joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cb50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x58], rax
test rdx, rdx
mov rsi, r8
mov rdi, rdx
mov r8d, 0x20019
sete al
lea rdx, str.AppExit
mov byte [r9], al
mov r14, r9
mov rbp, rcx
call fcn.14000daf0
mov rbx, rax
test rax, rax
jne 0x14000cba1
lea eax, [rbx + 1]
jmp 0x14000cc3d
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], 0x10
test rdi, rdi
jne 0x14000cbf6
xor eax, eax
mov word [rsp + 0x38], ax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
test eax, eax
je 0x14000cc35
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x14000cc3b
jmp 0x14000cc23
mov eax, dword [rdi]
lea r9, [0x14002ef10]
mov edx, 0x10
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x38]
lea r8, [rdx - 0x11]
call fcn.140001d80
test eax, eax
jns 0x14000cbbd
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, r14
mov r8, rsi
xor edx, edx
mov rcx, rbp
call fcn.14000cb50
jmp 0x14000cc3d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14000cf50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rax
movzx ebx, r9b
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x34]
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14000cfac
lea eax, [rdi + 1]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp edi, 2
jne 0x14000cfc7
test bl, bl
jne 0x14000cfc7
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov ecx, edi
call fcn.140002510
mov r9, rax
xor ebx, ebx
mov eax, 1
mov qword [rsp + 0x20], rbx
movzx ecx, ax
mov r8, rsi
mov edx, 0xc00003fa
call fcn.140002610
mov rsi, qword [rsp + 0x58]
cmp edi, 2
sete bl
lea eax, [rbx - 2]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14000d870
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14000d8d6
lea edi, [rax + 1]
mov qword [rsp + 0x20], rax
movzx ecx, di
lea r9, str.get_string__
mov r8, rbp
mov edx, 0xc00003eb
call fcn.140002610
mov eax, edi
jmp 0x14000da2c
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140019470
lea rax, [rsp + 0x30]
mov dword [rsp + 0x78], 2
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov dword [rsp + 0x30], edi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, eax
test eax, eax
je 0x14000d972
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r14d, 2
jne 0x14000d941
cmp byte [rsp + 0x90], 0
je 0x14000d9cc
mov ecx, r14d
call fcn.140002510
mov edi, 1
mov qword [rsp + 0x20], 0
movzx ecx, di
mov r9, rax
mov r8, rbp
mov edx, 0xc00003fa
call fcn.140002610
lea eax, [rdi + 1]
jmp 0x14000da2c
cmp byte [rsp + 0x88], 0
je 0x14000d985
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
cmp byte [rsp + 0x80], 0
jne 0x14000d9a1
cmp dword [rsp + 0x78], 2
jne 0x14000d9a8
mov edi, 1
mov dword [rsp + 0x78], edi
jmp 0x14000d9a8
cmp dword [rsp + 0x78], 2
je 0x14000d9d0
mov r8d, dword [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call fcn.140019060
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x14000da2c
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14000d9e7
cmp eax, edi
jbe 0x14000d9b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov edi, 1
mov qword [rsp + 0x20], 0
movzx ecx, di
mov r9, rax
mov r8, rbx
mov edx, 0xc00003fe
call fcn.140002610
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [rdi + 2]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14000dcc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, rcx
mov dword [rsp + 0x30], 4
mov rdi, r8
mov dword [rsp + 0x34], 4
mov rax, rdx
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x28], rcx
mov rsi, r9
mov qword [rsp + 0x20], r9
xor r8d, r8d
lea r9, [rsp + 0x30]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000ddaf
mov qword [rsp + 0x68], rbx
mov ebx, dword [rsp + 0xb0]
cmp eax, 2
je 0x14000dda8
cmp dword [rsp + 0x30], 4
je 0x14000dd80
mov edx, 0x10
mov dword [rsp + 0x20], ebx
lea r9, [0x14002ef10]
lea rcx, [rsp + 0x38]
lea r8, [rdx - 0x11]
call fcn.140001d80
mov edx, dword [rsp + 0xb8]
lea rax, [rsp + 0x38]
mov ecx, 2
mov qword [rsp + 0x28], 0
mov r9, rdi
mov qword [rsp + 0x20], rax
mov r8, rbp
call fcn.140002610
jmp 0x14000dda8
mov ecx, eax
call fcn.140002510
mov r9, rax
mov qword [rsp + 0x20], 0
mov eax, 1
mov r8, rdi
movzx ecx, ax
mov edx, 0xc00003fa
call fcn.140002610
mov dword [rsi], ebx
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000e0e0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x248
mov rax, qword [0x14003ebd8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x28], rdx
lea rax, str.AppEvents
mov rsi, r9
mov qword [rsp + 0x20], rax
mov r15, r8
lea r9, [0x14002e810]
mov r12, rcx
mov rdi, 0xffffffffffffffff
mov r8, rdi
lea rcx, [rsp + 0x30]
mov edx, 0xff
call fcn.140001d80
test eax, eax
jns 0x14000e16c
xor ebp, ebp
lea ebx, [rdi + 2]
movzx ecx, bx
lea r9, str.set_hook__
lea r8, str.hook_registry
mov qword [rsp + 0x20], rbp
mov edx, 0xc00003eb
call fcn.140002610
mov eax, ebx
jmp 0x14000e245
mov rax, rdi
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x14000e170
xor ebp, ebp
mov qword [rsp + 0x240], r14
test rax, rax
jne 0x14000e1d7
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, 0x20019
mov rcx, r12
call fcn.14000db00
mov r14, rax
test rax, rax
je 0x14000e1d3
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, r15
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, r14
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 2
jne 0x14000e1d7
xor eax, eax
jmp 0x14000e23d
mov r8d, 0x20006
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.14000daf0
mov r14, rax
test rax, rax
jne 0x14000e1f8
lea eax, [r14 + 1]
jmp 0x14000e23d
mov ebx, 1
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x14000e200
mov rdx, r15
mov rcx, r14
test rdi, rdi
je 0x14000e224
movzx r9d, bl
mov r8, rsi
call fcn.14000e2f0
mov ebx, eax
jmp 0x14000e232
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, 0xfffffffd
cmove ebx, ebp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov r14, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400180d0
add rsp, 0x248
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e270
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rbx, rdx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000e2a8
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov edi, 1
mov qword [rsp + 0x20], 0
movzx ecx, di
mov r9, rax
mov r8, rbx
mov edx, 0xc00003fb
call fcn.140002610
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x14000e2f0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r10, rcx
mov rax, 0xffffffffffffffff
cmp word [r8 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14000e303
lea ecx, [rax*2 + 2]
movzx r9d, r9b
mov dword [rsp + 0x28], ecx
inc r9d
mov qword [rsp + 0x20], r8
mov rcx, r10
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000e33d
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov edi, 1
mov qword [rsp + 0x20], 0
movzx ecx, di
mov r9, rax
mov r8, rbx
mov edx, 0xc00003fb
call fcn.140002610
mov eax, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x14000ef10
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x20], r9d
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
xor esi, esi
mov edi, ecx
xor r14d, r14d
xor r15d, r15d
mov r13, rdx
xor ebp, ebp
mov rbx, r8
mov rdx, r8
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14000f005
mov edx, dword [rbx + 4]
mov r9d, 0xa
lea r8, [0x140000000]
cmp edi, 0x80
ja case.0x14000ef7d.4
movzx eax, byte [r8 + rdi + 0xf03c]
mov ecx, dword [r8 + rax*4 + 0xf024]
add rcx, r8
jmp rcx
cmp edx, 2
je 0x14000ef9a
cmp edx, 4
jne 0x14000effa
xor eax, eax
jmp 0x14000f00a
cmp edx, 1
je case.0x14000ef7d.4
lea eax, [rdx - 3]
cmp eax, 1
ja 0x14000effa
mov eax, 1
mov edx, dword [rbx + 0x14]
mov ecx, dword [rbx + 0x18]
cmp edx, r14d
jne 0x14000efaf
cmp ecx, r15d
je 0x14000efb1
xor esi, esi
inc esi
mov r15d, ecx
cmp esi, 0xa
mov r14d, edx
cmovg esi, r9d
imul ecx, esi, 0x32
cmp dword [rsp + 0x70], 0
je 0x14000efd2
cmp ebp, dword [rsp + 0x70]
ja 0x14000f00a
add ebp, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rbx
jmp 0x14000ef40
mov eax, edx
sub eax, 6
je 0x14000ef9a
cmp eax, 1
je case.0x14000ef7d.4
jmp 0x14000effa
mov eax, edx
sub eax, 4
je case.0x14000ef7d.4
cmp eax, 1
je 0x14000ef9a
mov eax, 0xffffffff
cmp edx, dword [rsp + 0x68]
je 0x14000ef9f
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x140010840
Capabilities:
Create service
Delete service
Persist via windows service

Disassembly:
push rdi
sub rsp, 0x70
mov rdi, rcx
test rcx, rcx
jne 0x140010857
lea eax, [rcx + 1]
add rsp, 0x70
pop rdi
ret
mov ecx, 3
mov qword [rsp + 0x90], rsi
call fcn.140011340
mov rsi, rax
test rax, rax
jne 0x14001089f
lea ecx, [rax + 2]
call fcn.14001c1d0
mov rcx, rax
mov edx, 0x400001fb
call fcn.140002950
mov rcx, rdi
call fcn.14000f310
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
mov qword [rsp + 0x80], rbx
lea rbx, [rdi + 0x842c]
mov qword [rsp + 0x88], rbp
call fcn.140009dd0
lea r9, [0x14002ecd8]
mov qword [rsp + 0x20], rax
mov edx, 0x7fff
mov r8, 0xffffffffffffffff
mov rcx, rbx
call fcn.140001d80
xor eax, eax
lea r8, [rdi + 2]
mov qword [rsp + 0x60], rax
lea rdx, [rdi + 2]
mov qword [rsp + 0x58], rax
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rax
mov rcx, rsi
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rdi + 0x704f0], rax
test rax, rax
jne 0x140010970
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov ecx, 2
mov rbx, rax
call fcn.14001c1d0
mov rcx, rax
mov r8, rbx
mov edx, 0x40000203
call fcn.140002950
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 5
jmp 0x1400109c1
xor edx, edx
mov rcx, rdi
call fcn.14000f8d0
test eax, eax
je 0x14001099b
mov rcx, qword [rdi + 0x704f0]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 6
jmp 0x1400109c1
mov ecx, 1
call fcn.14001c1d0
mov rcx, rax
lea r8, [rdi + 2]
mov edx, 0x4000021e
call fcn.140002950
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x140012580
Capabilities:
Delete service

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
test rcx, rcx
jne 0x140012597
lea eax, [rcx + 1]
add rsp, 0x30
pop rsi
ret
mov ecx, 5
mov qword [rsp + 0x58], rdi
call fcn.140011340
mov rdi, rax
test rax, rax
jne 0x1400125d1
lea ecx, [rax + 2]
call fcn.14001c1d0
mov rcx, rax
mov edx, 0x400001fb
call fcn.140002950
lea eax, [rdi + 2]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
lea r9, [rsi + 2]
mov qword [rsp + 0x50], rbp
mov r8d, 0x10000
mov dword [rsp + 0x20], 0x100
lea rdx, [rsi + 2]
mov rcx, rdi
call fcn.140010fa0
mov qword [rsi + 0x704f0], rax
mov rcx, rdi
test rax, rax
jne 0x14001261e
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x50]
mov eax, 3
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
lea r9, [rsp + 0x40]
mov qword [rsp + 0x48], rbx
lea r8, [rsi + 0x202]
mov dword [rsp + 0x40], 0x100
lea rdx, [rsi + 2]
call qword [sym.imp.ADVAPI32.dll_GetServiceDisplayNameW]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0x100
lea r8, [rsi + 2]
mov rcx, rdi
lea rdx, [rsi + 0x202]
call qword [sym.imp.ADVAPI32.dll_GetServiceKeyNameW]
mov rcx, qword [rsi + 0x704f0]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x1400126ab
lea ecx, [rax + 2]
call fcn.14001c1d0
mov rcx, rax
mov edx, 0x40000221
call fcn.140002950
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbp, qword [rsp + 0x50]
mov eax, 4
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 1
call fcn.14001c1d0
mov rcx, rax
lea r8, [rsi + 2]
mov edx, 0x40000222
call fcn.140002950
mov rbp, qword [rsp + 0x50]
xor eax, eax
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x140013950
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, rdx
mov rbx, rcx
test r8, r8
je 0x14001396c
cmp word [r8], 0
jne 0x140013973
lea r8, [0x14002ee04]
mov qword [rsp + 0x50], r8
mov edi, 1
mov edx, edi
lea r8, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x14001399e
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002510
mov r9, rax
movzx ecx, di
mov r8, rbx
mov qword [rsp + 0x20], 0
mov edx, 0x40000428
call fcn.140002610
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x140013a40
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov edi, 1
lea r8, [rsp + 0x40]
mov rbx, rcx
mov dword [rsp + 0x40], edi
mov rcx, qword [rcx + 0x704f0]
lea edx, [rdi + 3]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x140013a9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7c
je 0x140013a9e
mov ecx, eax
call fcn.140002510
mov r9, rax
movzx ecx, di
lea r8, [rbx + 2]
mov qword [rsp + 0x20], 0
mov edx, 0x40000413
call fcn.140002610
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140020680
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140020513
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140020513
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140020513
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140020513
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140020513
cmp dword [rcx + 0x84], 0xe
jbe 0x140020513
cmp dword [rcx + 0xf8], 0
je 0x140020513
mov ecx, ebx
call fcn.1400205b4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400203a4
cmp dword [rbp + 0x20], 0
je 0x140020560
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140020568
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400204ac
Function at 0x1413f4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1413f41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1413f4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413f406f
add dl, dl
jne 0x1413f4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413f40f6
xor eax, eax
add dl, dl
jne 0x1413f40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413f41ad
add dl, dl
jne 0x1413f40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413f40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413f40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413f40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1413f40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1413f407e
mov eax, 1
add dl, dl
jne 0x1413f4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413f4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413f40fb
sub eax, ebx
mov ebx, 1
jne 0x1413f414c
mov ecx, 1
add dl, dl
jne 0x1413f412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1413f413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413f4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413f407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1413f4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1413f4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413f415d
cmp eax, 0x7d00
jae 0x1413f419b
cmp eax, 0x500
jb 0x1413f4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413f407e
cmp eax, 0x7f
ja 0x1413f419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413f407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1413f41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1413f407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x416200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4163ab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004329e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41626e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416281
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4162a5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4162b9
cmp rbx, 0x1000
jae 0x416278
nop
jmp 0x416329
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4162cd
xor edx, edx
jmp 0x416320
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004329e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4162af
jmp 0x416295
call fcn.00460e60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437040
lea rax, [0x004e657a]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00437940
mov rax, qword [rsp + 0x38]
call fcn.00437640
lea rax, [0x004e663a]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437940
mov rax, qword [rsp + 0x30]
call fcn.00437640
call fcn.004372a0
call fcn.004370c0
lea rax, [0x004e9179]
mov ebx, 0x21
call fcn.00435780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d2a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416200
Function at 0x4163e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41660a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432a60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41645b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41646e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416490
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4164a4
cmp rbx, 0x1000
jae 0x416465
jmp 0x41652e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4164b6
xor esi, esi
jmp 0x416520
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00432a60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41649a
jmp 0x416482
call fcn.00460e60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4165a9
call fcn.00437040
lea rax, [0x004e6bcb]
mov ebx, 0x19
call fcn.00437940
mov rax, qword [rsp + 0x68]
call fcn.00437640
lea rax, [0x004e663a]
mov ebx, 0x19
nop
call fcn.00437940
mov eax, dword [rsp + 0x34]
call fcn.00437640
call fcn.004372a0
call fcn.004370c0
lea rax, [0x004e27ab]
mov ebx, 0xd
call fcn.00435780
cmp eax, 0x5af
je 0x416553
call fcn.00437040
lea rax, [0x004e6bcb]
mov ebx, 0x19
call fcn.00437940
mov rax, qword [rsp + 0x38]
call fcn.00437640
lea rax, [0x004e663a]
mov ebx, 0x19
nop dword [rax]
call fcn.00437940
mov eax, dword [rsp + 0x34]
call fcn.00437640
call fcn.004372a0
call fcn.004370c0
lea rax, [0x004e89a7]
mov ebx, 0x1f
call fcn.00435780
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d2a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004163e0