joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140875eb0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140875f85
mov edx, 0x40
call fcn.1408772a0
test al, al
jne 0x140875f85
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140875f85
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140875f85
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.1408772a0
test al, al
jne 0x140875f85
cmp dword [rsi], 0x4550
jne 0x140875f85
mov edx, 0x40
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x140875f85
cmp word [rbx], di
jne 0x140875f85
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140875f85
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x140875f85
cmp dword [rdi], 0x4550
jne 0x140875f85
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x140875f85
xor eax, eax
mov ecx, 0x20b
cmp word [rdi + 0x18], cx
cmove rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140875fa0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
cmp edx, 0x10
jae 0x140876094
test rcx, rcx
je 0x140876094
mov edx, 0x40
call fcn.1408772a0
test al, al
jne 0x140876094
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140876094
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140876094
lea r14, [rbx + rax]
mov edx, 0xf8
mov rcx, r14
call fcn.1408772a0
test al, al
jne 0x140876094
cmp dword [r14], 0x4550
jne 0x140876094
mov edx, 0x40
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x14087607f
cmp word [rbx], di
jne 0x14087607f
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14087607f
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x14087607f
cmp dword [rdi], 0x4550
jne 0x14087607f
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x14087607f
mov eax, 0x20b
cmp word [rdi + 0x18], ax
lea rax, [rsi*8 + 0x88]
je 0x140876087
lea rax, [rsi*8 + 0x78]
add rax, r14
xor ecx, ecx
cmp dword [rax], ecx
cmove rax, rcx
jmp 0x140876096
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1408760b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x5a4d
test rcx, rcx
je 0x14087612b
mov edx, 0x40
call fcn.1408772a0
test al, al
jne 0x14087612b
cmp word [rbx], bp
jne 0x14087612b
movsxd rax, dword [rbx + 0x3c]
lea rdi, [rbx + 0x3c]
cmp eax, 0x400
jg 0x14087612b
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.1408772a0
test al, al
jne 0x14087612b
cmp dword [rsi], 0x4550
jne 0x14087612b
mov edx, 0xf8
mov rcx, rsi
call fcn.1408772a0
test al, al
je 0x140876125
xor esi, esi
jmp 0x140876136
movzx esi, word [rsi + 0x18]
jmp 0x140876136
xor esi, esi
lea rdi, [rbx + 0x3c]
test rbx, rbx
je 0x140876188
mov edx, 0x40
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x140876188
cmp word [rbx], bp
jne 0x140876188
movsxd rax, dword [rdi]
cmp eax, 0x400
jg 0x140876188
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x140876188
cmp dword [rdi], 0x4550
jne 0x140876188
mov eax, 0x20b
cmp si, ax
jne 0x140876183
mov rax, qword [rdi + 0x30]
jmp 0x14087618a
mov eax, dword [rdi + 0x34]
jmp 0x14087618a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1408761a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14087629f
mov edx, 0x40
call fcn.1408772a0
test al, al
jne 0x14087629f
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x14087629f
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14087629f
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x14087629f
cmp dword [rdi], 0x4550
jne 0x14087629f
mov edx, 0x40
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x140876284
cmp word [rbx], si
jne 0x140876284
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140876284
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x140876284
cmp dword [rdi], 0x4550
jne 0x140876284
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x140876284
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140876284
mov rcx, rbx
call fcn.140875eb0
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140875da0
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1408762c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x14087638c
call fcn.140875ce0
mov rsi, rax
test rax, rax
je 0x14087638c
mov edx, 0x40
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x14087634d
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14087634d
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14087634d
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x14087634d
cmp dword [rdi], 0x4550
jne 0x14087634d
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x14087634d
mov eax, 0x20b
lea rax, [rsi + 4]
test rax, rax
je 0x140876375
cmp rax, rbx
jb 0x140876375
mov rcx, rax
sub rcx, rbx
lea rdx, [rcx + 0x14]
cmp rdx, rbp
ja 0x140876375
cmp rdx, 0x14
jb 0x140876375
cmp rdx, rcx
jae 0x140876377
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140876670
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r13, r8
mov r15, rdx
mov rdi, rcx
test rcx, rcx
je 0x1408766ad
test r8, r8
je 0x1408766ad
test rdx, rdx
je 0x1408766cc
cmp rdx, 0x40
jae 0x1408766da
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov edx, 0x40
call fcn.1408772a0
test al, al
jne 0x1408766ad
mov esi, 0x5a4d
cmp word [rdi], si
jne 0x1408766ad
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1408766ad
lea rbx, [rax + rdi]
mov rcx, rax
test r15, r15
je 0x14087671f
test rbx, rbx
je 0x1408766ad
cmp rbx, rdi
jb 0x1408766ad
add rax, 0xf8
cmp rax, r15
ja 0x1408766ad
cmp rax, 0xf8
jb 0x1408766ad
cmp rax, rcx
jb 0x1408766ad
jmp 0x140876734
mov edx, 0xf8
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x1408766ad
cmp dword [rbx], 0x4550
jne 0x1408766ad
mov edx, 0x40
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x140876794
cmp word [rdi], si
jne 0x140876794
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140876794
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.1408772a0
test al, al
jne 0x140876794
cmp dword [rsi], 0x4550
jne 0x140876794
mov edx, 0xf8
mov rcx, rsi
call fcn.1408772a0
test al, al
jne 0x140876794
mov eax, 0x20b
xor r11d, r11d
lea r12, [rbx + 4]
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, r12
mov r14d, r11d
movzx esi, r11w
movzx edx, word [rax + rcx]
mov eax, dword [rbx + 0x54]
add rdx, 0x18
add rdx, rbx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rdx
cmp r11w, word [r12 + 2]
jae 0x1408768e0
nop dword [rax]
movzx eax, si
lea rcx, [rax + rax*4]
lea rbx, [rdx + rcx*8]
test rbx, rbx
je 0x1408766ad
cmp rbx, rdi
jb 0x1408766ad
mov rcx, rbx
sub rcx, rdi
lea rax, [rcx + 0x28]
cmp rax, r15
ja 0x1408766ad
cmp rax, 0x28
jb 0x1408766ad
cmp rax, rcx
jb 0x1408766ad
cmp rax, rbp
ja 0x1408766ad
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x1408768cd
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x1408768cd
mov r9d, dword [rbx + 0xc]
mov edx, ecx
mov r8d, eax
add rcx, rdi
add rax, r9
lea r10, [r9 + r13]
cmp rax, rbp
jbe 0x14087685a
mov rax, rbp
mov r8, r11
sub rax, r9
cmp rbp, r9
cmova r8, rax
cmp r9, rbp
jb 0x140876868
test r8, r8
jne 0x1408766ad
lea rax, [rdx + r8]
cmp rax, rbp
ja 0x1408766ad
test rcx, rcx
je 0x1408768c8
cmp rcx, rdi
jb 0x1408768c8
cmp rax, r15
ja 0x1408768c8
cmp rax, r8
jb 0x1408768c8
cmp rax, rdx
jb 0x1408768c8
test r10, r10
je 0x1408768c8
cmp r10, r13
jb 0x1408768c8
lea rax, [r9 + r8]
cmp rax, rbp
ja 0x1408768c8
cmp rax, r8
jb 0x1408768c8
cmp rax, r9
jb 0x1408768c8
mov rdx, rcx
mov rcx, r10
call fcn.14087bcc0
test r14d, r14d
je 0x1408768c1
cmp dword [rbx + 0x14], r14d
jae 0x1408768c5
mov r14d, dword [rbx + 0x14]
xor r11d, r11d
mov rdx, qword [rsp + 0x20]
inc si
cmp si, word [r12 + 2]
jb 0x1408767d0
mov eax, dword [rsp + 0x60]
test eax, eax
cmovne r14d, eax
mov r8d, r14d
cmp r8, rbp
ja 0x1408766ad
mov rdx, rdi
mov rcx, r13
call fcn.14087bcc0
mov al, 1
jmp 0x1408766af
Function at 0x140876930
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r12, r8
mov edx, 5
mov rsi, rcx
call fcn.140875fa0
test rax, rax
je 0x140876ba2
test rsi, rsi
je 0x140876ba2
cmp rax, rsi
jb 0x140876ba2
mov rcx, rax
sub rcx, rsi
lea rdx, [rcx + 8]
cmp rdx, r14
ja 0x140876ba2
cmp rdx, 8
jb 0x140876ba2
cmp rdx, rcx
jb 0x140876ba2
mov ecx, dword [rax + 4]
mov edx, 0x40
mov ebx, dword [rax]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
mov dword [rsp + 0x78], ebx
call fcn.1408772a0
test al, al
jne 0x140876a01
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140876a01
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x140876a01
lea rbx, [rsi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x1408769fd
cmp dword [rbx], 0x4550
jne 0x1408769fd
mov edx, 0xf8
mov rcx, rbx
call fcn.1408772a0
mov ebx, dword [rsp + 0x78]
mov r10d, dword [rsp + 0x20]
xor r13d, r13d
test r10d, r10d
je 0x140876b9e
mov r11d, 0x1000
nop dword [rax + rax]
lea eax, [rbx + r13]
lea r15, [rax + rsi]
mov ecx, eax
test r15, r15
je 0x140876ba2
cmp r15, rsi
jb 0x140876ba2
add rax, 8
cmp rax, r14
ja 0x140876ba2
cmp rax, 8
jb 0x140876ba2
cmp rax, rcx
jb 0x140876ba2
mov eax, dword [r15 + 4]
test eax, eax
je 0x140876b9e
mov r9d, dword [r15]
lea rbp, [rax - 8]
shr rbp, 1
lea rax, [r15 + 8]
mov dword [rsp + 0x24], r9d
test rax, rax
je 0x140876ba2
cmp rax, rsi
jb 0x140876ba2
sub rax, rsi
lea rbx, [rax + 2]
cmp rbx, r14
ja 0x140876ba2
cmp rbx, 2
jb 0x140876ba2
cmp rbx, rax
jb 0x140876ba2
test rbp, rbp
je 0x140876b8d
xor r8d, r8d
test rbp, rbp
je 0x140876b8d
mov rax, rbx
nop dword [rax + rax]
lea rdx, [rsi - 2]
add rdx, rax
je 0x140876b09
cmp rdx, rsi
jb 0x140876b09
cmp rax, r14
ja 0x140876b09
cmp rax, 2
jb 0x140876b09
lea rcx, [rax - 2]
cmp rax, rcx
jb 0x140876b09
cmp word [rdx], r11w
jae 0x140876b09
add rax, 2
inc r8
cmp r8, rbp
jb 0x140876ad0
jmp 0x140876b8d
xor edi, edi
nop dword [rax + rax]
lea rcx, [rsi - 2]
add rcx, rbx
je 0x140876b7d
cmp rcx, rsi
jb 0x140876b7d
cmp rbx, r14
ja 0x140876b7d
cmp rbx, 2
jb 0x140876b7d
lea rax, [rbx - 2]
cmp rbx, rax
jb 0x140876b7d
movzx eax, word [rcx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
test eax, eax
je 0x140876b7d
cmp eax, 3
je 0x140876b4e
cmp eax, 0xa
jne 0x140876ba2
add ecx, r9d
cmp rcx, r14
jae 0x140876ba2
test r12, r12
je 0x140876b71
mov rax, qword [r12]
lea rdx, [rcx + rsi]
mov rcx, r12
call qword [rax]
test al, al
je 0x140876ba2
mov r9d, dword [rsp + 0x24]
add rbx, 2
inc rdi
cmp rdi, rbp
jb 0x140876b10
test rdi, rdi
je 0x140876ba2
mov r10d, dword [rsp + 0x20]
mov r11d, 0x1000
add r13d, dword [r15 + 4]
mov ebx, dword [rsp + 0x78]
cmp r13d, r10d
jb 0x140876a20
mov al, 1
jmp 0x140876ba4
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140876bd0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov r14, rcx
call fcn.1408761a0
test eax, eax
je 0x140876e58
mov edi, eax
test rbp, rbp
jne 0x140876c01
mov ebp, edi
mov edx, 9
mov rcx, r14
call fcn.140875fa0
test rax, rax
je 0x140876e58
mov eax, dword [rax]
test eax, eax
je 0x140876e58
mov ebx, eax
add rbx, r14
je 0x140876e58
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x140876e58
cmp rbx, r14
jb 0x140876c5c
lea rax, [rdi + r14]
cmp rbx, rax
jae 0x140876c5c
mov rax, rbx
mov ecx, 0xffffffff
sub rax, r14
cmp rax, rcx
jae 0x140876c70
sub ebx, r14d
jmp 0x140876c72
cmp rbx, rdi
jae 0x140876e58
mov ecx, 0xffffffff
cmp rbx, rcx
cmovb ecx, ebx
mov ebx, ecx
test r14, r14
je 0x140876db8
mov edx, 0x40
mov rcx, r14
call fcn.1408772a0
test al, al
jne 0x140876db8
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x140876db8
movsxd rax, dword [r14 + 0x3c]
cmp eax, 0x400
jg 0x140876db8
lea rdi, [r14 + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x140876db8
cmp dword [rdi], 0x4550
jne 0x140876db8
mov edx, 0xf8
mov rcx, rdi
call fcn.1408772a0
test al, al
mov eax, ebx
lea rcx, [rax + r14]
jne 0x140876dc7
mov edx, 0x20b
cmp word [rdi + 0x18], dx
jne 0x140876dbe
test rcx, rcx
je 0x140876e51
cmp rcx, r14
jb 0x140876e51
lea rbx, [rax + 8]
cmp rbx, rbp
ja 0x140876e51
cmp rbx, 8
jb 0x140876e51
cmp rbx, rax
jb 0x140876e51
mov rcx, r14
call fcn.1408761a0
xor edi, edi
nop dword [rax]
lea rcx, [r14 - 8]
add rcx, rbx
je 0x140876e53
cmp rcx, r14
jb 0x140876e53
cmp rbx, rbp
ja 0x140876e53
cmp rbx, 8
jb 0x140876e53
lea rax, [rbx - 8]
cmp rbx, rax
jb 0x140876e53
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140876e53
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140876da2
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 8
jmp 0x140876d40
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.1408770c0
inc rdi
add rbx, 8
jmp 0x140876d40
mov eax, ebx
lea rcx, [r14 + rax]
test r14, r14
je 0x140876e51
test rcx, rcx
je 0x140876e51
cmp rcx, r14
jb 0x140876e51
lea rbx, [rax + 4]
cmp rbx, rbp
ja 0x140876e51
cmp rbx, 4
jb 0x140876e51
cmp rbx, rax
jb 0x140876e51
mov rcx, r14
call fcn.1408761a0
xor edi, edi
lea rcx, [r14 - 4]
add rcx, rbx
je 0x140876e53
cmp rcx, r14
jb 0x140876e53
cmp rbx, rbp
ja 0x140876e53
cmp rbx, 4
jb 0x140876e53
lea rax, [rbx - 4]
cmp rbx, rax
jb 0x140876e53
mov eax, dword [rcx]
test eax, eax
je 0x140876e53
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x40], rax
cmp rdx, qword [rsi + 0x10]
je 0x140876e3b
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 4
jmp 0x140876df3
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.1408770c0
inc rdi
add rbx, 4
jmp 0x140876df3
xor edi, edi
mov rax, rdi
jmp 0x140876e5a
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1408774e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov r10, rcx
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
movzx eax, byte [rdx + 2]
movzx r9d, byte [rdx + 3]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx + 1]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx]
shl r9d, 8
or r9d, eax
mov dword [rcx + 0x10], r9d
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x18], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x1c], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x20], ecx
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x24], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x28], ecx
movzx eax, byte [rdx + 0x1e]
movzx ecx, byte [rdx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
xor eax, eax
mov dword [r10 + 0x2c], ecx
mov qword [r10 + 0x30], rax
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x38], ecx
movzx eax, byte [r8 + 6]
movzx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov rax, r10
mov dword [r10 + 0x3c], ecx
ret
Function at 0x140878270
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
movzx r14d, r8b
mov rsi, rdx
mov rdi, rcx
mov rbp, qword gs:[0x60]
test rbp, rbp
je 0x1408782ba
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop
mov qword [rbp + 0x10], rdi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rdx, rdi
mov rcx, rdi
call fcn.1408741d0
mov rbx, rsi
test rsi, rsi
jne 0x1408782df
mov rcx, rdi
call fcn.1408761a0
test eax, eax
je 0x1408783da
mov ebx, eax
mov edx, 3
mov rcx, rdi
call fcn.140875fa0
test rax, rax
je 0x1408783da
mov ecx, dword [rax]
test ecx, ecx
je 0x1408783da
mov edx, dword [rax + 4]
test edx, edx
je 0x1408783da
lea rbp, [rcx + rdi]
test rdi, rdi
je 0x1408783da
test rbp, rbp
je 0x1408783da
cmp rbp, rdi
jae 0x140878340
mov rdx, rsi
mov rcx, rdi
call fcn.140874930
mov rdx, rsi
mov rcx, rdi
call fcn.140876e70
jmp 0x1408783f9
lea rax, [rcx + rdx]
cmp rax, rbx
ja 0x140878325
cmp rax, rdx
jb 0x140878325
cmp rax, rcx
jb 0x140878325
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
mov r11, rdx
shr r11, 3
xor edx, edx
test r11, r11
je 0x1408783da
mov r8, rbp
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [r8 + 8]
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x20]
mov r9d, ecx
lea r10, [rcx + rdi]
mov rax, qword [rsp + 0x20]
shr rax, 0x20
sub eax, ecx
mov ecx, eax
test r10, r10
je 0x1408783c4
cmp r10, rdi
jb 0x1408783c4
add rax, r9
cmp rax, rbx
ja 0x1408783c4
cmp rax, rcx
jb 0x1408783c4
cmp rax, r9
jb 0x1408783c4
inc rdx
add r8, 0xc
cmp rdx, r11
jb 0x140878371
test rdx, rdx
je 0x1408783da
mov r8, rdi
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlAddFunctionTable]
jmp 0x140878325
mov rdx, rsi
mov rcx, rdi
call fcn.140874930
mov rdx, rsi
mov rcx, rdi
call fcn.140876e70
test rdi, rdi
je 0x1408784b4
mov edx, 0x40
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x1408784b4
mov ebx, 0x5a4d
cmp word [rdi], bx
jne 0x1408784b4
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1408784b4
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.1408772a0
test al, al
jne 0x1408784b4
cmp dword [rsi], 0x4550
jne 0x1408784b4
mov edx, 0x40
mov rcx, rdi
call fcn.1408772a0
test al, al
jne 0x140878493
cmp word [rdi], bx
jne 0x140878493
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140878493
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.1408772a0
test al, al
jne 0x140878493
cmp dword [rbx], 0x4550
jne 0x140878493
mov edx, 0xf8
mov rcx, rbx
call fcn.1408772a0
mov eax, dword [rsi + 0x28]
test eax, eax
je 0x1408784b4
add rax, rdi
test r14b, r14b
je 0x1408784b0
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call rax
jmp 0x1408784b9
call rax
jmp 0x1408784b9
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14087aa7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14087aac6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14087aac6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14087aac6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14087aac6
cmp dword [rcx + 0x84], 0xe
jbe 0x14087aac6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14087aac8
xor al, al
add rsp, 0x28
ret

Function at 0x140883788
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140883578
Function at 0x140887c8c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140887d13
mov rsi, rbx
cmp word [rax], bp
je 0x140887cd2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140887cbc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140887cb8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1408852d4
mov rdi, rax
test rax, rax
je 0x140887d00
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14087bcc0
mov rbp, rdi
xor ecx, ecx
call fcn.140884730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1406aa058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406aa1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406aa089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406aa06f
add dl, dl
jne 0x1406aa096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406aa0f6
xor eax, eax
add dl, dl
jne 0x1406aa0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406aa1ad
add dl, dl
jne 0x1406aa0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406aa0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406aa07e
mov eax, 1
add dl, dl
jne 0x1406aa106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406aa113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406aa0fb
sub eax, ebx
mov ebx, 1
jne 0x1406aa14c
mov ecx, 1
add dl, dl
jne 0x1406aa12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406aa13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406aa123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406aa07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406aa168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406aa175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406aa15d
cmp eax, 0x7d00
jae 0x1406aa19b
cmp eax, 0x500
jb 0x1406aa196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406aa07e
cmp eax, 0x7f
ja 0x1406aa19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406aa07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406aa1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406aa07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20