joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1407d62c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
cmp rdx, 0x20
jb 0x1407d6347
mov qword [rsp + 0x10], rbx
lea r11, [r8 + 0x10]
mov qword [rsp], rdi
mov rbx, r10
sub rbx, r8
mov edi, 0x10
sub rdi, r8
nop
movdqu xmm0, xmmword [rbx + r11 - 0x10]
add rcx, 0x20
movdqu xmm2, xmmword [rbx + r11]
lea r11, [r11 + 0x20]
movdqa xmm1, xmm0
lea rax, [rdi + r11]
psrlw xmm0, 8
psllw xmm1, 8
pxor xmm1, xmm0
movdqa xmm0, xmm2
psllw xmm0, 8
psrlw xmm2, 8
pxor xmm0, xmm2
movdqu xmmword [r11 - 0x20], xmm0
movdqu xmmword [r11 - 0x30], xmm1
cmp rax, rdx
jbe 0x1407d62f0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
lea rax, [rcx + 0x10]
cmp rax, rdx
ja 0x1407d6371
movdqu xmm0, xmmword [rcx + r10]
movdqa xmm1, xmm0
psrlw xmm0, 8
psllw xmm1, 8
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
mov rcx, rax
cmp rcx, rdx
jae 0x1407d63a5
lea rax, [rcx + r8]
sub r10, r8
nop dword [rax]
cmp r9, 0x10
jae 0x1407d63a5
movzx ecx, word [rax + r10]
add r9, 2
rol cx, 8
mov word [rax], cx
add rax, 2
mov rcx, rax
sub rcx, r8
cmp rcx, rdx
jb 0x1407d6380
mov rax, rdx
add rsp, 8
ret
Function at 0x1408e664c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1408e64df
xor ecx, ecx
call qword [0x14091b4b8]
test rax, rax
je 0x1408e64df
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1408e64df
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1408e64df
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1408e64df
cmp dword [rcx + 0x84], 0xe
jbe 0x1408e64df
cmp dword [rcx + 0xf8], 0
je 0x1408e64df
mov ecx, ebx
call fcn.1408e6580
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1408e6370
cmp dword [rbp + 0x20], 0
je 0x1408e652c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1408e6534
int3
xor r8d, r8d
xor edx, edx
jmp 0x1408e6478
Function at 0x140036844
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x2a0
movsxd rsi, r8d
mov rbx, rdx
cmp esi, 2
jl 0x14003690c
cmp byte [rdx], 0x81
jne 0x14003690c
lea rax, [rsp + 0x30]
xor ebp, ebp
lea r9, [r11 - 0x208]
mov qword [rsp + 0x20], rax
lea r8, [r11 - 0x108]
xor edi, edi
lea rdx, [rsp + 0x68]
call fcn.1400bdfb8
mov al, byte [rsp + 0xa0]
xor r8d, r8d
test al, al
je 0x1400368c9
lea rdx, [rsp + 0xa0]
movsx eax, al
inc rdx
and eax, 0xf
lea ecx, [rax + r8]
mov al, byte [rdx]
add ebp, ecx
xor edi, ecx
inc r8d
cmp al, 0
jne 0x1400368af
movsx eax, byte [rbx + 1]
lea edx, [rbp + 0x1d]
xor edx, edi
add edi, 3
xor eax, edx
cmp al, 0x81
je 0x1400368df
xor eax, eax
jmp 0x140036911
cmp rsi, 2
jle 0x140036906
mov r8, rbx
lea r9, [rsi - 2]
mov cl, byte [r8 + 2]
add edx, 0x1d
xor edx, edi
add edi, 3
xor cl, dl
mov byte [r8], cl
inc r8
sub r9, 1
jne 0x1400368ec
and word [rsi + rbx - 2], 0
mov eax, 1
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140045460
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x830
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov qword [rsp + 0x848], rbx
mov rbx, rcx
call fcn.1400461a0
mov rsi, rax
cmp dword [rax + 0x28], 0
je 0x14004549d
mov rcx, rax
call qword [fcn.14010b150]
mov qword [rsp + 0x858], rdi
test rbx, rbx
jne 0x1400454b1
xor edi, edi
jmp 0x140045661
cmp byte [rbx], 1
jne 0x14004565e
movsx edx, byte [rbx + 1]
movzx eax, dl
add al, al
lea ecx, [rdx + 0x65]
add cl, al
xor byte [rbx + 2], cl
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rbx + 2]
lea eax, [rcx + 0x68]
xor byte [rbx + 3], al
lea edx, [rcx + 4]
movzx eax, byte [rbx + 3]
shl r9d, 8
or r9, rax
jbe 0x140045511
mov r8, rbx
nop dword [rax]
movzx eax, byte [r8 + 4]
lea edx, [rdx + rdx*2]
lea ecx, [rdx + 0x65]
xor al, cl
lea edx, [rdx + 1]
mov byte [r8], al
inc r8
mov rax, r8
sub rax, rbx
cmp rax, r9
jl 0x1400454f0
xor edi, edi
mov byte [r9 + rbx], 0
call fcn.140597e84
nop
mov r8d, eax
lea edx, [rdi + 1]
lea rax, [0x1401632d0]
lea rcx, [0x140163284]
lea r9, [0x140000000]
cmp dword [rcx], r8d
je 0x14004554b
inc edx
add rcx, 4
cmp rcx, rax
jl 0x140045532
jmp 0x140045551
mov edi, edx
test edx, edx
jne 0x14004556e
mov ecx, dword [0x140163270]
cmp ecx, 0x13
jae 0x14004556e
inc ecx
mov dword [0x140163270], ecx
mov edi, ecx
mov dword [r9 + rcx*4 + 0x163280], r8d
mov eax, edi
mov rdi, qword [r9 + rax*8 + 0x1631d0]
mov qword [r9 + rax*8 + 0x1631d0], rbx
test rdi, rdi
je 0x14004565e
cmp rdi, rbx
je 0x14004565e
cmp byte [rbx], 1
je 0x14004565e
cmp byte [rdi], 1
je 0x14004565e
mov r8d, 0x800
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1405a1b8b
nop
lea rcx, [rsp + 0x20]
call fcn.14059e9e7
nop
mov r8d, eax
test eax, eax
je 0x14004565e
lea rax, [rsp + 0x20]
mov qword [rsp + 0x850], rbp
movzx ecx, al
mov r11d, 4
mov byte [rdi + 1], cl
mov byte [rdi], 1
lea ecx, [rcx + rcx*2]
lea ebp, [rcx + 0x65]
lea ecx, [rcx + 1]
lea edx, [rcx + rcx*2]
lea r10d, [rdx + 0x65]
inc edx
test r8d, r8d
jle 0x140045639
lea r9, [rsp + 0x20]
mov rax, rdi
sub rax, r9
lea rcx, [rsp + 0x20]
lea r11d, [r8 + 4]
lea r9, [rax + 4]
nop dword [rax]
lea edx, [rdx + rdx*2]
lea eax, [rdx + 0x65]
xor al, byte [rcx]
lea edx, [rdx + 1]
mov byte [r9 + rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x140045620
movsxd rax, r11d
lea ecx, [r11 - 4]
mov byte [rax + rdi], 0
mov eax, ecx
sar eax, 8
xor al, bpl
mov rbp, qword [rsp + 0x850]
xor r10b, cl
mov byte [rdi + 2], al
mov byte [rdi + 3], r10b
mov rdi, rbx
cmp dword [rsi + 0x28], 0
mov rbx, qword [rsp + 0x848]
je 0x140045678
mov rcx, rsi
call qword [fcn.14010b158]
mov rax, rdi
mov rdi, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140090220
add rsp, 0x830
pop rsi
ret
Function at 0x1400456a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x830
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov qword [rsp + 0x858], rdi
mov rdi, rcx
call fcn.1400461a0
mov rsi, rax
cmp dword [rax + 0x28], 0
je 0x1400456dd
mov rcx, rax
call qword [fcn.14010b150]
mov qword [rsp + 0x848], rbx
test rdi, rdi
jne 0x1400456f1
xor ebx, ebx
jmp 0x140045841
cmp byte [rdi], 1
jne 0x14004583e
movsx edx, byte [rdi + 1]
movzx eax, dl
add al, al
lea ecx, [rdx + 0x65]
add cl, al
xor byte [rdi + 2], cl
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rdi + 2]
lea eax, [rcx + 0x68]
xor byte [rdi + 3], al
lea edx, [rcx + 4]
movzx eax, byte [rdi + 3]
shl r9d, 8
or r9, rax
jbe 0x14004574b
xor ebx, ebx
nop dword [rax + rax]
movzx eax, byte [rdi + rbx + 4]
lea edx, [rdx + rdx*2]
lea ecx, [rdx + 0x65]
xor al, cl
lea edx, [rdx + 1]
mov byte [rbx + rdi], al
inc rbx
cmp rbx, r9
jl 0x140045730
mov rbx, qword [0x1401632d0]
mov byte [r9 + rdi], 0
mov qword [0x1401632d0], rdi
test rbx, rbx
je 0x14004583e
cmp rbx, rdi
je 0x14004583e
cmp byte [rdi], 1
je 0x14004583e
cmp byte [rbx], 1
je 0x14004583e
mov r8d, 0x800
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1405a1b8b
nop
lea rcx, [rsp + 0x20]
call fcn.14059e9e7
nop
mov r8d, eax
test eax, eax
je 0x14004583e
lea rax, [rsp + 0x20]
mov qword [rsp + 0x850], rbp
movzx ecx, al
mov r11d, 4
mov byte [rbx + 1], cl
mov byte [rbx], 1
lea ecx, [rcx + rcx*2]
lea ebp, [rcx + 0x65]
lea ecx, [rcx + 1]
lea edx, [rcx + rcx*2]
lea r10d, [rdx + 0x65]
inc edx
test r8d, r8d
jle 0x140045819
lea r9, [rsp + 0x20]
mov rax, rbx
sub rax, r9
lea rcx, [rsp + 0x20]
lea r11d, [r8 + 4]
lea r9, [rax + 4]
nop word [rax + rax]
lea edx, [rdx + rdx*2]
lea eax, [rdx + 0x65]
xor al, byte [rcx]
lea edx, [rdx + 1]
mov byte [r9 + rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x140045800
movsxd rax, r11d
lea ecx, [r11 - 4]
mov byte [rax + rbx], 0
mov eax, ecx
sar eax, 8
xor al, bpl
mov rbp, qword [rsp + 0x850]
xor r10b, cl
mov byte [rbx + 2], al
mov byte [rbx + 3], r10b
mov rbx, rdi
cmp dword [rsi + 0x28], 0
mov rdi, qword [rsp + 0x858]
je 0x140045858
mov rcx, rsi
call qword [fcn.14010b158]
mov rax, rbx
mov rbx, qword [rsp + 0x848]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140090220
add rsp, 0x830
pop rsi
ret
Function at 0x140045da0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov eax, 0x1040
call fcn.14008f990
sub rsp, rax
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov qword [rsp + 0x1058], rbx
mov rbx, rcx
call fcn.1400461a0
mov rbp, rax
cmp dword [rax + 0x28], 0
je 0x140045de3
mov rcx, rax
call qword [fcn.14010b150]
mov qword [rsp + 0x1060], rsi
test rbx, rbx
jne 0x140045df7
xor esi, esi
jmp 0x140045f6f
cmp word [rbx], 1
jne 0x140045f6c
movzx edx, word [rbx + 2]
xor esi, esi
movzx eax, dx
mov qword [rsp + 0x1038], rdi
add ax, ax
lea ecx, [rdx + 0x65]
add cx, ax
xor word [rbx + 4], cx
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rbx + 4]
lea eax, [rcx + 0x68]
xor word [rbx + 6], ax
lea edx, [rcx + 4]
movzx eax, byte [rbx + 6]
shl r9d, 8
or r9, rax
jbe 0x140045e60
mov r8d, esi
movzx eax, word [rbx + r8*2 + 8]
lea edx, [rdx + rdx*2]
lea ecx, [rdx + 0x65]
xor ax, cx
lea edx, [rdx + 1]
mov word [rbx + r8*2], ax
inc r8
cmp r8, r9
jl 0x140045e41
mov rdi, qword [0x1401632d8]
mov word [rbx + r9*2], si
mov qword [0x1401632d8], rbx
test rdi, rdi
je 0x140045f64
cmp rdi, rbx
je 0x140045f64
cmp word [rbx], 1
je 0x140045f64
cmp word [rdi], 1
je 0x140045f64
mov r8d, 0x800
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14059d022
nop
lea rcx, [rsp + 0x20]
call fcn.14059a52b
nop
mov r8d, eax
test eax, eax
je 0x140045f64
mov eax, 1
mov qword [rsp + 0x1030], r14
mov word [rdi], ax
mov r11d, 4
lea rax, [rsp + 0x20]
movzx ecx, al
mov word [rdi + 2], cx
lea ecx, [rcx + rcx*2]
lea r14d, [rcx + 0x65]
lea ecx, [rcx + 1]
lea edx, [rcx + rcx*2]
lea r10d, [rdx + 0x65]
inc edx
test r8d, r8d
jle 0x140045f3b
lea r9, [rsp + 0x20]
mov rax, rdi
sub rax, r9
lea rcx, [rsp + 0x20]
lea r11d, [r8 + 4]
lea r9, [rax + 8]
nop word [rax + rax]
lea edx, [rdx + rdx*2]
lea eax, [rdx + 0x65]
xor ax, word [rcx]
lea edx, [rdx + 1]
mov word [r9 + rcx], ax
lea rcx, [rcx + 2]
sub r8, 1
jne 0x140045f20
movsxd rax, r11d
lea ecx, [r11 - 4]
mov word [rdi + rax*2], si
mov eax, ecx
sar eax, 8
xor ax, r14w
mov r14, qword [rsp + 0x1030]
xor r10w, cx
mov word [rdi + 4], ax
mov word [rdi + 6], r10w
mov rdi, qword [rsp + 0x1038]
mov rsi, rbx
cmp dword [rbp + 0x28], 0
mov rbx, qword [rsp + 0x1058]
je 0x140045f86
mov rcx, rbp
call qword [fcn.14010b158]
mov rax, rsi
mov rsi, qword [rsp + 0x1060]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140090220
add rsp, 0x1040
pop rbp
ret
Function at 0x140091344
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov ebx, dword [rdx]
xor r11d, r11d
mov edi, dword [rdx + 4]
mov r8, rcx
mov esi, dword [rdx + 8]
mov ebp, dword [rdx + 0xc]
mov r9d, dword [rcx]
lea edx, [r11 + 0x20]
mov r10d, dword [rcx + 4]
mov ecx, r10d
lea r11d, [r11 - 0x61c88647]
shr ecx, 5
mov eax, r10d
add ecx, edi
shl eax, 4
add eax, ebx
xor ecx, eax
lea eax, [r11 + r10]
xor ecx, eax
add r9d, ecx
mov ecx, r9d
mov eax, r9d
shr ecx, 5
shl eax, 4
add ecx, ebp
add eax, esi
xor ecx, eax
lea eax, [r11 + r9]
xor ecx, eax
add r10d, ecx
sub rdx, 1
jne 0x140091373
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r8], r9d
mov dword [r8 + 4], r10d
ret

Function at 0x1400915b4
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor eax, eax
mov r12, r8
mov r8d, edx
mov edi, r9d
mov rdx, rcx
mov qword [r11 - 0x38], rax
mov r14d, r9d
mov qword [r11 - 0x30], rax
lea rcx, [r11 - 0x30]
shr r14d, 3
and edi, 7
mov qword [r11 - 0x28], rax
xor esi, esi
call fcn.140091254
mov rbp, qword [rsp + 0x80]
xor r15d, r15d
test r14d, r14d
je 0x140091655
mov esi, r14d
shl esi, 3
mov eax, r15d
lea rdx, [rsp + 0x28]
shl eax, 3
lea rcx, [rsp + 0x20]
mov ebx, eax
mov eax, dword [rax + r12]
mov dword [rsp + 0x20], eax
mov eax, dword [r12 + rbx + 4]
mov dword [rsp + 0x24], eax
call fcn.140091344
mov eax, dword [rsp + 0x20]
inc r15d
mov dword [rbx + rbp], eax
mov eax, dword [rsp + 0x24]
mov dword [rbx + rbp + 4], eax
cmp r15d, r14d
jb 0x140091616
test edi, edi
je 0x140091683
shl r14d, 3
mov r8d, edi
lea rdx, [r14 + r12]
lea rcx, [r14 + rbp]
call fcn.140092940
xor edx, edx
test edi, edi
je 0x140091681
lea eax, [r14 + rdx]
inc edx
xor byte [rax + rbp], 0x17
cmp edx, edi
jb 0x140091673
add esi, edi
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x140091692
mov dword [rax], esi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret

Function at 0x1405a427c
Capabilities:
Encode data using xor

Disassembly:
or dword [rcx + 0x35], ebx
mov eax, 0x8841a6f
invalid
push rax
sub rsp, 8
push rax
pop qword [rsp]
jmp 0x1405a44f1
mov eax, 0x4fd39e72
jmp 0x14059c2c9
Function at 0x140edf058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140edf1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140edf089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140edf06f
add dl, dl
jne 0x140edf096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140edf0f6
xor eax, eax
add dl, dl
jne 0x140edf0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140edf1ad
add dl, dl
jne 0x140edf0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140edf0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140edf0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140edf0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140edf0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140edf07e
mov eax, 1
add dl, dl
jne 0x140edf106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140edf113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140edf0fb
sub eax, ebx
mov ebx, 1
jne 0x140edf14c
mov ecx, 1
add dl, dl
jne 0x140edf12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140edf13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140edf123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140edf07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140edf168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140edf175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140edf15d
cmp eax, 0x7d00
jae 0x140edf19b
cmp eax, 0x500
jb 0x140edf196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140edf07e
cmp eax, 0x7f
ja 0x140edf19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140edf07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140edf1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140edf07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x10003140
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
mov rsi, rcx
lea rcx, str.8192
mov qword [rsp + 0x48], rdi
mov edi, edx
call fcn.10031bc0
lea rcx, str.4096
mov ebx, eax
call fcn.10031bc0
mov rdx, rdi
or ebx, eax
mov r9d, 0x40
xor ecx, ecx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
mov r11, rax
jne 0x100031a4
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
xor r8d, r8d
test edi, edi
je 0x100031f5
mov r9, rax
mov r10, r8
sub rsi, rax
lea rbx, str.D5N0rIO_AGhxv_o_gonPZ6_h8k_asOjdO_2m_31h_kjJCgy_lzyo_
nop
nop
mov eax, 0x22b63cbf
mov rcx, r10
add r9, 1
add r10, 1
mul r8d
shr edx, 3
add r8d, 1
mov eax, edx
imul rax, rax, 0x3b
sub rcx, rax
movzx eax, byte [rcx + rbx]
xor al, byte [rsi + r9 - 1]
cmp r8d, edi
mov byte [r9 - 1], al
jb 0x100031c0
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rax, r11
add rsp, 0x28
ret

Function at 0x10003210
Capabilities:
Decode data using base64 via winapi

Disassembly:
sub rsp, 0x58
test r8, r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], r12
mov rbx, rdx
mov r12d, r9d
mov rsi, r8
mov rbp, rcx
jne 0x10003240
xor al, al
jmp 0x100032c4
mov qword [rsp + 0x48], r13
xor r13d, r13d
xor r9d, r9d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdx
lea r8d, [r13 + 1]
mov edx, r12d
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x100032bf
mov ecx, dword [rbx]
mov qword [rsp + 0x78], rdi
add ecx, 1
call fcn.1002fbb0
test rax, rax
mov rdi, rax
mov qword [rbp], rax
je 0x100032ba
mov ecx, dword [rbx]
xor eax, eax
mov qword [rsp + 0x30], r13
add ecx, 1
lea r8d, [rax + 1]
mov edx, r12d
rep stosb byte [rdi], al
mov r9, qword [rbp]
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rbx
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
setne al
mov rdi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x100032e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 8
movsxd rax, dword [rdx + 0x3c]
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov r9d, dword [rax + rdx + 0x88]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
add r9, rdx
mov qword [rsp], r12
xor r10d, r10d
mov r12d, dword [r9 + 0x24]
mov r11d, dword [r9 + 0x20]
mov ebp, dword [r9 + 0x1c]
imul r12d, ecx
mov r9d, dword [r9 + 0x18]
add r11, rdx
add rbp, rdx
add r12, rdx
mov rdi, r8
mov rbx, rdx
imul r9d, ecx
test r9d, r9d
mov esi, ecx
je 0x10003375
nop
mov eax, dword [r11]
mov r8, rdi
add rax, rbx
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x10003364
add rax, 1
test ecx, ecx
jne 0x10003350
test edx, edx
je 0x10003394
add r10d, 1
add r11, 4
cmp r10d, r9d
jb 0x10003340
xor eax, eax
mov r12, qword [rsp]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret
imul r10d, esi
movzx ecx, word [r12 + r10*2]
mov eax, dword [rbp + rcx*4]
imul eax, esi
add rax, rbx
jmp 0x10003377
Function at 0x1000f060
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x208], 0
mov rbx, rcx
jne 0x1000f0a0
lea rdx, [0x10097fac]
call fcn.10033040
test rax, rax
mov qword [rbx + 0x208], rax
jne 0x1000f0a0
lea rcx, str.Debug_System_Error_____Debug_log_file_cannot_be_opened._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1000f370
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x148
mov rax, qword [0x100b4680]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp qword [rcx + 0x208], 0
mov qword [rsp + 0x160], rbx
mov rbx, rcx
jne 0x1000f3c8
lea rdx, [0x10097fac]
call fcn.10033040
test rax, rax
mov qword [rbx + 0x208], rax
jne 0x1000f3c8
lea rcx, str.Debug_System_Error_____Debug_log_file_cannot_be_opened._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1000f4e3
mov rcx, qword [rbx + 0x208]
call fcn.100333a0
mov ecx, eax
call fcn.10033210
cmp eax, 0xffffffff
jne 0x1000f41a
mov rcx, qword [rbx + 0x208]
test rcx, rcx
je 0x1000f412
call fcn.10033100
test eax, eax
je 0x1000f402
lea rcx, str.Debug_System_Error_____Cannot_close_the_debug_log_file._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov qword [rbx + 0x208], 0
jmp 0x1000f4e3
mov rax, rcx
jmp 0x1000f4ea
cmp eax, 0x80000
jle 0x1000f4e3
mov rcx, qword [rbx + 0x208]
test rcx, rcx
je 0x1000f46e
mov qword [rsp + 0x168], rdi
call fcn.10033100
test eax, eax
sete dil
test dil, dil
jne 0x1000f456
lea rcx, str.Debug_System_Error_____Cannot_close_the_debug_log_file._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test dil, dil
mov rdi, qword [rsp + 0x168]
mov qword [rbx + 0x208], 0
je 0x1000f4e3
lea rcx, [rsp + 0x20]
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
lea rcx, [rsp + 0x20]
mov edx, 0x5c
call fcn.10032ed0
test rax, rax
je 0x1000f49c
add rax, 1
jmp 0x1000f4a1
lea rax, [rsp + 0x20]
lea rdx, str.error.log.old
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x20]
call fcn.100331e0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.100331b0
test eax, eax
je 0x1000f4db
lea rcx, str.Debug_System_Error_____Cannot_create_a_backup_copy_of_the_debug_log_file_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1000f4e3
mov rcx, rbx
call fcn.1000f060
mov rax, qword [rbx + 0x208]
mov rbx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.10031790
add rsp, 0x148
ret
Function at 0x1001a1e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x1001a23e
call fcn.1001c2ec
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x1001a23e
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x1001a260
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.10019c64
test rdi, rdi
mov esi, eax
je 0x1001a25e
test rbx, rbx
je 0x1001a25e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1001b508
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x1001b53e
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1001b5f5
call fcn.1002abec
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1001b55d
mov ecx, 0x80004005
call fcn.10001000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x118]
mov rdx, rsi
mov rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x50]
mov rcx, rdi
call fcn.10033b60
test eax, eax
je 0x1001b5c8
cmp eax, 0xc
je 0x1001b5c2
cmp eax, 0x16
je 0x1001b5bc
cmp eax, 0x22
je 0x1001b5bc
cmp eax, 0x50
je 0x1001b5c8
call fcn.1000fcd8
int3
call fcn.1000fcd8
int3
call fcn.1000fc90
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1001b5f3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x100331b0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x100331d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100331d9
mov ecx, eax
call fcn.10033d10
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x100331e0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10033209
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10033209
mov ecx, eax
call fcn.10033d10
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret