joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140067274
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1400a92c0]
test rax, rax
je 0x1400672be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400672be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400672be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400672be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400672be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400672c0
xor al, al
add rsp, 0x28
ret

Function at 0x140071804
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14007194c

Function at 0x14007194c
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14007194c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400719bb
xor ecx, ecx
call qword [0x1400a92c0]
test rax, rax
je 0x1400719bb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400719bb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400719bb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400719bb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400719bb
cmp dword [rcx + 0xf8], 0
je 0x1400719bb
mov ecx, ebx
call fcn.140071884
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140071ae0
nop
cmp dword [rbp + 0x20], 0
je 0x140071a09
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140071918
int3
Function at 0x140079700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
test r8, r8
jne 0x140079720
call fcn.140072444
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.140072e2c
xor eax, eax
add rsp, 0x28
ret
test rdx, rdx
je 0x140079709
test rcx, rcx
jne 0x14007972f
cmp qword [r8], rcx
je 0x140079709
add rsp, 0x28
jmp 0x140079738
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ae040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r10d, r10d
mov rdi, r8
mov eax, r10d
mov r11, rdx
cmp rax, 0x20
mov r9, rcx
jae 0x140079857
mov byte [rsp + rax + 0x20], r10b
inc rax
cmp rax, 0x20
jl 0x140079762
movzx r8d, byte [r11]
inc r11
mov edx, r8d
mov eax, r8d
shr rdx, 3
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
mov byte [rsp + rdx + 0x20], cl
test r8b, r8b
jne 0x140079776
test r9, r9
jne 0x1400797a3
mov r9, qword [rdi]
movzx r8d, byte [r9]
mov edx, 1
mov eax, r8d
mov ecx, r8d
and ecx, 7
shr rax, 3
shl edx, cl
mov r11, r9
test byte [rsp + rax + 0x20], dl
je 0x1400797fa
mov rsi, r9
mov bl, r8b
mov r8b, bl
test bl, bl
je 0x1400797fa
lea r9, [rsi + 1]
mov edx, 1
movzx ebx, byte [r9]
mov r11, r9
mov eax, ebx
mov ecx, ebx
and ecx, 7
shr rax, 3
shl edx, cl
mov rsi, r9
mov r8b, bl
test byte [rsp + rax + 0x20], dl
jne 0x1400797ca
mov rbx, r11
test r8b, r8b
je 0x140079835
mov al, byte [r11]
movzx r8d, al
mov edx, 1
mov ecx, r8d
inc rbx
and ecx, 7
shr r8, 3
shl edx, cl
test byte [rsp + r8 + 0x20], dl
jne 0x14007982f
mov al, byte [rbx]
mov r9, rbx
test al, al
jne 0x140079805
jmp 0x140079835
mov byte [r9], r10b
mov r9, rbx
cmp rbx, r11
mov qword [rdi], r9
cmovne r10, r11
mov rax, r10
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14007d340
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
call fcn.14008137c
int3

Function at 0x140079e40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140079e68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140079e68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1403e4002
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
push 0xffffffffd7bbc0a9
lea rsp, [rsp + 8]
call rax
mov r10d, 0x58bbd181
sar r10b, 0x86
lea rdi, [r10 + r10 - 0x17e316f1]
mov rsp, qword [rbp + r10 - 0x58bbd20e]
movsx ecx, r10b
lea rdx, [rdi - 0x124f5b4e]
movsx r8d, cx
mov rbp, qword [rbp + r10 - 0x58bbd206]
movzx r9d, r10w
mov qword [r10 + rbp - 0x58bbd1fe], rax
xor di, r10w
mov rbx, rbp
pop r11
call fcn.1403e9fa4
mov r9d, 0xc2845623
mov eax, r9d
movzx esi, ax
mov r8, qword [rsi + rbx - 0x5623]
movzx ebp, ax
mov al, byte [rbx + rsi*8 - 0x2b110]
lea rbx, [rbx + rsi - 0x5619]
xor rsi, rbp
sal bpl, 1
jl 0x1403fbbcb
mov byte ss:[r8 + rsi*2], al
movzx ecx, r9w
xchg r9, rsi
jne 0x140413ba3
sub esi, 0x8bb6dfa0
not esi
xor byte [rsp + rdx*2 - 0x196], ch
call fcn.140409670
xor rcx, rcx
mov edx, r9d
mov word [rbx + rcx*2], ax
shr r9d, 0xa9
mov qword [rsp + r9*2 - 0xd85c00], rdi
ret 0x18
or eax, edx
jnp 0x1403f8f95
shl edx, 0x5d
call fcn.1403ea151
lea r10, [r9 + r10 + 4]
xor eax, r11d
shl rbp, cl
adc r9w, cx
lea eax, [rax + r9*4 - 0x468a561a]
xor eax, 0xf0baf832
and edx, edx
shr r9b, 3
not eax
seta bpl
sbb eax, ebp
neg eax
sub eax, ebp
xor eax, 0x84b16c0f
call fcn.14040c4cb
add r10, 4
mov r9d, 0x9cac0a3a
xor r8d, r11d
call fcn.1403e6f74
lea r10, [rcx + r10 - 0x74c3a849]
movsx eax, dx
xadd r8w, cx
xor esi, r11d
jmp 0x1403e6ecc
dec esi
push rbp
lea r8, [rdx + 0x50b5d2b1]
movzx eax, word [rsp + rdx - 0xcc]
bswap esi
xor esi, 0x5155f02
jmp 0x1403e4de2
rol sil, 1
neg ecx
xor byte [rsp + r8 - 0xf171], r8b
jge 0x140413c73
xor r11b, sil
xadd byte [rsp + rcx - 0x4bb88240], dh
sar word [rsp + r8 - 0xf178], cl
adc dword [rsp + r8 - 0xf177], 0x8fa5233f
lea rsi, [rsp + rsi + 0x10]
shl qword [rsp + r8 - 0xf178], cl
mov qword [rsi + r8 - 0xf180], r9
pop r8
jae 0x140403ee1
mov esi, dword [r10 + rdx*8 - 0x670]
ror word [rsp + rdx*4 - 0x338], 0x84
xchg word [rsp + rdx*2 - 0x19c], cx
movsx r8d, cl
lea r10, [r10 + rcx - 0x4bb80bfc]
xor esi, r11d
mov ebp, 0xc90ee6a3
pop rcx
jmp 0x1403f9d94
mov eax, dword [r10 + r9*2]
mov edx, esi
jns 0x1403e85f6
Function at 0x140402967
Capabilities:
Encode data using base64

Disassembly:
pop r11
movsxd rbp, ebp
movzx esi, dx
not dl
add rdi, rbp
and ax, dx
add cl, cl
mov rcx, qword [rbx + rdx*2 - 0x7738b6d4]
movzx ax, byte ss:[rdx + rcx - 0x3b9c5b6a]
push rsi
lea rbx, [rsi + rbx - 0x5b8f]
push rdx
xchg r8b, r9b
or r9, r8
mov word [rdx + rbx - 0x3b9c5b6a], ax
pop r9
mov qword [rsp + r9 - 0x3b9c5b6a], rdi
ret
mov qword [rsp + 8], 0x4e344c23
lea rsp, [rsp + 0x10]
ja 0x1403e8993
mov r9d, 0xb5278b81
mov r9, rsp
mov ecx, 0x108
mov r8d, 0x292c852b
lea r8, [r8 + rbx - 0x292c85ab]
mov esi, 0x4084699a
and r8, 0xfffffffffffffff0
not esi
inc rsi
sub r8, rcx
call fcn.1403f602b
lea r11, [r9 + r8*4 + 0xbb15231]
xor dword [rsp + rdx - 0x3b9c5b95], ebp
jmp 0x14040b532
dec r8
jno 0x1403ddd1d
mov word [rbx], si
mov ebp, 0xb00c5588
mov ecx, dword [r10]
add r10, 4
mov qword [rsp + 8], 0x3caa16b0
xor ecx, r11d
sar byte [rsp + 0xf], 6
bswap ecx
call fcn.1403f9e1d
movzx edx, r9w
xor r8d, r11d
ror r8d, 1
lea r9, [r9*4 - 0x63e57771]
sub r8d, 0x879730a7
lea rcx, [rdx*8 + 0x5d9f72bc]
xchg edx, r9d
movsx ebp, cx
not r8d
xadd ecx, r9d
call fcn.1403f3187
mov esi, 0x602a7139
mov edx, esi
mov rdx, qword [rbx + rdx - 0x602a7139]
and sil, 0xbb
mov rsi, qword [rsi + rbx - 0x602a7131]
adc rbx, 0xc
jmp 0x1403e4500

Function at 0x14040744c
Capabilities:
Encode data using base64

Disassembly:
sub r9b, 0x90
shr qword [rsp + rsi + 0x40010009], cl
or word [rsp + rbp + 0x14], r8w
sal bpl, 0x45
neg r9b
xor r11b, r9b
lea r9, [rsp + r9 + 0x20]
mov cx, word [r9 + rsi + 0x40010000]
lea rbx, [rsi + rbx + 0x4000fffe]
mov word [rbx + rbp*8], cx
movzx r9d, byte [rsp + rsi + 0x4001001b]
or rsi, r9
pop r9
pop r8
pop r9
pop r8
jl fcn.1403fcea5
mov ecx, 0x28b3a117
movsx esi, cx
mov edx, dword [r10 + rcx*2 - 0x5167422e]
lea r10, [rcx + r10 - 0x28b3a113]
rol cx, 0x4a
lea rbp, [rcx + rsi + 0x4e9f36b3]
call fcn.1403f3ad7
Function at 0x14040e73f
Capabilities:
Encode data using base64

Disassembly:
pop rbp
pop rbp
jns fcn.1403fcea5
bswap eax
push rdx
lea eax, [rax + r8*4 - 0x1d95948c]
dec dword [rsp + r8*2 - 0x1ac59]
sete cl
mov qword [rsp + r8*4 - 0x358c8], r11
dec word [rsp + r8 - 0xd62a]
xor dword [rsp + r8*2 - 0x1ac5c], eax
mov r11, qword [rsp + r8*4 - 0x358c8]
lea rsi, [r8 + 0x6010f68a]
movsxd rax, eax
and cl, r8b
push r8
adc rdi, rax
pop r9
neg sil
mov ecx, dword [rbx + r8 - 0xd636]
lea rbx, [rbx + r8*4 - 0x358d4]
push rsi
rol r8w, 1
movsx ebp, word [rsp + r8*4 - 0x2b1a1]
movzx r9d, byte [r8 + r10 - 0xac6d]
lea r10, [r10 + r8 - 0xac6c]
call fcn.1403f4ceb
and r8b, sil
mov word [rbx], r9w
neg ebp
mov edx, ebp
mov ebp, dword [rdx + r10 - 0x2d537dfb]
movzx ecx, r8w
inc r8d
dec r8w
lea r10, [r10 + rdx - 0x2d537df7]
rol rdx, 0x19
and cx, dx
inc esi
xor ebp, r11d
movzx eax, r8w
lea ebp, [rbp + rcx*2 - 0x3d38f6b1]
xchg sil, dl
sar r8, 0x24
sub r8, rax
rol ebp, 3
rol ecx, 0xc5
jae 0x1403f66f2
push 0x7caa39b0
xor r9d, r9d
test rsi, rsi
lea rsp, [rsp + 8]
je 0x1403f8c0b
push r10
lea rax, [0x14040fb28]
dec word [rsp + r8*4 + 4]
xor dword [rsp + r8 + 8], esi
mov r11, qword [rsp + r8*2 + 8]
movsxd rsi, esi
jmp 0x140401dab
ror esi, 1
shr qword [rsp + r8 + 4], 0x69
or qword [rsp + r8 + 8], r11
jmp 0x1403e7c9e
lea ebp, [rbp + rsi*2 - 0x38816ed0]
lea rsi, [r8*2 - 0x7c6a21f8]
movzx r9d, r8w
not ebp
setb dl
dec ebp
and r8, r8
not esi
push r11
xor dword [rsp + r8 + 0x8c8f], ebp
ror r9b, 0xa1
shr r9b, 0xe1
call fcn.1404152f3
lea r11, [rdx*8 + 0x353abfbe]
xor dword [rsp + rax - 0x5294], r9d
sar r8w, cl
inc ebp
sar rax, 3
pop r11
not edx
lea rbx, [rbx + rax*4 - 0x294c]
xadd bpl, al
mov dword [rax + rbx - 0xa60], r9d
sal r8d, cl
lea r9, [r8 + 0x381eb71d]
shr r8d, cl
mov r8d, dword [r10 + rax*4 - 0x2980]
inc cx
cmovle si, r9w
bswap ebp
lea r10, [r10 + rdx*4 + 4]
call fcn.140414a7e
xor dword [rsp + r8*2 - 0x7fa4c2], eax
pop r11
inc rdx
call fcn.140402af8
push rbp
neg esi
neg rax
mov qword [rsp + r8*4 + 8], rbp
xor esi, 0xf684191a
jmp 0x14040d26d
mov eax, 0x1912d830
not r9d
jmp 0x140401778
movzx ecx, ax
mov dword [rbx + rax - 0x1912d830], r9d
mov ecx, dword [r10 + rax*2 - 0x3225b060]
lea r9, [rax*2 + 0x618ab296]
lea r10, [rax + r10 - 0x1912d82c]
mov r8d, r9d
movsx esi, r8b
bswap r9
xor ecx, r11d
shl r9w, 1
not ecx
rol rax, 0x3d
adc r8b, 4
lea ecx, [rcx + rsi - 0x72498eea]
js 0x140410c4d
sal dword [rsp + r8*8 + 4], 0xe6
xchg byte [rsp + r8*2 + 5], cl
adc rdi, rsi
shr bp, 0x8b
jp 0x1403dda34
shr r9w, 0x49
je 0x1403e962e
mov ebp, dword [r10]
mov qword [rsp], 0xffffffffa39fbc12
add r10, 4
mov eax, 0x7ba15e90
push rax
xor ebp, r11d
call fcn.1404124e2
mov r9w, word [rbx]
mov ecx, 0x9e04ca2b
mov cl, byte [rbx + 2]
mov ebp, 0xd2ac8205
add rbx, 2
lea rsi, [rbp*2 - 0x3956777b]
shl r9w, cl
movsx r8d, si
jmp 0x1403e44ac
movzx ebp, r9w
not ecx
adc rax, rax
inc ecx
xor r9d, ebp
push rax
shr ebp, 0x92
bswap ecx
ror ecx, 3
ror si, 0xee
mov edx, dword [rsp + rax*2 - 0xc896c16]
mov qword [rsp + rax*2 - 0xc896c18], r11
adc r8, rbp
xor dword [rsp + rax - 0x644b60c], ecx
not esi
xadd dl, r8b
pop r11
movsxd rcx, ecx
dec al
add rdi, rcx
bswap edx
add r9, rdi
jmp r9
Function at 0x140412391
Capabilities:
Encode data using base64

Disassembly:
add rsi, rbx
sub rbx, 2
mov word [rbx], si
rol dword [rsp + 5], 0xdf
pop rbp
pop rdx
jae fcn.1403fcea5
dec cl
xadd rdx, rcx
lea r9d, [rdx + r9 - 0x18b5716]
call fcn.14040dfd7
mov r11, qword [rsp + rsi + 8]
and esi, 0x93852396
mov qword [rsp + rsi*8], r8
movsxd rax, eax
mov qword [rsp + rsi*4 + 8], rcx
neg ecx
add rdi, rax
rol qword [rsp + rsi*4 + 8], 0x9b
jae 0x14041135d
mov r9d, 0x262f9534
mov eax, dword [rbx + r9*2 - 0x4c5f2a68]
mov rsi, rbx
push rbx
sar r9d, 0x21
lea rbp, [r9*8 - 0x1172ce43]
movsx ecx, bp
cpuid
movsx r8d, bpl
lea rsi, [rsi + r9*2 - 0x262f9540]
mov dword [rsi + r9*4 - 0x4c5f2a5c], eax
sal rbp, 0x31
mov dword [rsi + r9*4 - 0x4c5f2a60], ebx
add r8d, 0x2c983330
sub rbp, r8
mov dword [rsi + r9*2 - 0x262f9530], ecx
mov dword [rsi + r9*2 - 0x262f9534], edx
adc bp, r9w
not r9
mov ebx, 0x508d3991
pop rbx
jno 0x1403f337d
Function at 0x1400279dc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b104
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b104
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027b2c
cmp rax, 0xffffffffffffffff
je 0x140027b2c
xor edi, edi
test rbp, rbp
jle 0x140027ad7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001da18
mov rbx, rax
test rax, rax
jne 0x140027a64
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027acd
mov edx, 0x8000
mov ecx, r14d
call fcn.140018a68
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001bde0
cmp eax, 0xffffffff
je 0x140027aad
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027a74
mov edx, r15d
mov ecx, r14d
call fcn.140018a68
jmp 0x140027acd
cmp byte [rsi + 0x38], dil
je 0x140027ac4
cmp dword [rsi + 0x34], 5
jne 0x140027ac4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027acd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400197c8
jmp 0x140027b40
jns 0x140027b40
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b104
cmp rax, 0xffffffffffffffff
jne 0x140027af8
cmp byte [rsi + 0x30], dil
je 0x140027b40
mov edi, dword [rsi + 0x2c]
jmp 0x140027b40
mov ecx, r14d
call fcn.140017594
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027b40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027b40
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027b39
mov eax, dword [rsi + 0x2c]
jmp 0x140027b3e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b104
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140028c30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140028c58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140028c58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x18059f6d5
Capabilities:
Encode data using xor

Disassembly:
mov r11, qword [rsp + 8]
lea rsp, [rsp + 0x10]
lea r10, [0x1805863a0]
lea rsp, [rsp + 8]
mov r11d, 0xa43da0bd
movzx r11d, byte [r9]
push 0x1aa38c00
ror qword [rsp], 0x73
xor r11d, r8d
and r11d, 0xff
mov r11d, dword [r10 + r11*4]
shr r8d, 8
xor r8d, r11d
inc r9
xor r8d, 0xac983bad
dec rdi
lea rsp, [rsp + 8]
jne 0x18059f6e1
mov r11d, 0xbf370c39
push r11
jmp 0x18059388e
Function at 0x140f7ce7f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdi
mov r8, 0x179732e8
push rbx
mov r11b, r15b
sets bh
movsx r11w, r13b
push rsi
movzx ebx, r10w
jmp 0x140f61cae
push r12
sar r11w, 0xcf
shld r11, r9, 0xb2
push r15
cmovl r10d, edx
rdtsc
push rcx
movabs r8, 0
shr r10b, cl
push r8
shrd r9w, si, 0x59
xadd si, dx
mov r11, qword [rsp + 0x90]
cbw
movsx esi, di
add r9d, 0x546270c3
neg r11d
cqo
xor ax, 0x20f7
rdtsc
sub r11d, 0x61e82192
cbw
test r14b, 0x8f
neg r11d
rcr bx, 0x5e
sub r11d, 0x129b2599
movzx rax, r10w
sub r10w, 0x4084
xor r11d, 0x1d1746c5
rcr ebx, cl
sub r11d, 0x5d0c0cc4
rcr r10b, 0xee
inc r9d
xadd bh, al
lea r11, [r11 + r8]
cbw
bt r10, 0x90
movabs rax, 0x100000000
shr dx, cl
or sil, 0x62
lea r11, [r11 + rax]
btc r9w, 0xa5
bswap ebx
mov r10, rsp
not sil
sal r9b, 0xb6
btc dx, 0x8d
sub rsp, 0x180
bt ebx, 0xdd
and rsp, 0xfffffffffffffff0
mov rsi, r11
cwd
rcr ebx, cl
movabs rdx, 0
btc r9d, 0x6f
jmp 0x140fe1f6c
push r11
movzx r11, bp
mov r8d, 0x11682888
jmp 0x140ebcdc3
pushfq
mov bl, ah
inc r8b
push r14
cmovnp si, bx
xchg r11w, si
push rbp
and r8, r15
movsx r8, r9w
push r10
push rdx
push rax
sub r8b, bpl
sar bx, cl
rcl ah, cl
push r9
shl r11, cl
add r10b, cl
push r13
jmp 0x140f2ac53
push r8
jmp 0x140f4cd7d
movsxd r9, r9d
test edi, r11d
add rbx, r9
jmp 0x140fe50cc
sub rsi, rdx
movsx rbx, si
lea rbx, [0x140fe1f73]
shrd r9w, r9w, 0xaf
mov r9d, dword [r11]
stc
add r11, 4
jmp 0x140fed4a2
push rbx
ret
xor r9d, esi
ror r9d, 2
xor r9d, 0x451e6392
stc
test ch, bh
cmc
sub r9d, 0x8cc1e10
neg r9d
test edi, 0x66eb72e4
push rsi
movsx esi, r9w
neg si
sar esi, cl
xor dword [rsp], r9d
xadd sil, sil
pop rsi
test al, r11b
jmp 0x140f9b37c
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004a8360]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004a8370]
mov dword [rax], 1
mov rax, qword [0x004a8380]
mov dword [rax], 1
mov rax, qword [0x004a8350]
mov dword [rax], 1
mov rax, qword [0x004a8210]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004a8340]
mov dword [0x004cc008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x004a8300]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x004a7690]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x401550
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
lea rax, [rbp - 8]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call rax
test eax, eax
sete al
test al, al
je 0x4015a3
mov eax, 0xffffffff
jmp 0x401759
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x800c
mov rax, qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
call rax
test eax, eax
sete al
test al, al
je 0x4015f2
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov eax, 0xffffffff
jmp 0x401759
mov rax, qword [rbp - 0x10]
mov ecx, dword [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptHashData]
call rax
test eax, eax
sete al
test al, al
je 0x40164a
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov eax, 0xffffffff
jmp 0x401759
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8, rdx
mov edx, 0x6610
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
call rax
test eax, eax
sete al
test al, al
je 0x4016aa
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov eax, 0xffffffff
jmp 0x401759
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 1
mov edx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
call rax
test eax, eax
sete al
test al, al
je 0x40171f
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov eax, 0xffffffff
jmp 0x401759
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call rax
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call rax
mov eax, 0
add rsp, 0x50
pop rbp
ret
Function at 0x40b7d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x004cc624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x40b958
mov rax, qword [0x004cc628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40b81c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x40b8a5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x40b800
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x40b98d
mov rax, qword [0x004cc628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004cc628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x40b970
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40b89e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x40b900
add dword [0x004cc624], 1
cmp edi, 8
jae 0x40b8d3
test dil, 4
jne 0x40b944
test edi, edi
je 0x40b8c8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40b95f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x40b8c8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40b8ec
jmp 0x40b8c8
add rsi, qword [0x004cc628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40b89e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x40b8c8
xor esi, esi
jmp 0x40b827
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x40b8c8
mov rax, qword [0x004cc628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x40c0e0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004cc900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004cc8e0]
test rbx, rbx
je 0x40c134
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40c12b
test rsi, rsi
je 0x40c12b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x40c110
lea rcx, [0x004cc900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]