joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3260af200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260af2fd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3216997274b0f5de
mov qword [rsp + 0x39], rdx
movabs rdx, 0xd76e237269767732
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd9bfc62cc612d70f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1408000c1106150c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x11314061205020f
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1502000c07130113
mov qword [rsp + 0x29], rdx
movabs rdx, 0x11116060e130c10
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x3260af2a0
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 - 0x36]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 - 0x36]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x3260af2cd
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x3260af2f0
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x3260af27f
jmp 0x3260af2e4
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.32601d600
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.326033020
mov eax, edi
mov ecx, 0x17
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.3260af200

Function at 0x3260afaa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260afbcc
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x8a61848765758366
mov qword [rsp + 0x3d], rdx
movabs rdx, 0x5a205b8a61848765
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20256f8c206c657d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x59913d6f707b2e6f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x3a6e576c7250567a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x40619060f071502
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1a14010b04061906
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x110d14201b150411
mov qword [rsp + 0x25], rdx
movabs rdx, 0x131e05061d0a2218
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x1e1805191c0a081b
mov qword [rsp + 0x35], rdx
xor eax, eax
jmp 0x3260afb66
movzx r9d, byte [rsp + rsi + 0x3d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x26]
mov byte [rsp + rdi + 0x3d], dl
mov byte [rsp + rsi + 0x3d], r8b
add rax, 2
cmp rax, 0x24
jge 0x3260afb9c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x23
jae 0x3260afbbf
movzx r8d, byte [rsp + rdi + 0x3d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x26]
cmp rsi, 0x23
jb 0x3260afb4c
jmp 0x3260afbb3
xor eax, eax
lea rbx, [rsp + 0x3d]
mov ecx, 0x23
call fcn.32601d600
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.326033020
mov eax, edi
mov ecx, 0x23
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260afaa0
Function at 0x3260b1f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260b2058
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x74631970204f6e20
mov qword [rsp + 0x46], rdx
movabs rdx, 0x646574631970204f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4af850b86e062afd
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc5136fe83e656e67
mov qword [rsp + 0x58], rdx
movabs rdx, 0xfd18726972725b1a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x210a02150f0e1620
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1a1e1e1a00121b0f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x210190b030b1a1e
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc1115101b0c200c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe11020e16050b05
mov qword [rsp + 0x36], rdx
movabs rdx, 0x319160b0e181618
mov qword [rsp + 0x3e], rdx
xor eax, eax
jmp 0x3260b1ff5
movzx r9d, byte [rsp + rsi + 0x46]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xe]
mov byte [rsp + rdi + 0x46], dl
mov byte [rsp + rsi + 0x46], r8b
add rax, 2
cmp rax, 0x2e
jge 0x3260b2028
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x3260b204b
movzx r8d, byte [rsp + rdi + 0x46]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xe]
nop
cmp rsi, 0x22
jb 0x3260b1fdb
jmp 0x3260b203f
xor eax, eax
lea rbx, [rsp + 0x46]
mov ecx, 0x22
call fcn.32601d600
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.326033020
mov eax, edi
mov ecx, 0x22
call fcn.326033020
nop
call fcn.326030d20
nop dword [rax]
jmp fcn.3260b1f20

Function at 0x3260b4fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260b50e7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x63a8fb6f08658e1f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x651f9108652541db
mov qword [rsp + 0x50], rdx
movabs rdx, 0x438eee1e966f7759
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1381f874ef659713
mov qword [rsp + 0x60], rdx
movabs rdx, 0x11b1e03051d0e0e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x191b0e0d10030609
mov qword [rsp + 0x24], rdx
movabs rdx, 0x15101516191b0e0d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x606081f15030917
mov qword [rsp + 0x30], rdx
movabs rdx, 0x130e0c0114090e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1f0a1f00181b1418
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x3260b5089
movzx r9d, byte [rsp + rsi + 0x48]
sub r9d, edx
lea edx, [r9 - 0x78]
mov byte [rsp + rdi + 0x48], dl
lea edx, [r8 - 0x78]
mov byte [rsp + rsi + 0x48], dl
add rax, 2
cmp rax, 0x2c
jge 0x3260b50b7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x20
jae 0x3260b50da
movzx r8d, byte [rsp + rdi + 0x48]
sub r8d, edx
cmp rsi, 0x20
jb 0x3260b506c
jmp 0x3260b50ce
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x20
call fcn.32601d600
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.326033020
mov eax, edi
mov ecx, 0x20
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260b4fc0
Function at 0x3260b5100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260b5227
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x63a8fb6f08658e1f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x651f9108652541db
mov qword [rsp + 0x50], rdx
movabs rdx, 0x438eee1e966f7759
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1381f874ef659713
mov qword [rsp + 0x60], rdx
movabs rdx, 0x11b1e03051d0e0e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x191b0e0d10030609
mov qword [rsp + 0x24], rdx
movabs rdx, 0x15101516191b0e0d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x606081f15030917
mov qword [rsp + 0x30], rdx
movabs rdx, 0x130e0c0114090e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1f0a1f00181b1418
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x3260b51c9
movzx r9d, byte [rsp + rsi + 0x48]
sub r9d, edx
lea edx, [r9 - 0x78]
mov byte [rsp + rdi + 0x48], dl
lea edx, [r8 - 0x78]
mov byte [rsp + rsi + 0x48], dl
add rax, 2
cmp rax, 0x2c
jge 0x3260b51f7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x20
jae 0x3260b521a
movzx r8d, byte [rsp + rdi + 0x48]
sub r8d, edx
cmp rsi, 0x20
jb 0x3260b51ac
jmp 0x3260b520e
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x20
call fcn.32601d600
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.326033020
mov eax, edi
mov ecx, 0x20
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260b5100

Function at 0x3260b5340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260b5418
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x3c64f8065f76e769
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x2afabb70
movabs rdx, 0xa05030701010b07
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x40b0a0503070101
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x30301090a0b0504
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x3260b53b7
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x12
jge 0x3260b53e8
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x3260b540b
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
nop dword [rax]
cmp rsi, 0xc
jb 0x3260b539a
jmp 0x3260b53ff
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.326033020
mov eax, edi
mov ecx, 0xc
call fcn.326033020
nop
call fcn.326030d20
nop dword [rax]
jmp fcn.3260b5340
Function at 0x3260b65c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260b66dd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x446e726cd1dc6103
mov qword [rsp + 0x41], rdx
movabs rdx, 0xd46efae474df6f63
mov qword [rsp + 0x49], rdx
movabs rdx, 0x996df8ec787563d4
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf16f65617261f185
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa1517030c0710
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x70a000a1517030c
mov qword [rsp + 0x21], rdx
movabs rdx, 0x1e0a1c1010120d0f
mov qword [rsp + 0x29], rdx
movabs rdx, 0x111e0f0216100204
mov qword [rsp + 0x31], rdx
movabs rdx, 0x21714131c021e18
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x3260b6680
movzx r9d, byte [rsp + rsi + 0x41]
sub r9d, edx
lea edx, [r9 - 0x5f]
mov byte [rsp + rdi + 0x41], dl
lea edx, [r8 - 0x5f]
mov byte [rsp + rsi + 0x41], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x3260b66ad
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x3260b66d0
movzx r8d, byte [rsp + rdi + 0x41]
sub r8d, edx
cmp rsi, 0x1f
jb 0x3260b665d
jmp 0x3260b66c4
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.32601d600
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.326033020
mov eax, edi
mov ecx, 0x1f
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.3260b65c0

Function at 0x3260c1540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260c160c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x807944ceaa284f97
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x6e436480
movabs rdx, 0x6070400030a0304
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x10a0704080607
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x3260c15a5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x3260c15dc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x3260c15ff
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x37]
cmp rsi, 0xb
jb 0x3260c158b
jmp 0x3260c15f3
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.326033020
mov eax, edi
mov ecx, 0xb
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260c1540
Function at 0x3260c1620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260c16dd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf36854ae453c2195
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x8f
movabs rdx, 0x708060002040202
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x8020804
xor eax, eax
nop
jmp 0x3260c1680
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x39]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x39]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x3260c16ad
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x3260c16d0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x3260c1662
jmp 0x3260c16c4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.3260c1620

Function at 0x3260c1700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260c17bd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbcda49537f104dd7
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xec
movabs rdx, 0x207030603060007
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x30800
xor eax, eax
nop
jmp 0x3260c1760
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x42]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x42]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x3260c178d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x3260c17b0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x3260c1742
jmp 0x3260c17a4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.3260c1700
Function at 0x3260c22a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260c238a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x37655272337c7e30
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x3837655272337c7e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7057657b886a459a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0b040a01060c0b
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc0210090f060b0b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb0d020601060905
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x3260c232d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 1]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 1]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jge 0x3260c235a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x3260c237d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x3260c2310
jmp 0x3260c2371
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.32601d600
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.326033020
mov eax, edi
mov ecx, 0x11
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260c22a0

Function at 0x3260c8640
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.3260c9a60
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.3260c9a60
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x3260c86b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x32626a864]
mov r12, rcx
test ebx, ebx
jle 0x3260c87e0
mov rax, qword [0x32626a868]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x3260c86fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x3260c8783
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x3260c86e0
mov rcx, r12
call fcn.3260c8e30
mov rsi, rax
test rax, rax
je 0x3260c8802
mov rax, qword [0x32626a868]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.3260c8f60
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x32626a868]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x3260c87e7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x3260c877c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x3260c8790
add dword [0x32626a864], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x32626a868]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x3260c877c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.3260c8640
nop dword [rax]
xor ebx, ebx
jmp 0x3260c8707
mov rax, qword [0x32626a868]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.3260c8640
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.3260c8640
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x3260c8aa0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x32626a8a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x32626a880]
test rbx, rbx
je 0x3260c8af4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x3260c8aeb
test r12, r12
je 0x3260c8aeb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x3260c8ad0
lea rcx, [0x32626a8a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x3260c8e30
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x3261d6f80]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x3260c8e50
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x3260c8e58
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3260c8e50
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x3260c8ea5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x3260c8e9c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x3260c8e50
add rax, 0x28
cmp rax, r9
jne 0x3260c8e88
xor eax, eax
ret

Function at 0x3260c8eb0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3261d6f80]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x3260c8ed0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x3260c8ed8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x3260c8ed0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x3260c8f60
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3261d6f80]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x3260c8f80
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x3260c8f88
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x140806a20
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140806ba7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140806a51
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140806a37
add dl, dl
jne 0x140806a5e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140806abe
xor eax, eax
add dl, dl
jne 0x140806a6d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140806b75
add dl, dl
jne 0x140806a7e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140806a8b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140806a98
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140806aa5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140806ab2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140806a46
mov eax, 1
add dl, dl
jne 0x140806ace
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140806adb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140806ac3
sub eax, ebx
mov ebx, 1
jne 0x140806b14
mov ecx, 1
add dl, dl
jne 0x140806af6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140806b03
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140806aeb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140806a46
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140806b30
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140806b3d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140806b25
cmp eax, 0x7d00
jae 0x140806b63
cmp eax, 0x500
jb 0x140806b5e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140806a46
cmp eax, 0x7f
ja 0x140806b66
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140806a46
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140806b9a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140806a46
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0xbf43b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xbf43bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xbf43cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xbf43b5
lea eax, [rcx + 1]
jmp 0xbf43db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xbf43ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xbf43d4
sub eax, 3
jb 0xbf440e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xbf445d
sar eax, 1
movsxd rbp, eax
jb 0xbf4444
jmp 0xbf441c
add ebx, ebx
jne 0xbf441a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbf4444
inc ecx
add ebx, ebx
jne 0xbf442a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xbf4444
call r11
adc ecx, ecx
add ebx, ebx
jne 0xbf443d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xbf442c
add ecx, 2
jmp 0xbf4449
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00bf4372
jmp 0xbf43bd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x329800
mov dl, 0x62
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xbf44a9
cmp rsi, rcx
jae 0xbf44b1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xbf4490
cmp al, 0x8f
ja 0xbf4490
cmp byte [rsi - 2], 0xf
je 0xbf4496
sub al, 0xe8
cmp al, 1
ja 0xbf447a
cmp rsi, rcx
jae 0xbf44b1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xbf4480
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xbf44b1
lodsb al, byte [rsi]
jmp 0xbf4490
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x7e9000]
mov eax, dword [rdi]
or eax, eax
je 0xbf450e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7f4000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xbf44be
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xbf4508
mov qword [rbx], rax
add rbx, 8
jmp 0xbf44de
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xbf4552
cmp al, 0xef
ja 0xbf453a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xbf451a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xbf4529
mov eax, dword [rdi]
add rdi, 4
jmp 0xbf4529
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xbf45a6
sub rsp, 0xffffffffffffff80
jmp 0x468fa0