cc5
inc r9d
add r10, 4
cmp r9d, edi
jb 0x140012c90
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x140012cb0
Function at 0x140012f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [0x140020950]
lea rcx, [rbp - 0x30]
xor edx, edx
mov dword [rbp - 0x20], 0x74706563
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x1c], 0x486e6f69
mov dword [rbp - 0x18], 0x6c646e61
mov word [rbp - 0x14], 0x7265
mov byte [rbp - 0x12], 0
call fcn.140012b10
lea rdx, [0x140012f40]
mov ecx, 1
call rax
movdqa xmm0, xmmword [0x140020910]
lea rcx, [rbp - 0x30]
xor edx, edx
mov qword [rbp - 0x10], 0
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x69666974
mov dword [rbp - 0x1c], 0x69746163
mov word [rbp - 0x18], 0x6e6f
mov byte [rbp - 0x16], 0
call fcn.140012b10
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x140012940]
xor ecx, ecx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400160f0
add rsp, 0x50
pop rbp
ret
Function at 0x140014b80
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 8
movzx r11d, byte [rcx]
xor r10d, r10d
mov r8d, r10d
mov r9d, r10d
cmp r11b, 0xcc
je 0x140014bc4
mov qword [rsp], rbx
mov ebx, r10d
nop
cmp r11b, byte [rbx + rdx]
lea eax, [r8 + 1]
cmovne eax, r8d
inc r9d
mov r8d, eax
mov ebx, r9d
movzx r11d, byte [r9 + rcx]
cmp r11b, 0xcc
jne 0x140014ba0
mov rbx, qword [rsp]
cmp r8d, r9d
sete r10b
mov eax, r10d
add rsp, 8
ret