joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000af50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov edi, r9d
mov rbx, rdx
mov r14, rcx
test r9d, r9d
je 0x14000b01c
test dil, 0xf
jne 0x14000b01c
mov r15, rdx
mov edx, edi
test r9d, r9d
je 0x14000afa5
mov rcx, rbx
sub r8, rbx
mov al, byte [r8 + rcx]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000af96
lea ecx, [rdi - 0x10]
mov esi, edi
add rbx, rcx
shr esi, 4
test esi, esi
je 0x14000b005
mov rdx, rbx
mov rcx, r14
call fcn.14000b3dc
cmp dword [r14 + 8], 1
jne 0x14000affc
mov rcx, rbx
cmp esi, 1
jne 0x14000afe9
mov rdx, qword [r14 + 0x18]
lea r8d, [rsi + 0xf]
sub rdx, rbx
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x14000afd9
jmp 0x14000affc
mov edx, 0x10
mov al, byte [rcx - 0x10]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000afee
sub rbx, 0x10
add esi, 0xffffffff
jne 0x14000afb4
lea ecx, [rdi - 1]
movzx r8d, byte [rcx + r15]
mov ecx, edi
sub ecx, r8d
cmp r8d, edi
cmovbe ebp, ecx
mov eax, ebp
jmp 0x14000b01e
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14000b038
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r9d
mov rbx, rdx
mov rbp, rcx
test r9d, r9d
jne 0x14000b05e
xor eax, eax
jmp 0x14000b0dc
mov rdx, rsi
test r9d, r9d
je 0x14000b07b
mov rcx, rbx
sub r8, rbx
mov al, byte [r8 + rcx]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000b06c
lea ecx, [rsi - 0x10]
mov edi, esi
add rbx, rcx
shr edi, 4
test edi, edi
je 0x14000b0da
mov rdx, rbx
mov rcx, rbp
call fcn.14000b3dc
cmp dword [rbp + 8], 1
jne 0x14000b0d1
mov rcx, rbx
cmp edi, 1
jne 0x14000b0be
mov rdx, qword [rbp + 0x18]
lea r8d, [rdi + 0xf]
sub rdx, rbx
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x14000b0ae
jmp 0x14000b0d1
mov edx, 0x10
mov al, byte [rcx - 0x10]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000b0c3
sub rbx, 0x10
add edi, 0xffffffff
jne 0x14000b08a
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b0f4
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r10d, r9d
mov rbx, r8
mov r14, rcx
test r9d, r9d
je 0x14000b131
sub rdx, rbx
mov al, byte [rdx + r8]
mov byte [r8], al
inc r8
sub r10, 1
jne 0x14000b121
mov edx, r9d
mov rcx, rbx
call fcn.14000af04
mov r13d, eax
test eax, eax
je 0x14000b227
mov rdx, qword [r14 + 0x18]
mov edi, r13d
shr edi, 4
test edi, edi
je 0x14000b224
mov r15, r14
mov r9d, 0x10
sub r15, rbx
add r15, 0x20
cmp dword [r14 + 8], 1
jne 0x14000b187
mov rcx, rbx
sub rdx, rbx
mov r8, r9
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x14000b179
mov rsi, rbx
mov rcx, r9
mov al, byte [r15 + rsi]
xor byte [rsi], al
inc rsi
sub rcx, 1
jne 0x14000b18d
cmp dword [r14], 1
mov r12b, 1
jl 0x14000b212
lea ebp, [rcx + 1]
mov rcx, rbx
mov rdx, r9
movzx eax, byte [rcx]
lea r8, [0x14000d4b0]
mov al, byte [rax + r8]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000b1ae
mov rcx, rbx
call fcn.14000b650
cmp ebp, dword [r14]
je 0x14000b1de
xor edx, edx
mov rcx, rbx
call fcn.14000b4a0
shl ebp, 4
mov r9d, 0x10
mov r8d, ebp
mov rcx, rbx
sub r8, rbx
mov edx, r9d
add r8, r14
mov al, byte [r8 + rcx + 0x20]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000b1f6
inc r12b
movzx ebp, r12b
cmp ebp, dword [r14]
jle 0x14000b1a8
sub r15, r9
mov rdx, rbx
mov rbx, rsi
add edi, 0xffffffff
jne 0x14000b169
mov eax, r13d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000b244
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov edx, dword [rcx + 4]
mov rbx, rcx
mov dword [rax + 8], 1
mov r14b, 1
mov r15d, 4
sub edx, 0x80
je 0x14000b2a5
sub edx, 0x40
je 0x14000b292
cmp edx, 0x40
jne 0x14000b2a5
mov dword [rcx], 0xe
lea esi, [rdx - 0x38]
lea edi, [rdx - 0x20]
jmp 0x14000b2a0
mov esi, 6
mov dword [rcx], 0xc
lea edi, [rsi + 0x12]
mov al, dil
jmp 0x14000b2b5
mov eax, 0x10
mov dword [rcx], 0xa
mov edi, eax
mov esi, r15d
mov rdx, qword [rbx + 0x10]
add rcx, 0x20
mov r8, rdi
movzx ebp, al
call fcn.14000bdc0
mov eax, dword [rbx]
lea r8, [rbx + 0x20]
add r8, rdi
lea eax, [rax*4 + 4]
cmp ebp, eax
jge 0x14000b3c1
mov r10d, esi
lea r9, [rsp + 0x40]
neg r10
lea rdi, [0x14000d4b0]
sub r9, r8
mov r11b, bpl
mov ecx, dword [r8 - 4]
xor edx, edx
mov eax, ebp
mov dword [r8], ecx
div esi
test edx, edx
jne 0x14000b372
mov al, byte [r8 + 1]
mov rdx, r15
mov byte [r8], al
mov al, byte [r8 + 2]
mov byte [r8 + 1], al
mov al, byte [r8 + 3]
mov byte [r8 + 3], cl
mov rcx, r8
mov byte [r8 + 2], al
movzx eax, byte [rcx]
mov al, byte [rax + rdi]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000b32a
mov rcx, r8
mov rdx, r15
mov al, byte [r9 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000b341
mov al, r14b
mov dl, r14b
add al, al
movzx ecx, al
mov al, cl
mov r14d, ecx
xor al, 0x1b
test dl, dl
movzx eax, al
cmovs r14d, eax
mov byte [rsp + 0x40], r14b
jmp 0x14000b393
cmp esi, 6
jbe 0x14000b393
cmp edx, r15d
jne 0x14000b393
mov rcx, r8
mov rdx, r15
movzx eax, byte [rcx]
mov al, byte [rax + rdi]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000b382
mov rcx, r15
mov al, byte [r8 + r10*4]
xor byte [r8], al
inc r8
sub rcx, 1
jne 0x14000b396
mov eax, dword [rbx]
inc r11b
sub r9, r15
movzx ebp, r11b
lea eax, [rax*4 + 4]
cmp ebp, eax
jl 0x14000b2f8
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14000b3dc
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx]
lea r9, [rcx + 0x20]
shl eax, 4
mov ebp, 0x10
cdqe
mov rsi, rdx
add r9, rax
mov r8, rdx
sub r9, rdx
mov edx, ebp
mov al, byte [r9 + r8]
xor byte [r8], al
inc r8
sub rdx, 1
jne 0x14000b40e
movzx edi, byte [rcx]
test dil, dil
je 0x14000b48a
lea rbx, [rdi + 1]
shl rbx, 4
sub rbx, rsi
add rbx, rcx
mov dl, 1
mov rcx, rsi
call fcn.14000b650
mov rcx, rsi
mov rdx, rbp
movzx eax, byte [rcx]
lea r8, [0x14000d3b0]
mov al, byte [rax + r8]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000b444
mov rcx, rsi
mov rdx, rbp
mov al, byte [rbx + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000b463
cmp dil, 1
je 0x14000b481
mov dl, 1
mov rcx, rsi
call fcn.14000b4a0
sub rbx, rbp
add dil, 0xff
jne 0x14000b434
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b8b0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x60], 0
mov ebx, 4
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x14000b911
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
test rax, rax
je 0x14000b911
lea rdx, [0x14000c9b0]
mov rcx, rax
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x14000b929
add rbx, 4
cmp rbx, 0x10000000
jb 0x14000b8d0
mov eax, 0xc0000001
add rsp, 0x50
pop rbx
ret
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14000b91e
xorps xmm0, xmm0
mov qword [rsp + 0x68], rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea r9, [0x14000c9c0]
lea r8, [0x14000c9d0]
lea rdx, [0x14000c210]
lea rcx, [0x14000c9e0]
call fcn.14000b6e0
mov r9, rax
lea r8, [0x14000c9f0]
xor edx, edx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
test rdi, rdi
jne 0x14000b9a5
mov rdi, qword [rsp + 0x68]
mov eax, 0xc0000141
add rsp, 0x50
pop rbx
ret
mov eax, dword [rdi + 1]
lea rcx, [rsp + 0x20]
add eax, 5
movsxd rdx, eax
add rdx, rdi
mov qword [0x140011de8], rdx
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdi, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140101490]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1401014a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.1400e3d20
jmp 0x14000123c
mov rax, qword [0x1401014a0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1401014a0]
mov dword [rax], 1
mov rax, qword [0x1401014e0]
mov rdx, rax
mov rax, qword [0x1401014d0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000123c
mov dword [0x140105024], 1
mov rax, qword [0x1401014a0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1401014c0]
mov rdx, rax
mov rax, qword [0x1401014b0]
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov rax, qword [0x1401014a0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140101490]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1401013e0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1401013e0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.1400e2fa8
mov rax, qword [0x140101520]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140101480]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.1400e27a0
mov eax, dword [0x140105004]
lea rdx, [0x140105008]
mov ecx, eax
call fcn.14000147c
call fcn.1400e2537
mov rax, qword [0x140101410]
mov rax, qword [rax]
mov rdx, qword [0x140105010]
mov qword [rax], rdx
mov rcx, qword [0x140105010]
mov rdx, qword [0x140105008]
mov eax, dword [0x140105004]
mov r8, rcx
mov ecx, eax
call fcn.1400016d0
mov dword [0x14010501c], eax
mov eax, dword [0x140105020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14010501c]
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov eax, dword [0x140105024]
test eax, eax
jne 0x14000136c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x14010501c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140101440]
mov dword [rax], 1
mov rax, qword [0x140101450]
mov dword [rax], 1
mov rax, qword [0x140101460]
mov dword [rax], 1
mov rax, qword [0x140101400]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400e27b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.1400e3b10
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x1400e3482
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140105168]
test eax, eax
je 0x1400e351a
lea rax, [0x140105140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140105170]
mov qword [rbp - 8], rax
jmp 0x1400e34fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400e34f2
cmp qword [rbp - 0x10], 0
je 0x1400e34f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400e34b8
lea rax, [0x140105140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400e351b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400e3620
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400e3648
mov eax, 0
jmp 0x1400e3696
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400e3671
mov eax, 0
jmp 0x1400e3696
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400e3691
mov eax, 0
jmp 0x1400e3696
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400e369c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400e371a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400e3711
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400e3711
mov rax, qword [rbp - 8]
jmp 0x1400e372f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400e36e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020504]
cmp r15, 1
jne 0x140004953
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205e4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205e4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205e4]
call fcn.14000dd0c
mov rcx, qword [0x1400205e4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205ec]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f180]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021200]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020630]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020630]
call fcn.1400123b8
lea rcx, [0x140021200]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
not byte [rbp - 0x5e6fcd4e]
movabs eax, dword [0x639b1bbe070c56f3]
adc byte [rdi + 0x1e], dh
and al, 0x8f
movsd dword [rdi], dword [rsi]
pop rbp
cld
sub eax, dword [rcx - 0x2a7207b9]
mov cl, 0x7d
cmp al, 0xe5
in eax, dx
lahf
fild qword [rbp - 0x7ecce759]
int 0xd2
cmp byte [rcx], cl
pop rcx
iretd
cmpsd dword [rsi], dword [rdi]
or dh, dl
test dword [rbx - 0x60], ebp
cmp dword [rbx - 0x7b52693d], esp
invalid
ja 0x14003f634
invalid
sal ch, 0xd2
push rbx
cmp eax, 0xfbe59a99
xchg dword [rdx - 0x4aca4792], esi
test eax, 0xf88ab485
mov bh, al
mov bh, al
loopne 0x14003f661
xor ecx, dword [rbx + rsi*4 + 0x2d]
invalid
invalid
invalid
mov ebx, 0xb66ab68c
call 0x160b2cd8f
invalid
scasb al, byte [rdi]
invalid
invalid
fsub dword [rdi + 0x3f3fdf72]
xchg dword [rsi + 0x13], ebx
push rax
mov al, 0xa7
test dword [rsi + rax*4 - 0x3b], 0x2af527c6
mov esi, 0xdd16ef6a
retf 0x9ef1
Function at 0x180947058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1809471df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180947089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18094706f
add dl, dl
jne 0x180947096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1809470f6
xor eax, eax
add dl, dl
jne 0x1809470a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1809471ad
add dl, dl
jne 0x1809470b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809470c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809470d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1809470dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1809470ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18094707e
mov eax, 1
add dl, dl
jne 0x180947106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180947113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1809470fb
sub eax, ebx
mov ebx, 1
jne 0x18094714c
mov ecx, 1
add dl, dl
jne 0x18094712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18094713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180947123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18094707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180947168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180947175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18094715d
cmp eax, 0x7d00
jae 0x18094719b
cmp eax, 0x500
jb 0x180947196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18094707e
cmp eax, 0x7f
ja 0x18094719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18094707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1809471d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18094707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400052bc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400ccc48]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000532b
cmp byte [rcx + 0x71], 0
je 0x14000532b
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000537f
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140005345
sub eax, 1
je 0x140005349
cmp eax, 2
jne 0x14000537f
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140043a90
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005376
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1400539b4
cmp rdi, rax
jne 0x14000537f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000532d
xor al, al
jmp 0x14000532d