joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001230
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140048080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
xor edx, edx
mov ecx, 0x5c
call fcn.140001110
lea edx, [rcx - 0x5b]
mov word [rsp + 0x40], ax
call fcn.140001110
lea ecx, [rdx + 0x2d]
mov word [rsp + 0x42], ax
lea edx, [rcx - 0x2c]
call fcn.140001110
lea ecx, [rdx + 0x5a]
mov word [rsp + 0x44], ax
lea edx, [rcx - 0x59]
call fcn.140001110
lea ecx, [rdx + 0x42]
mov word [rsp + 0x46], ax
lea edx, [rcx - 0x41]
call fcn.140001110
lea ecx, [rdx + 0x45]
mov word [rsp + 0x48], ax
lea edx, [rcx - 0x44]
call fcn.140001110
lea ecx, [rdx + 0x4c]
mov word [rsp + 0x4a], ax
lea edx, [rcx - 0x4b]
call fcn.140001110
lea ecx, [rdx + 0x3e]
mov word [rsp + 0x4c], ax
lea edx, [rcx - 0x3d]
call fcn.140001110
lea ecx, [rdx + 0x4f]
mov word [rsp + 0x4e], ax
lea edx, [rcx - 0x4e]
call fcn.140001110
xor ecx, ecx
mov word [rsp + 0x50], ax
lea edx, [rcx + 9]
call fcn.140001110
lea edx, [rcx + 0xa]
mov word [rsp + 0x52], ax
movzx ecx, word [0x1400418ec]
call fcn.140001110
movzx ecx, word [0x1400418ee]
mov edx, 0xb
mov word [rsp + 0x54], ax
call fcn.140001110
movzx ecx, word [str.Unknown_exception]
mov edx, 0xc
mov word [rsp + 0x56], ax
call fcn.140001110
movzx ecx, word [0x1400418f2]
mov edx, 0xd
mov word [rsp + 0x58], ax
call fcn.140001110
movzx ecx, word [0x1400418f4]
mov edx, 0xe
mov word [rsp + 0x5a], ax
call fcn.140001110
movzx ecx, word [0x1400418f6]
mov edx, 0xf
mov word [rsp + 0x5c], ax
call fcn.140001110
movzx ecx, word [0x1400418f8]
mov edx, 0x10
mov word [rsp + 0x5e], ax
call fcn.140001110
movzx ecx, word [0x1400418fa]
mov edx, 0x11
mov word [rsp + 0x60], ax
call fcn.140001110
movzx ecx, word [0x1400418fc]
mov edx, 0x12
mov word [rsp + 0x62], ax
call fcn.140001110
mov word [rsp + 0x64], ax
mov r9d, 0x133
xor eax, eax
mov word [rsp + 0x66], ax
xor r10d, r10d
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x40]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x1400013c0
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov dword [rsp + 0x28], r10d
mov edx, 0xc0000000
mov word [rsp + 0x66], r10w
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000e1c0
add rsp, 0x70
pop rbx
ret
Function at 0x140003370
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140048080]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov rdi, rcx
mov r9, rdx
jb 0x1400033a1
mov r9, qword [rdx]
cmp qword [rcx + 0x18], 8
mov r8, rdi
jb 0x1400033ae
mov r8, qword [rcx]
mov ecx, 0x72
xor edx, edx
call fcn.140001110
lea ecx, [rdx + 0x75]
mov word [rsp + 0x30], ax
lea edx, [rcx - 0x74]
call fcn.140001110
lea ecx, [rdx + 0x6d]
mov word [rsp + 0x32], ax
lea edx, [rcx - 0x6c]
call fcn.140001110
lea ecx, [rdx + 0x5f]
mov word [rsp + 0x34], ax
lea edx, [rcx - 0x5e]
call fcn.140001110
lea ecx, [rdx + 0x70]
mov word [rsp + 0x36], ax
lea edx, [rcx - 0x6f]
call fcn.140001110
xor ecx, ecx
mov word [rsp + 0x38], ax
lea edx, [rcx + 5]
call fcn.140001110
lea edx, [rcx + 6]
mov word [rsp + 0x3a], ax
movzx ecx, word [0x140041a7c]
call fcn.140001110
movzx ecx, word [0x140041a7e]
mov edx, 7
mov word [rsp + 0x3c], ax
call fcn.140001110
movzx ecx, word [str..sys]
mov edx, 8
mov word [rsp + 0x3e], ax
call fcn.140001110
movzx ecx, word [0x140041a82]
mov edx, 9
mov word [rsp + 0x40], ax
call fcn.140001110
movzx ecx, word [0x140041a84]
mov edx, 0xa
mov word [rsp + 0x42], ax
call fcn.140001110
mov word [rsp + 0x44], ax
mov r10d, 0x133
xor eax, eax
mov word [rsp + 0x46], ax
xor esi, esi
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rcx*2]
lea ecx, [r10 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0xb
jb 0x140003490
mov dword [rsp + 0x28], esi
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x20], rsi
mov word [rsp + 0x46], si
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003500
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400034fb
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003576
mov rcx, r8
call fcn.14000e7b0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000354a
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003545
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003576
mov rcx, r8
call fcn.14000e7b0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000e1c0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.140015278
int3
Function at 0x140003580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x1400035a2
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140003636
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003615
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003610
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400036df
mov rcx, r8
call fcn.14000e7b0
mov al, 1
mov rsi, qword [rsp + 0x78]
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14000367b
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003677
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003672
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400036df
mov rcx, r8
call fcn.14000e7b0
xor al, al
jmp 0x140003617
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x41200
mov qword [rsp + 0x20], rbp
lea rdx, [0x14004af70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x1400036c8
cmp rax, 8
jb 0x140003677
lea rdx, [rax*2 + 2]
jmp 0x14000364e
cmp rax, 8
jb 0x140003615
lea rdx, [rax*2 + 2]
jmp 0x1400035e8
call fcn.140015278
int3
Function at 0x1400036f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x140003712
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1400037a6
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003785
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003780
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000384f
mov rcx, r8
call fcn.14000e7b0
mov al, 1
mov rsi, qword [rsp + 0x78]
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x1400037eb
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400037e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400037e2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000384f
mov rcx, r8
call fcn.14000e7b0
xor al, al
jmp 0x140003787
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2400
mov qword [rsp + 0x20], rbp
lea rdx, [0x140048b70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140003838
cmp rax, 8
jb 0x1400037e7
lea rdx, [rax*2 + 2]
jmp 0x1400037be
cmp rax, 8
jb 0x140003785
lea rdx, [rax*2 + 2]
jmp 0x140003758
call fcn.140015278
int3
Function at 0x140003da0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
sub rsp, 0x40
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003de1
xor eax, eax
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x50], rbx
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
mov ebx, eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov rdx, rax
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x140003e45
cmp dword [rdi], 0x905a4d
je 0x140003e56
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
Function at 0x1400049a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x140004b08
test byte [r8 + 0x5e], 0x40
jne 0x1400049cd
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx eax, word [rsi + 0x14]
lea rdx, [rsi + 0x18]
mov r8d, dword [r8 + 0xb0]
add rdx, rax
movzx eax, word [rsi + 6]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x28], r15
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140004a1f
nop word [rax + rax]
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140004a16
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140004b16
add rdx, 0x28
cmp rdx, r9
jb 0x140004a00
xor ebx, ebx
mov r15d, dword [rsi + 0xb4]
add r15, rbx
test rbx, rbx
je 0x140004afe
cmp rbx, r15
jae 0x140004afe
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x140004af9
lea ecx, [rax - 8]
shr ecx, 1
je 0x140004aed
lea r11, [rbx + 8]
mov edi, ecx
nop
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x140004a82
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x140004a8e
cmp ax, 0xa
jne 0x140004adc
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x140004acb
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x140004ac2
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x140004b27
add rax, 0x28
cmp rax, r10
jb 0x140004ab0
xor ecx, ecx
test rcx, rcx
movzx eax, r8w
cmove rcx, rbp
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x140004a60
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x140004a42
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
add rbx, r8
add rbx, rbp
jmp 0x140004a21
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jmp 0x140004acd
Function at 0x14001aa70
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001a89c
Function at 0x180001010
Capabilities:
Create process on windows
Create process suspended
Get common file path
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2f0
mov rdi, rcx
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
lea rcx, str.x64_rc4.bin
xor eax, eax
xor esi, esi
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
movups xmmword [rsp + 0x70], xmm0
lea r8d, [rax + 3]
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x20], 3
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x28], rsi
lea r8d, [rsi + 4]
mov rcx, rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x180001145
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rdi
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180001145
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [rsi + 1]
jmp 0x180001147
xor eax, eax
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180001160
Capabilities:
Contain obfuscated stackstrings
Get common file path
Print debug messages
Terminate process

Disassembly:
push rbx
sub rsp, 0x460
xor r9d, r9d
lea r8, [0x180017a40]
lea rdx, [0x180017a40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x65
mov dword [rsp + 0x20], 0x760073
mov word [rsp + 0x34], cx
xor edx, edx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x24], 0x680063
mov r8d, 0x208
mov dword [rsp + 0x28], 0x73006f
mov dword [rsp + 0x2c], 0x2e0074
mov dword [rsp + 0x30], 0x780065
call fcn.1800022b0
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x40]
mov rax, rcx
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1800011f0
lea rdx, [rsp + 0x20]
nop
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x180001200
sub eax, ecx
lea rbx, [rsp + 0x40]
movsxd rcx, eax
lea rdx, [rsp + 0x20]
lea rbx, [rbx + rcx*2]
mov rcx, rbx
call fcn.1800051c4
test eax, eax
jne 0x180001246
nop dword [rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180001230
mov edx, 0x104
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [0x180017a50]
lea rcx, [rsp + 0x250]
call fcn.180001360
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x250]
call fcn.180001360
lea rcx, [rsp + 0x250]
call fcn.180001010
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x180008ed8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180008f08
xor eax, eax
jmp 0x180008fcb
mov rbp, rbx
cmp word [rax], si
je 0x180008f2d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180008f14
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180008f10
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180008df8
movsxd r14, eax
test eax, eax
jne 0x180008f6b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180008f01
mov rcx, r14
call fcn.18000a168
mov rdi, rax
test rax, rax
jne 0x180008f84
xor ecx, ecx
call fcn.1800074cc
jmp 0x180008f60
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180008df8
test eax, eax
jne 0x180008fb5
mov rcx, rdi
call fcn.1800074cc
jmp 0x180008fbf
xor ecx, ecx
call fcn.1800074cc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18000e7e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000e808
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18000e808
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x141264058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1412641df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141264089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14126406f
add dl, dl
jne 0x141264096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412640f6
xor eax, eax
add dl, dl
jne 0x1412640a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1412641ad
add dl, dl
jne 0x1412640b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412640c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412640d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1412640dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1412640ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14126407e
mov eax, 1
add dl, dl
jne 0x141264106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141264113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1412640fb
sub eax, ebx
mov ebx, 1
jne 0x14126414c
mov ecx, 1
add dl, dl
jne 0x14126412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14126413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141264123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14126407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141264168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141264175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14126415d
cmp eax, 0x7d00
jae 0x14126419b
cmp eax, 0x500
jb 0x141264196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14126407e
cmp eax, 0x7f
ja 0x14126419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14126407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1412641d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14126407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000db00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14000dc20
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14000db60
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14000db60
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14000db60

Function at 0x140025f40
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140025f87
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140025fa1
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140025f7f
mov qword [rsi], rdi
call fcn.14004b510
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140025fb7
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14004b510
mov rcx, qword [rsi]
call fcn.14004b520
mov qword [rsi], 0
jmp 0x140025f6d
int3
Function at 0x140026250
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140026296
mov r14, r12
test r14, r14
je 0x140026398
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x1400262f8
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x1400262e4
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.140068520
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x140026272
mov rax, r12
sub rax, r15
sar rax, 2
cmp r12, r15
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x1400263be
lea rcx, [r13*8]
call fcn.1400656b8
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, r12
mov r14, rcx
sub rdx, rbx
je 0x14002635e
lea r14, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x140026398
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x140026346
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], rdx
cmp r12, rbx
je 0x14002637e
add r12, 0xfffffffffffffff8
jne 0x140026371
jmp 0x1400263ab
test r15, r15
je 0x140026272
mov rcx, r15
call fcn.1400656f4
mov r14, qword [rsi + 0x10]
jmp 0x140026272
lea rcx, [0x1400d0b43]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.140096010
lea rcx, [0x1400d0b43]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.140096010
call fcn.140095bb0
int3