joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801d6130
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x1801d6170
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1802a12c0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x1801d61ae
cmp rsi, r14
jb 0x1801d61a6
cmp rsi, r15
jae 0x1801d61a6
cmp qword [rsi + 8], 0
jne 0x1801d6377
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1801d6191
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1801d6242
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1801d6239
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1801d6239
cmp dword [rsp + 0x70], 0x10000
je 0x1801d62bb
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x1801d6239
sub rbx, rbp
cmp rbx, r14
jae 0x1801d6200
test rsi, rsi
jne 0x1801d6320
cmp rdi, r15
ja 0x1801d635f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1801d635f
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1801d635f
cmp dword [rsp + 0x70], 0x10000
je 0x1801d62f1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1801d6272
jmp 0x1801d635f
test rbx, rbx
je 0x1801d6239
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1801d6320
cmp rbx, r14
jae 0x1801d61e0
jmp 0x1801d6242
test rdi, rdi
je 0x1801d635f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1801d6320
cmp rdi, r15
jbe 0x1801d6250
jmp 0x1801d635f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x1801d6330
mov rax, qword [0x1802a12c0]
mov qword [rsi], rax
mov qword [0x1802a12c0], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x1801d8458
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1801d8492
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1801d8497
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1801d84e0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1801d84e0
dec r8
sub rdx, 1
jne 0x1801d84c6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14165cbb0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14165cbbd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14165cbcd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14165cbb5
lea eax, [rcx + 1]
jmp 0x14165cbdb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14165cbee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14165cbd4
sub eax, 3
jb 0x14165cc0e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14165cc5d
sar eax, 1
movsxd rbp, eax
jb 0x14165cc44
jmp 0x14165cc1c
add ebx, ebx
jne 0x14165cc1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14165cc44
inc ecx
add ebx, ebx
jne 0x14165cc2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14165cc44
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14165cc3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14165cc2c
add ecx, 2
jmp 0x14165cc49
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14165cb72
jmp 0x14165cbbd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x1623000]
mov eax, dword [rdi]
or eax, eax
je 0x14165ccc9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1665930]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14165cc6d
jns 0x14165cca2
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14165ccac
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14165ccc3
mov qword [rbx], rax
add rbx, 8
jmp 0x14165cc8d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14165cd0d
cmp al, 0xef
ja 0x14165ccf5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14165ccd5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14165cce4
mov eax, dword [rdi]
add rdi, 4
jmp 0x14165cce4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14165cd8c], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14165cd8c
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14165cd7c
sub rsp, 0xffffffffffffff80
jmp 0x1400c1da4
Function at 0x1401a6570
Capabilities:
Check os version
Parse pe header

Disassembly:
mov rax, qword gs:[0x60]
mov r9, rcx
test rax, rax
je 0x1401a660b
cmp dword [rax + 0x118], 0xa
jne 0x1401a660b
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
mov rax, qword [rdx]
mov rdx, qword [rax + 0x20]
test rdx, rdx
je 0x1401a660b
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1401a660b
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1401a660b
mov r8d, dword [rax + rdx + 0x88]
add r8, rdx
je 0x1401a660b
mov qword [rcx + 0x20], rdx
mov ecx, dword [r8 + 0x18]
mov dword [r9 + 0x18], ecx
mov r11d, dword [r8 + 0x20]
add r11, rdx
mov qword [r9 + 8], r11
mov r10d, dword [r8 + 0x1c]
add r10, rdx
mov qword [r9], r10
mov r8d, dword [r8 + 0x24]
add r8, rdx
mov qword [r9 + 0x10], r8
test ecx, ecx
je 0x1401a660b
test r11, r11
je 0x1401a660b
test r10, r10
je 0x1401a660b
test r8, r8
je 0x1401a660b
mov eax, 1
ret
xor eax, eax
ret

Function at 0x1401a75f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401a763a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401a763a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401a763a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401a763a
cmp dword [rcx + 0x84], 0xe
jbe 0x1401a763a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401a763c
xor al, al
add rsp, 0x28
ret

Function at 0x1401abc70
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401aba6c
Function at 0x1401aed24
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401aed54
xor eax, eax
jmp 0x1401aee17
mov rbp, rbx
cmp word [rax], si
je 0x1401aed79
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1401aed60
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401aed5c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401aec44
movsxd r14, eax
test eax, eax
jne 0x1401aedb7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401aed4d
mov rcx, r14
call fcn.1401af7b8
mov rdi, rax
test rax, rax
jne 0x1401aedd0
xor ecx, ecx
call fcn.1401ad27c
jmp 0x1401aedac
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401aec44
test eax, eax
jne 0x1401aee01
mov rcx, rdi
call fcn.1401ad27c
jmp 0x1401aee0b
xor ecx, ecx
call fcn.1401ad27c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1401b4580
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401b45a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401b45a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000a380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400010f8]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebx, ebx
call fcn.14000a1a0
mov r8, rax
lea ecx, [rbx + 4]
xor edx, edx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test rax, rax
je 0x14000a3c7
mov rcx, rax
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140012a44
test ebx, ebx
jne 0x14000a50e
call fcn.140009ee0
lea r8, [0x140001af8]
mov qword [rsp + 0x58], 0
lea edx, [rbx + 0x64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14000a4ee
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x50], eax
movzx eax, byte [rbx + 1]
movzx ecx, byte [rbx + 3]
movzx edx, byte [rbx + 2]
shl rcx, 8
or rcx, rdx
mov dword [rsp + 0x64], 0x5d
shl rcx, 8
or rcx, rax
mov byte [rsp + 0x68], 1
movzx eax, byte [rbx]
shl rcx, 8
or rcx, rax
mov qword [rsp + 0x58], rcx
call fcn.140012a4c
sub qword [rsp + 0x50], 4
lea r8, [rbx + 4]
mov rdi, rax
lea r9, [rsp + 0x50]
lea rax, [0x140001b10]
mov rcx, rdi
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x64]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
call fcn.14000cff0
test eax, eax
je 0x14000a4c1
mov rcx, rdi
call fcn.140012a44
xor edi, edi
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
call fcn.14000aab0
mov rcx, rdi
mov rbx, rax
call fcn.140012a44
test rbx, rbx
je 0x14000a4ee
mov rcx, rbx
call fcn.14000a970
mov rcx, rbx
call fcn.14000a9f0
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000d6a0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
xor ecx, ecx
call fcn.140012cfc
int3
Function at 0x14000a770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r8, qword [rcx]
movabs rax, 0xffffffff00000000
mov r11d, dword [rcx + 0x60]
mov r14, rcx
neg r11d
movzx ebx, word [r8 + 0x14]
mov r12, qword [r8 + 0x30]
add rbx, r8
and r12, rax
mov r10d, dword [rbx + 0x20]
mov r9d, dword [rbx + 0x28]
or r10, r12
and r11, r10
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], r11
test r9d, r9d
jne 0x14000a7d6
mov eax, dword [rbx + 0x3c]
test al, 0x40
je 0x14000a7ce
mov r9d, dword [r8 + 0x20]
jmp 0x14000a7d6
test al, al
jns 0x14000a7d6
mov r9d, dword [r8 + 0x24]
mov edx, dword [rbx + 0x3c]
mov r13d, 1
mov r15d, r13d
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x38], 0
cmp r13w, word [r8 + 6]
jae 0x14000a8c8
add rbx, 0x64
nop word [rax + rax]
mov edi, dword [r14 + 0x60]
mov ebp, dword [rbx - 0x1c]
neg edi
mov esi, dword [rbx - 0x14]
or rbp, r12
and rdi, rbp
test esi, esi
jne 0x14000a84a
mov eax, dword [rbx]
test al, 0x40
je 0x14000a842
mov esi, dword [r8 + 0x20]
jmp 0x14000a84a
test al, al
jns 0x14000a84a
mov esi, dword [r8 + 0x24]
cmp r11, rdi
je 0x14000a88d
mov eax, r9d
add rax, r10
cmp rax, rdi
ja 0x14000a88d
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.14000a6b0
test eax, eax
je 0x14000a963
mov edx, dword [rbx]
mov r10, rbp
mov r8, qword [r14]
mov r11, rdi
mov qword [rsp + 0x20], rbp
mov r9d, esi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], esi
jmp 0x14000a8af
mov ecx, dword [rbx]
mov eax, ecx
and eax, edx
or edx, ecx
bt eax, 0x19
jb 0x14000a89f
btr edx, 0x19
mov r9d, ebp
sub r9d, dword [rsp + 0x20]
add r9d, esi
mov dword [rsp + 0x30], r9d
movzx eax, word [r8 + 6]
inc r15d
add rbx, 0x28
mov dword [rsp + 0x34], edx
cmp r15d, eax
jl 0x14000a820
test r9d, r9d
je 0x14000a8ec
bt edx, 0x19
jae 0x14000a912
cmp r10, r11
jne 0x14000a8ec
mov edx, r9d
mov r8d, 0x4000
mov r9, qword [r14 + 0x50]
mov rcx, r10
call qword [r14 + 0x30]
mov eax, r13d
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
mov ecx, edx
mov eax, edx
shr rax, 0x1e
and eax, r13d
shr rcx, 0x1d
and ecx, r13d
lea rcx, [rax + rcx*2]
mov eax, edx
shr rax, 0x1f
lea rcx, [rax + rcx*2]
lea rax, [0x1400010b0]
mov eax, dword [rax + rcx*4]
mov r8d, eax
bts r8d, 9
mov rcx, r10
and edx, 0x4000000
mov edx, r9d
lea r9, [rsp + 0x70]
cmove r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000a8ec
xor eax, eax
jmp 0x14000a8ef
Function at 0x140012cfc
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140012ad0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012ad0
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140012ad0
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140012ad0
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140012ad0
cmp dword [rcx + 0x84], 0xe
jbe 0x140012ad0
cmp dword [rcx + 0xf8], esi
je 0x140012ad0
mov ecx, r14d
call fcn.140012c18
mov ecx, 2
call fcn.1400166d0
nop
cmp byte [0x140021778], 0
jne 0x140012b9a
mov r15d, 1
mov eax, r15d
xchg dword [0x140021768], eax
test ebx, ebx
jne 0x140012b43
mov rdi, qword [0x1400010f8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140021770]
cmp rcx, rax
je 0x140012b3a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14000d9a4]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140021908]
jmp 0x140012b4f
cmp ebx, r15d
jne 0x140012b55
lea rcx, [0x140021920]
call fcn.14001404c
nop
test ebx, ebx
jne 0x140012b6c
lea rdx, [0x140001078]
lea rcx, [0x140001058]
call fcn.140013a4c
lea rdx, [0x140001088]
lea rcx, [0x140001080]
call fcn.140013a4c
movzx eax, byte [0x140021778]
test esi, esi
cmove eax, r15d
mov byte [0x140021778], al
jmp 0x140012b9a
mov ecx, 2
call fcn.140016724
test esi, esi
jne 0x140012bb1
mov ecx, r14d
call fcn.140012bcc
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140012a60
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call fcn.14017f000
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1400087ec
add rsp, 0x28
jmp 0x140008188
Function at 0x140061800
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14006180d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14006181d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140061805
lea eax, [rcx + 1]
jmp 0x14006182b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14006183e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140061824
sub eax, 3
jb 0x14006185e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400618ad
sar eax, 1
movsxd rbp, eax
jb 0x140061894
jmp 0x14006186c
add ebx, ebx
jne 0x14006186a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140061894
inc ecx
add ebx, ebx
jne 0x14006187a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140061894
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14006188d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14006187c
add ecx, 2
jmp 0x140061899
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400617c2
jmp 0x14006180d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x31000
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400618fd
cmp rsi, rcx
jae 0x140061905
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400618e4
cmp al, 0x8f
ja 0x1400618e4
cmp byte [rsi - 2], 0xf
je 0x1400618ea
sub al, 0xe8
cmp al, 1
ja 0x1400618ce
cmp rsi, rcx
jae 0x140061905
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400618d4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140061905
lodsb al, byte [rsi]
jmp 0x1400618e4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5f000]
mov eax, dword [rdi]
or eax, eax
je 0x140061962
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x611dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140061912
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14006195c
mov qword [rbx], rax
add rbx, 8
jmp 0x140061932
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14006199c
cmp al, 0xef
ja 0x14006198e
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14006196e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14006197d
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140061a1b], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140061a1b
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140061a0b
sub rsp, 0xffffffffffffff80
jmp 0x14002e48c
Function at 0x140f641e4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f641ee
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f64217
pop rbp
sub rbp, 0x33
sub rbp, 0xf641e4
sub rsp, 0x20
jmp 0x140f64236
mov rax, 0xf641e4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x5069fd2a
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f64255
jmp 0x140f6426c
invalid