joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401146d7
Capabilities:
Hash data using fnv

Disassembly:
mov rdx, rcx
mov r9d, 8
test rcx, rcx
jmp 0x140543421
je 0x1404a6797
mov r8d, 0x811c9dc5
jmp 0x1404aeccd
ret
je 0x140721aa1
mov rcx, r9
jmp 0x1405bc414
sub eax, eax
jmp 0x14024e9dc
inc rdx
movzx eax, al
test r9b, dl
test r12w, 0x6bc1
jmp 0x14085b749
ret
je 0x1404a6797
mov al, byte [rcx]
stc
test al, al
jmp 0x140167d9f
dec r9
test rcx, rcx
jmp 0x140721a9b
jne 0x1404aeccd
mov eax, r8d
jmp 0x1405271af
xor eax, r8d
movzx r8w, bl
clc
imul r8d, eax, 0x1000193
adc al, 0xa3
mov al, byte [rdx]
clc
test al, al
jmp 0x14035fd91

Function at 0x140180d34
Capabilities:
Hash data using fnv

Disassembly:
test rcx, rcx
je 0x1402e6a3f
mov al, byte [rcx]
mov edx, 0x811c9dc5
cmc
test al, al
jmp 0x14056ef0f
xor eax, edx
or dh, 0xb9
rcl edx, cl
movsx edx, r10w
imul edx, eax, 0x1000193
xor al, r9b
mov al, byte [rcx]
test al, al
jne 0x14056ef15
mov eax, edx
jmp 0x1404b1b84
xor eax, eax
jmp 0x14071fe4f
ret
je 0x1402e6a3f
inc rcx
cmp dl, r11b
cmp r9b, 0x55
movzx eax, al
test r11b, 0x66
jmp 0x1401ac6fa
ret

Function at 0x14019e161
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
sub eax, eax
jmp 0x14063ce97
lea rcx, [rcx + 2]
xor eax, edx
cmp r10b, 0xf7
sal dl, cl
movzx rdx, r9w
imul edx, eax, 0x1000193
stc
nop
movzx eax, word [rcx]
cmc
test ax, ax
jne 0x14024ea83
mov eax, edx
jmp 0x140704c57
test rcx, rcx
je 0x1400c8903
movzx eax, word [rcx]
movsxd rdx, r9d
xchg dx, dx
mov edx, 0x811c9dc5
test r9b, bl
test ax, ax
jmp 0x14024ea7d
je 0x1400c8903
movzx eax, ax
jmp 0x14012985c
ret
ret

Function at 0x14044ff31
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
je 0x1404f8039
mov r10d, 0x811c9dc5
cbw
rcr ecx, 0xc9
lea eax, [r9 - 0x41]
movzx cx, r12b
shr cl, 0x47
cmp ax, 0x19
cbw
cdqe
movsxd rcx, esp
lea ecx, [r9 + 0x20]
mov al, r12b
lea r8, [r8 + 2]
lahf
movzx rax, r13w
jmp 0x1407e3df5
je 0x1404f8039
movzx r9d, word [rcx]
stc
test ebp, 0x2afa279c
jmp 0x1403793cb
ret
test r9w, r9w
jmp 0x1400d8500
mov r8, rcx
test bl, ah
test rcx, rcx
jmp 0x140206dc3
sub eax, eax
jmp 0x1402f6df9
ret
cmova cx, r9w
movzx r9d, word [r8]
movzx eax, cx
test r9b, 0x2c
cmp bl, r9b
cmp dil, 0xb0
xor eax, r10d
imul r10d, eax, 0x1000193
test cx, bx
test r9w, r9w
je 0x14084b6b0
mov rcx, rdx
jmp 0x14084b6a4
dec rdx
test rcx, rcx
jne 0x1400d8511
mov eax, r10d
jmp 0x140722ab6

Function at 0x1404679d6
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
xor eax, eax
ret
je 0x1400a1682
test rdx, rdx
jmp 0x140437684
xor eax, r8d
adc r8, r10
imul r8d, eax, 0x1000193
cmc
clc
sub rdx, 1
jmp 0x1407c45bd
je 0x1400a1682
mov r8d, 0x811c9dc5
sal ch, 0x9c
add eax, 0x61c82a00
movzx eax, word [r9]
movzx rcx, r8w
movzx ecx, word [r9]
stc
clc
test bl, bpl
sub ax, 0x41
add cx, 0x20
cmp ax, 0x19
movsxd rax, r15d
mov ah, 0xfa
cwde
cmova cx, word [r9]
movsx eax, r9w
cmp rdx, 0xf810b4f
lea r9, [r9 + 2]
movzx eax, cx
clc
jmp 0x1402f8261
mov r9, rcx
cmp ah, 0x96
clc
test rcx, rcx
jmp 0x1402c4fc6
jne 0x140437698
mov eax, r8d
ret
Function at 0x14061507d
Capabilities:
Hash data using fnv

Disassembly:
ret
jb 0x1404a473b
mov eax, ecx
jmp 0x140158307
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
cmc
cmp r8, rdx
jmp 0x14018fd95
je 0x14018fd9b
movzx eax, byte [r8 + r9]
jmp 0x140276446
xor r8d, r8d
btc r9, rax
sal r9w, cl
mov r9, rcx
clc
stc
cmp dx, 0x12f4
test rcx, rcx
jmp 0x14087b26b
mov ecx, 0x811c9dc5
test rdx, rdx
jmp 0x1404a4735
jne 0x1407c6357
sub eax, eax
jmp 0x1408839b4
ret

Function at 0x1406fc8ca
Capabilities:
Hash data using fnv

Disassembly:
je 0x1404821fd
mov r9d, 0x811c9dc5
lea eax, [r8 - 0x41]
adc cx, r10w
cmp ax, 0x19
lea ecx, [r8 + 0x20]
lea rdx, [rdx + 2]
cmova cx, r8w
btr r8w, sp
movzx r8d, word [rdx]
bswap rax
and eax, r14d
test r8d, 0x30c640e0
movzx eax, cx
test r10b, dl
xor eax, r9d
imul r9d, eax, 0x1000193
test r14d, r9d
clc
test r8w, r8w
jmp 0x140358cb0
ret
jne 0x1401fc447
mov eax, r9d
jmp 0x1402f8090
je 0x1404821fd
movzx r8d, word [rcx]
cmp r8, rbx
stc
cmp sil, 0x4f
test r8w, r8w
jmp 0x1401fc43b
test rcx, rcx
jmp 0x1403a52a9
sub eax, eax
jmp 0x14082b180
mov rdx, rcx
test r14, rbp
cmp al, 0x7e
jmp 0x1403d9be3
ret

Function at 0x140878dce
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
ret
test rcx, rcx
jmp 0x1403c6f7b
sub eax, eax
jmp 0x140155398
je 0x1402b3f43
mov r9b, byte [rcx]
test r9w, bp
jmp 0x14050b24d
test r9b, r9b
je 0x1402b3f43
mov r10d, 0x811c9dc5
xchg cl, al
movzx edx, r9b
shrd cx, r13w, 0x2f
xor ecx, r13d
xchg cx, ax
sub r9b, 0x41
cmp r9b, 0x19
cdqe
lahf
lea eax, [rdx + 0x20]
movzx ecx, al
xchg r9b, r9b
cmova ecx, edx
inc r8
movzx eax, cl
neg r9b
inc r9b
or r9b, 0xfe
xor eax, r10d
or r10b, 2
inc r10b
or r10b, al
imul r10d, eax, 0x1000193
mov r9b, byte [r8]
cmc
stc
test r9b, r9b
jne 0x14050b25e
mov eax, r10d
ret
mov r8, rcx
jmp 0x140268d22
Function at 0x14089e4da
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
cmc
jmp 0x14089e4f3
mov qword [rax + 8], rbx
test si, 0x4943
test ax, sp
mov qword [rax + 0x10], rbp
test r13b, 0xad
sub bp, dx
mov qword [rax + 0x18], rsi
bts ebp, eax
sbb sil, r15b
mov qword [rax + 0x20], rdi
push r14
sar r14b, cl
add r14b, 0xb0
stc
sub rsp, 0x20
and ebp, edx
cbw
not bpl
mov rax, qword gs:[0x60]
mov r14b, r8b
rcr bpl, 0xcb
bswap ebp
shl rbp, 0x98
mov ebp, ecx
ror sil, cl
bsr si, r13w
rcr si, 0xbd
mov rsi, qword [rax + 0x18]
test rsi, rsi
jmp 0x14089e55d
je 0x14089e610
add rsi, 0x10
xor edi, edi
setno bl
shld bx, si, 0xeb
xor ebp, 0x75ede3db
movsxd rbx, r15d
mov rbx, qword [rsi]
clc
cmp r12b, 8
test r8b, r8b
jmp 0x14089e58a
je 0x14089e5c7
call 0x1403e1b45
jmp 0x14089e5c7
movzx edx, word [rbx + 0x58]
bswap rcx
shl cl, cl
cmovl cx, ax
mov rcx, qword [rbx + 0x60]
test al, 0xca
clc
shr rdx, 1
jmp 0x14089e5b7
call fcn.14044ff31
cmp eax, ebp
je 0x14089e5d5
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x14089e59b
jmp 0x14089e5e0
mov rdi, rbx
jmp 0x14089e5e0
test r14b, r14b
jmp 0x14089e5e8
je 0x14089e5f3
call 0x14036e903
test rdi, rdi
jmp 0x14089e5fc
je 0x14089e610
mov rax, qword [rdi + 0x30]
jmp 0x14089e60b
jmp 0x14089e612
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
bts si, cx
add si, r9w
rcr r14d, 0x4f
mov rsi, qword [rsp + 0x40]
movsx r14w, dil
test r10w, 0x33fc
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x14089e648
ret
Function at 0x14089ef08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
cmp r11b, 0xa4
jmp 0x14089ef29
mov qword [rax + 8], rbx
shl rbx, cl
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
movzx di, r13b
sar bl, cl
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
shl dil, 0
mov bx, 0x5bf5
sub esi, esi
mov rdi, rdx
shld ebx, r15d, 0xad
bswap rbx
mov dword [rbp + 7], 0x4b005c
shl bl, 0x2b
shrd ebx, r9d, 0x66
add dil, 0x48
mov qword [rbp + 0x7f], rsi
setne bh
mov rbx, r8
mov dword [rbp + 0xb], 0x6f006e
dec dil
movzx di, sil
mov rdi, rcx
cmp r10d, r14d
mov dword [rbp + 0xf], 0x6e0077
clc
mov dword [rbp + 0x13], 0x6c0044
clc
mov dword [rbp + 0x17], 0x73006c
mov dword [rbp + 0x1b], 0x320033
jmp 0x14089efb5
mov word [rbp + 0x1f], si
test dl, dl
jmp 0x14089efc0
jne 0x14089efd1
mov word [rbp + 0x1b], si
xchg dl, ch
cmovns cx, r9w
lea rdx, [rbp + 7]
movsx rcx, r9w
mov cx, 0x649a
lea rcx, [rbp - 0x19]
jmp 0x14089efe6
call 0x14024eaaa
lea rax, [rbp - 0x19]
jmp 0x14089eff5
mov dword [rbp + 0x27], 0x30
jmp 0x14089f001
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
movsxd rcx, esi
movzx cx, cl
lea r8, [rbp + 0x27]
cwd
movsx rcx, r15w
movzx edx, r12w
mov qword [rbp + 0x2f], rsi
cdq
mov edx, 3
mov dword [rbp + 0x3f], 0x40
lea rcx, [rbp + 0x7f]
jmp 0x14089f037
movdqu xmmword [rbp + 0x47], xmm0
call fcn.1402686b7
test eax, eax
jmp 0x14089f048
js 0x14089f0db
mov rdx, rdi
movsxd rcx, edi
lea rcx, [rbp - 9]
jmp 0x14089f05d
call 0x1400f569c
mov rax, qword [rbp + 0x7f]
movzx r8, r13w
movsx r8d, r13w
lea r8, [rbp + 0x27]
jmp 0x14089f078
mov qword [rbp + 0x2f], rax
jmp 0x14089f081
xorps xmm0, xmm0
lea rax, [rbp - 9]
movzx cx, r9b
mov dword [rbp + 0x27], 0x30
mov edx, 0xf
mov cl, 0x95
mov qword [rbp + 0x37], rax
mov rcx, rbx
jmp 0x14089f0a7
mov dword [rbp + 0x3f], 0x40
jmp 0x14089f0b3
movdqu xmmword [rbp + 0x47], xmm0
call fcn.1404f7df5
mov rcx, qword [rbp + 0x7f]
mov bl, 0x94
movsxd rbx, edx
mov ebx, eax
jmp 0x14089f0cd
call fcn.14021d808
mov eax, ebx
mov r11b, dil
movzx di, dl
lea r11, [rsp + 0x90]
movsx rsi, di
mov rbx, qword [r11 + 0x10]
movsx esi, r15w
cmovae di, r10w
mov rsi, qword [r11 + 0x18]
movzx edi, r9w
sete bpl
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
jmp 0x14089f10d
ret
Function at 0x1408a25b5
Capabilities:
Execute anti-debugging instructions
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
shl ebp, cl
mov qword [rsp + 0x20], rsi
test rbp, 0x2f86b68
push rdi
movsxd rdi, ebp
rcl r10b, cl
sar r10, cl
push r14
rcl dil, 0xf
sal dil, 0xa
btc bp, r10w
mov r8, rdx
add si, 0x7af0
mov r9, rdx
shr r8, 3
bswap rdi
mov bp, 0x3bba
mov rdi, rcx
setns r14b
movsx r14, r13w
movabs rsi, 0xcbf29ce484222325
mov r10b, 0x89
movabs rbp, 0x100000001b3
bswap r14
movabs r14, 0x7080100200400801
movsxd r10, edi
mov r10d, 8
jmp 0x1408a2639
jmp 0x1408a26f4
dec r8
sub dx, 0x2d77
sal dl, cl
bsr rbx, r15
rdtsc
bswap r11d
btr bx, 9
shl rdx, 0x20
shld bx, bx, 0x29
btr r11w, si
shl bh, cl
lea r11, [rsp + 0x18]
shrd bx, r8w, 0x35
rol ch, cl
or rax, rdx
mov rbx, r10
mov rcx, rax
movsx edx, dx
bswap dx
cqo
ror rcx, 3
xor rcx, rax
bt dx, r13w
mov rax, r14
add dl, al
movzx dx, sil
and dx, 0xdc
mul rcx
mov rcx, rsi
test dl, 0xd8
cmc
xor rdx, rax
not eax
cdqe
mov qword [rsp + 0x18], rdx
mov al, r12b
movzx eax, byte [r11]
jmp 0x1408a26c1
inc r11
xor rcx, rax
imul rcx, rbp
test r13, 0x72eb1b3d
cmc
jmp 0x1408a26d8
sub rbx, 1
jne 0x1408a26b8
xor rcx, rdx
cmc
mov qword [rdi], rcx
stc
clc
jmp 0x1408a26f0
lea rdi, [rdi + r10]
test r8, r8
jne 0x1408a263e
and r9d, 7
je 0x1408a27da
rdtsc
bsr rcx, r12
shl rdx, 0x20
movzx rcx, sp
adc cl, bpl
or rax, rdx
not ch
movzx cx, bh
mov rcx, rax
clc
ror rcx, 3
xor rcx, rax
mov al, 0x6d
ror rdx, 0x46
mov rax, r14
cqo
clc
mul rcx
bt rcx, rbp
shl cl, 0xf0
or rcx, 0x666f1198
lea rcx, [rsp + 0x18]
jmp 0x1408a2753
xor rdx, rax
dec al
cmovb ax, ax
xchg ah, al
mov qword [rsp + 0x18], rdx
movzx eax, byte [rcx]
jmp 0x1408a276b
inc rcx
xor rsi, rax
test r9b, r13b
imul rsi, rbp
cmp spl, 0x6d
sub r10, 1
jmp 0x1408a2785
jne 0x1408a2763
xor rdx, rsi
jmp 0x1408a2796
mov qword [rsp + 0x18], rdx
jmp 0x1408a27a7
test rdi, rdi
jmp 0x1408a27af
je 0x1408a27da
lea rsi, [rsp + 0x18]
movsx bx, dil
movsxd rbp, r15d
mov rcx, r9
movzx rbx, sp
movsx r14w, r11b
sets bl
rep movsb byte [rdi], byte [rsi]
movsx edi, r9w
xchg bpl, sil
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
not esi
bswap di
mov dil, 0xb0
mov rsi, qword [rsp + 0x30]
pop r14
not dil
movzx rdi, r15w
xchg dil, dil
pop rdi
jmp 0x1408a2803
ret
Function at 0x1408a2e89
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
sar bh, cl
rcr rbx, 0xcd
add bp, 0x4869
push rsi
btc esi, 0x34
movsx rbx, r11w
push rdi
bsr rsi, rdi
lea rbp, [rsp - 0x430]
dec sil
ror bh, cl
sub rsp, 0x530
btr si, 0x5b
bt si, dx
xchg esi, esi
cmp qword [rcx], 0
mov rsi, rdx
movsxd rbx, r9d
mov bx, bp
movzx ebx, r11w
mov rbx, rcx
jmp 0x1408a2ee0
je 0x1408a2f1a
add rcx, 0x90
lea rax, [rbx + 0x10]
jmp 0x1408a2ef6
jmp 0x1408a2f11
cmp byte [rax + 0x18], 0
jne 0x1408a2f54
add rax, 0x20
cmp r11b, sil
stc
cmp r12b, 0xa5
cmp rax, rcx
jne 0x1408a2efb
and dword [rsi], 0
bts bp, bp
bts rdi, r12
mov rbx, qword [rsp + 0x558]
rcr di, cl
btr di, 0xbb
add rsp, 0x530
xchg rbp, rsi
pop rdi
movzx bp, r8b
movzx rbp, r8w
pop rsi
movsx ebp, bx
pop rbp
jmp 0x1408a2f53
ret
mov rcx, qword [rbx]
movzx r9d, di
jmp 0x1408a2f66
lea r8, [rsp + 0x30]
bswap r9d
neg r9b
xor r9b, 0xc4
and qword [rsp + 0x20], 0
adc r9b, dl
bts r9w, r10w
btr r9w, 0xba
mov r9d, 0x30
test spl, 0xbd
cmc
cmp r11d, edi
xor edx, edx
jmp 0x1408a2f9e
call fcn.140205f97
mov dword [rsi], eax
test eax, eax
jmp 0x1408a2fac
js 0x1408a2fc5
cmp dword [rsp + 0x30], 0x103
jmp 0x1408a2fbf
jne 0x1408a2f1a
mov rcx, qword [rbx]
xchg dh, dh
cwd
lea rdx, [rbp + 0x460]
jmp 0x1408a2fd8
call fcn.140455cbb
mov dword [rsi], eax
test eax, eax
js 0x1408a2f25
sub eax, eax
movsx rdi, dx
movsxd rdx, edi
movsx edi, r8w
lea rdi, [rsp + 0x60]
cdq
cmovle cx, r15w
movzx cx, r14b
mov ecx, 0x4d0
lea rdx, [rsp + 0x60]
rep stosb byte [rdi], al
bswap cx
setp ch
xchg ecx, ecx
mov rcx, qword [rbx]
jmp 0x1408a3020
mov dword [rbp - 0x70], 0x100010
jmp 0x1408a302c
call fcn.1402d1f06
mov dword [rsi], eax
test r11b, bpl
test eax, eax
jmp 0x1408a303d
jns 0x1408a306a
mov rcx, qword [rbx]
lea rdx, [rbp + 0x450]
and dword [rbp + 0x450], 0
jmp 0x1408a3059
call fcn.1405cf576
mov dword [rsi], eax
jmp 0x1408a3065
jmp 0x1408a2f25
lea rdx, [rbp - 0x58]
inc ecx
xor edi, edi
rcl rcx, 0x77
lea rcx, [rbx + 0x28]
stc
cmp byte [rcx], 0
jmp 0x1408a3083
je 0x1408a30c5
mov rax, qword [rcx - 0x10]
test r9w, 0x1a65
cmp qword [rdx], rax
jmp 0x1408a309b
jne 0x1408a30be
and qword [rdx], 0
cdqe
mov rax, qword [rbp - 0x30]
clc
jmp 0x1408a30b2
btr rax, rdi
clc
cmp ax, bx
mov qword [rbp - 0x30], rax
mov byte [rcx], 0
cmp sil, 9
add rcx, 0x20
test bpl, r9b
cmp r15, 0x79591b91
add rdi, 2
clc
add rdx, 8
stc
cmp rdi, 8
jb 0x1408a307b
mov rcx, qword [rbx]
lea rdx, [rsp + 0x60]
jmp 0x1408a30f4
call fcn.1405c9a2b
mov dword [rsi], eax
jmp 0x1408a3043
Function at 0x1408b600e
Capabilities:
Authenticate hmac

Disassembly:
mov rax, rsp
cmc
mov qword [rax + 8], rcx
clc
shld ecx, r9d, 0x5c
push rbp
rcl cl, cl
push rsi
push rdi
add esi, 0x5b7d7bfe
movzx cx, r14b
push r12
push r13
rcr bp, 0xa0
movzx rcx, cx
push r14
rcr ebp, cl
push r15
bsf r14d, r9d
shl bpl, 0xcd
mov rbp, rsp
sub rsp, 0x60
xor r13b, 0x87
sbb r13b, r10b
mov qword [rbp - 0x30], 0xfffffffffffffffe
sbb si, 0x2348
jmp 0x1408b6066
mov qword [rax + 0x10], rbx
sal r13b, 0x36
sbb r14w, 0x4017
mov r14, r9
not ecx
mov r13b, r8b
cbw
sbb sil, 0xea
mov r15, rdx
sal r8b, cl
mov dword [rbp - 0x28], 0x6c2f0b27
cmc
mov dword [rbp - 0x24], 0xf07aa625
and si, r14w
xadd r8b, cl
mov dword [rbp - 0x20], 0x19b7a0af
bsr si, r10w
movzx ax, sil
dec sil
and dword [r9], 0
rol ecx, 0xbe
lea rsi, [rbp - 0x28]
shrd ax, r13w, 0xb7
clc
xor edi, edi
add cx, 0x4e54
cwde
lea rcx, [rbp - 0x1c]
movsxd rax, edi
add al, r10b
or r9, rcx
lea rax, [rbp - 0x28]
sal r9b, 0x17
adc r9w, r8w
mov r8w, 0x12a2
cmp rcx, rax
cdqe
cmovae rcx, r12
sbb rbx, rbx
not rbx
rcl r8d, 0x17
mov r8w, 0x27fa
and ebx, 3
movzx r8, dx
jmp 0x1408b6111
mov eax, dword [rsi]
cmp r14, r8
mov dword [rbp - 0x18], eax
movsx ecx, r8w
btc r9w, r12w
and qword [rbp - 0x10], 0
or cx, 0x6b89
lea r9, [fcn.140036818]
xor rcx, rsi
bts cx, r13w
lea r8, [rbp - 0x18]
xor edx, edx
movzx ecx, sp
movsxd rcx, r8d
mov rcx, qword [r15]
jmp 0x1408b614f
call fcn.14089e76f
nop
bsf ax, r14w
mov rax, qword [rbp - 0x10]
test rax, rax
jmp 0x1408b6166
je 0x1408b629f
and dword [rbp + 0x40], 0
movsxd rcx, r15d
sar dl, 0xca
adc cx, 0x6674
and qword [rbp + 0x58], 0
lea r12, [rax + 0x34]
lea rax, [rbp + 0x58]
mov r9b, bl
xchg r9b, r8b
mov qword [rsp + 0x20], rax
cwd
movsx r8w, r13b
movsx rcx, dx
mov r9d, 4
xchg cx, dx
movzx rcx, r13w
mov ch, 0x20
lea r8, [rbp + 0x40]
mov rdx, r12
cmovl ecx, r13d
bswap cx
mov ecx, 0x7b666e73
mov rcx, qword [r15]
call fcn.1401e79ee
nop
ror edx, 0x28
rcr dl, cl
mov dx, r13w
mov edx, eax
cmc
test eax, eax
jmp 0x1408b61dd
js 0x1408b6292
test r13b, r13b
jmp 0x1408b61eb
je 0x1408b6223
mov ecx, dword [rbp + 0x40]
mov eax, 0x40000
cmp al, r9b
stc
jmp 0x1408b6202
test eax, ecx
jmp 0x1408b6209
jne 0x1408b6285
or ecx, eax
jmp 0x1408b6216
mov dword [rbp + 0x40], ecx
jmp 0x1408b621e
jmp 0x1408b624f
mov eax, dword [rbp + 0x40]
clc
stc
bt eax, 0x12
jmp 0x1408b6231
jae 0x1408b6285
btr eax, 0x12
xor r8w, 0x72ed
and rcx, r12
cmp bp, r14w
mov dword [rbp + 0x40], eax
shl dl, 5
cmc
and qword [rsp + 0x20], 0
mov r9d, 4
mov r8w, r8w
cdq
movsx edx, r11w
lea r8, [rbp + 0x40]
movzx ecx, r15w
mov rdx, r12
mov rcx, qword [r15]
call fcn.1407c2c68
nop
bswap edx
mov edx, eax
test r14w, r11w
clc
cmp r9b, 0x91
test edx, edx
jmp 0x1408b628c
jns 0x1408b62aa
mov dword [r14], edx
jmp 0x1408b629a
jmp 0x1408b62aa
mov dword [r14], 0xc0000225
stc
test ah, 0xb1
add rsi, 4
jmp 0x1408b62b3
inc rdi
cmc
cmp rdi, rbx
jmp 0x1408b62bf
jne 0x1408b6111
mov rbx, qword [rsp + 0xa8]
movzx si, bl
add rsp, 0x60
xchg sil, r15b
movsx r12, si
movzx r12d, si
pop r15
not di
pop r14
xchg r13w, di
mov dil, r10b
pop r13
bswap r12w
pop r12
movsx di, r11b
setne bpl
bswap rdi
pop rdi
pop rsi
xchg bpl, bpl
movzx ebp, r10w
pop rbp
ret
Function at 0x140005400
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140005434
cmp word [rcx], 0x5a4d
jne 0x140005434
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140005434
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005434
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140005340
test eax, eax
jne 0x140005450
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400053b0
test rax, rax
je 0x140005445
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140005bff
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140005b00
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140005aa0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005f64
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14053def8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14053def4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140005fb2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140005faa
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140006099
inc ebx
add rax, 0x28
jmp 0x140005f8a
mov rcx, r12
call fcn.140006791
mov rbp, rax
test rax, rax
jne 0x140005fd1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140005f00
movsxd rbx, ebx
mov rax, qword [0x14053def8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.14000683f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14053def8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140006033
mov rax, qword [0x14053def8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140005f00
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140006093
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140006093
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14053def8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140006093
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140005f00
inc dword [0x14053def4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400064c0
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14053df60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14053df40]
test rbx, rbx
je 0x14000650c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140006506
test eax, eax
jne 0x140006506
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x1400064de
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400066c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400066e3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400066e3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400066e4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x14000671e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140006715
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140006720
inc r8d
add rax, 0x28
jmp 0x1400066fc
xor eax, eax
ret

Function at 0x140006791
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140539a70]
mov r8, rcx
mov rcx, r9
call fcn.1400066c0
test eax, eax
je 0x1400067bd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1400066e4
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001144
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
xor eax, eax
test rcx, rcx
je 0x140001178
mov word [rcx], ax
mov rdx, rcx
lea rcx, str._JAVA_VM_OPTIONS
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x3fe
ja 0x140001178
mov eax, 1
jmp 0x14000117a
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001f0c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140011018]
xor rax, rsp
mov qword [rsp + 0x260], rax
movsxd r14, edx
mov rsi, rcx
xor ebx, ebx
mov word [rcx], bx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x140001fd4
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140001634
mov rax, qword [rax]
test rax, rax
je 0x140001f81
mov r8, qword [rax]
jmp 0x140001f84
mov r8, rbx
mov rdx, r14
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rcx, [rsp + 0x30]
call fcn.1400016cc
nop
jmp 0x140001fa9
test edi, edi
setns bl
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140005100
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop r14
pop rdi
pop rsi
ret
mov edx, eax
lea rcx, str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.140004d5c
xor edx, edx
mov ecx, edi
call fcn.140006660
int3

Function at 0x140001ff4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140011018]
xor rax, rsp
mov qword [rsp + 0x260], rax
movsxd r14, edx
mov rsi, rcx
xor ebx, ebx
mov word [rcx], bx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test eax, eax
js 0x1400020bc
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140001634
mov rax, qword [rax]
test rax, rax
je 0x140002069
mov r8, qword [rax]
jmp 0x14000206c
mov r8, rbx
mov rdx, r14
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rcx, [rsp + 0x30]
call fcn.1400016cc
nop
jmp 0x140002091
test edi, edi
setns bl
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140005100
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x270
pop r14
pop rdi
pop rsi
ret
mov edx, eax
lea rcx, str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.140004d5c
xor edx, edx
mov ecx, edi
call fcn.140006660
int3