joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14030a0f0
Capabilities:
Create directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x848
mov rsi, rcx
lea rdi, [rsp + 0x38]
mov qword [rdi], rcx
lea rax, [rsp + 0x40]
lea rbx, [rsp + 0x30]
mov qword [rbx], rax
lea r14, [rsp + 0x840]
call fcn.1401bdfb0
lea rdx, [rsi + rax]
add rdx, 1
mov dword [rsp + 0x20], 0
mov rcx, rdi
mov r8, rbx
mov r9, r14
call fcn.1401cdce0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x14030a15b
lea rcx, [rsp + 0x40]
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
cmp eax, 1
sbb eax, eax
add rsp, 0x848
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14030aef0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
call fcn.140424c80
lea rbx, [rsp + 0x2c]
mov dword [rbx], 0xffffffff
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
mov r8d, esi
mov r9, rbx
call sub.KERNEL32.dll_WriteFile
mov edx, dword [rbx]
xor ecx, ecx
cmp eax, 1
sbb rcx, rcx
or rcx, rdx
mov rax, rcx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140338fa0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov eax, 0xfffffffb
test rcx, rcx
je 0x140339118
mov r13, rdx
test rdx, rdx
je 0x140339118
cmp byte [r13], 1
je 0x140339118
mov rsi, r8
xor eax, eax
test r8, r8
je 0x140339118
mov r14d, r9d
test r9d, r9d
jle 0x140339118
mov rbx, rcx
mov rbp, qword [rsp + 0xa0]
mov edi, r14d
shr edi, 4
mov cl, byte [rcx + 0x14]
cmp cl, 2
je 0x14033907f
mov eax, 0xfffffffb
cmp cl, 1
jne 0x140339118
test edi, edi
je 0x14033903c
lea rbx, [r13 + 0x54]
mov r9d, dword [r13 + 0x4c]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.140454080
add rsi, 0x10
add rbp, 0x10
dec edi
jg 0x14033901e
mov r8d, r14d
and r8d, 0xf
mov ebx, 0x10
sub ebx, r8d
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, rsi
call fcn.14058e590
mov rcx, r15
sub rcx, rbx
add rcx, 0x10
mov edx, ebx
mov r8, rbx
call fcn.14058e9f0
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
mov rcx, r15
jmp 0x140339102
test edi, edi
je 0x1403390c1
lea r15, [r13 + 0x54]
lea r12, [rsp + 0x20]
mov rax, rbx
mov rbx, rbp
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rax]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
mov r9d, dword [r13 + 0x4c]
mov rcx, r12
mov rdx, rbp
mov r8, r15
call fcn.140454080
add rsi, 0x10
lea rbp, [rbp + 0x10]
mov rax, rbx
dec edi
jg 0x14033908f
mov eax, r14d
and eax, 0xf
je 0x1403390df
mov edi, eax
xor edx, edx
mov cl, byte [rbx + rdx]
xor cl, byte [rsi + rdx]
mov byte [rsp + rdx + 0x20], cl
inc rdx
cmp rdx, rdi
jne 0x1403390cd
mov cl, 0x10
sub cl, al
mov dl, byte [rbx + rax]
xor dl, cl
mov byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x10
jne 0x1403390e3
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov r8, r13
call fcn.140454080
add r14d, 0x10
and r14d, 0xfffffff0
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403390c4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov eax, 0xfffffffb
test rcx, rcx
je 0x140339118
mov r13, rdx
test rdx, rdx
je 0x140339118
cmp byte [r13], 1
je 0x140339118
mov rsi, r8
xor eax, eax
test r8, r8
je 0x140339118
mov r14d, r9d
test r9d, r9d
jle 0x140339118
mov rbx, rcx
mov rbp, qword [rsp + 0xa0]
mov edi, r14d
shr edi, 4
mov cl, byte [rcx + 0x14]
cmp cl, 2
je 0x14033907f
mov eax, 0xfffffffb
cmp cl, 1
jne 0x140339118
test edi, edi
je 0x14033903c
lea rbx, [r13 + 0x54]
mov r9d, dword [r13 + 0x4c]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.140454080
add rsi, 0x10
add rbp, 0x10
dec edi
jg 0x14033901e
mov r8d, r14d
and r8d, 0xf
mov ebx, 0x10
sub ebx, r8d
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, rsi
call fcn.14058e590
mov rcx, r15
sub rcx, rbx
add rcx, 0x10
mov edx, ebx
mov r8, rbx
call fcn.14058e9f0
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
mov rcx, r15
jmp 0x140339102
test edi, edi
je 0x1403390c1
lea r15, [r13 + 0x54]
lea r12, [rsp + 0x20]
mov rax, rbx
mov rbx, rbp
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rax]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
mov r9d, dword [r13 + 0x4c]
mov rcx, r12
mov rdx, rbp
mov r8, r15
call fcn.140454080
add rsi, 0x10
lea rbp, [rbp + 0x10]
mov rax, rbx
dec edi
jg 0x14033908f
mov eax, r14d
and eax, 0xf
je 0x1403390df
mov edi, eax
xor edx, edx
mov cl, byte [rbx + rdx]
xor cl, byte [rsi + rdx]
mov byte [rsp + rdx + 0x20], cl
inc rdx
cmp rdx, rdi
jne 0x1403390cd
mov cl, 0x10
sub cl, al
mov dl, byte [rbx + rax]
xor dl, cl
mov byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x10
jne 0x1403390e3
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov r8, r13
call fcn.140454080
add r14d, 0x10
and r14d, 0xfffffff0
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140340550
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
mov ecx, dword [0x1406088b4]
cmp ecx, 0xffffffff
jne 0x14034056f
call sub.KERNEL32.dll_TlsAlloc
mov ecx, eax
mov dword [0x1406088b4], eax
movsxd rdx, esi
add rsp, 0x20
pop rsi
jmp sub.KERNEL32.dll_TlsSetValue
Function at 0x1403a4620
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
mov r10, rdx
lea rax, [rdx + 2]
movabs rsi, 0xaaaaaaaaaaaaaaab
mul rsi
movabs rax, 0x7ffffffffffffffe
and rax, rdx
lea rdx, [rax + rax]
add rdx, 1
mov eax, 0x54
cmp qword [r9], rdx
jb 0x1403a4743
mov rax, r10
mul rsi
shr rdx, 1
lea r11, [rdx + rdx*2]
xor eax, eax
test r11, r11
jne 0x1403a4673
mov rdx, r8
jmp 0x1403a46db
lea rsi, [0x1405c4004]
mov rdx, r8
movzx edi, byte [rcx]
shr rdi, 2
mov bl, byte [rdi + rsi]
mov byte [rdx], bl
movzx edi, byte [rcx]
shl rdi, 4
movzx ebx, byte [rcx + 1]
shr rbx, 4
and edi, 0x30
or rdi, rbx
mov bl, byte [rsi + rdi]
mov byte [rdx + 1], bl
movzx edi, byte [rcx + 1]
movzx ebx, byte [rcx + 2]
shr rbx, 6
and edi, 0xf
lea rdi, [rbx + rdi*4]
mov bl, byte [rsi + rdi]
mov byte [rdx + 2], bl
movzx edi, byte [rcx + 2]
and edi, 0x3f
mov bl, byte [rdi + rsi]
mov byte [rdx + 3], bl
add rdx, 4
add rcx, 3
add rax, 3
cmp rax, r11
jb 0x1403a467d
cmp rax, r10
jae 0x1403a473b
movzx esi, byte [rcx]
inc rax
xor r11d, r11d
cmp rax, r10
jae 0x1403a46f3
movzx r11d, byte [rcx + 1]
mov rdi, rsi
shr rdi, 2
shl rsi, 4
mov ecx, r11d
shr rcx, 4
and esi, 0x30
or rsi, rcx
lea rcx, [0x1405c4004]
mov bl, byte [rdi + rcx]
mov byte [rdx], bl
mov bl, byte [rcx + rsi]
mov byte [rdx + 1], bl
mov bl, 0x3d
cmp rax, r10
jae 0x1403a4730
shl r11d, 2
and r11d, 0x3c
mov bl, byte [r11 + rcx]
mov byte [rdx + 2], bl
mov byte [rdx + 3], 0x3d
add rdx, 4
mov byte [rdx], 0
sub edx, r8d
xor eax, eax
mov qword [r9], rdx
pop rbx
pop rdi
pop rsi
ret
Function at 0x14045400f
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
cmp edx, 2
jl 0x140454073
mov r8d, edx
mov edx, 1
lea r9, [0x140615a20]
lea r10, [0x140615e20]
lea r11, [0x140616220]
lea r14, [0x140616620]
mov rsi, rdx
shl rsi, 4
movzx edi, byte [rcx + rsi]
movzx ebx, byte [rcx + rsi + 1]
mov ebx, dword [r10 + rbx*4]
xor ebx, dword [r9 + rdi*4]
movzx edi, byte [rcx + rsi + 2]
movzx eax, byte [rcx + rsi + 3]
xor ebx, dword [r11 + rdi*4]
xor ebx, dword [r14 + rax*4]
mov dword [rcx + rsi], ebx
movzx eax, byte [rcx + rsi + 4]
movzx edi, byte [rcx + rsi + 5]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 6]
movzx ebx, byte [rcx + rsi + 7]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 4], edi
movzx eax, byte [rcx + rsi + 8]
movzx edi, byte [rcx + rsi + 9]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xa]
movzx ebx, byte [rcx + rsi + 0xb]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 8], edi
movzx eax, byte [rcx + rsi + 0xc]
movzx edi, byte [rcx + rsi + 0xd]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xe]
xor edi, dword [r11 + rax*4]
movzx eax, byte [rcx + rsi + 0xf]
xor edi, dword [r14 + rax*4]
mov dword [rcx + rsi + 0xc], edi
inc rdx
cmp rdx, r8
jne 0x140453fc2
xor eax, eax
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140474800
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov edi, r9d
mov rbx, r8
mov ebp, edx
mov rsi, rcx
mov ecx, edx
call fcn.14035b860
test eax, eax
jne 0x140474927
mov dword [rsi + 0x110], ebp
test edi, edi
jne 0x140474841
mov eax, 0x20001
jmp 0x140474927
movsxd rax, ebp
imul r14, rax, 0x78
lea r15, [0x14067d1d0]
mov r13d, dword [r14 + r15 + 0xc]
mov eax, 0x16
cmp r13d, 0x80
ja 0x140474927
lea r12, [r14 + r15]
add r12, 0x10
mov eax, dword [r12]
cmp eax, edi
jae 0x1404748b7
lea rcx, [rsp + 0x2c]
mov dword [rcx], eax
lea r9, [rsi + 0x228]
mov qword [rsp + 0x20], rcx
mov ecx, ebp
mov rdx, rbx
mov r8d, edi
call fcn.1403405c0
test eax, eax
jne 0x140474927
mov edx, dword [r12]
cmp edx, r13d
jbe 0x1404748ec
sub edx, r13d
lea rcx, [rsi + r13]
add rcx, 0x228
jmp 0x1404748e3
mov ebp, edi
lea rcx, [rsi + 0x228]
mov rdx, rbx
mov r8, rbp
call fcn.1401cda80
mov edx, dword [r12]
mov eax, edx
sub eax, edi
jbe 0x1404748ec
lea rcx, [rsi + rbp]
add rcx, 0x228
mov rdx, rax
call fcn.1401cf370
mov edx, dword [r12]
test edx, edx
je 0x14047490a
mov eax, edx
xor ecx, ecx
mov dl, byte [rsi + rcx + 0x228]
xor dl, 0x36
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, rax
jb 0x1404748f4
mov rcx, rsi
call qword [r14 + r15 + 0x58]
test eax, eax
jne 0x140474927
mov r8d, dword [r12]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [r14 + r15 + 0x60]
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1404749a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov ebp, dword [rcx + 0x110]
mov ecx, ebp
call fcn.14035b860
test eax, eax
jne 0x140474a9f
movsxd rax, ebp
imul rbp, rax, 0x78
lea rsi, [0x14067d1d0]
mov r14d, dword [rbp + rsi + 0xc]
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call qword [rbp + rsi + 0x68]
test eax, eax
jne 0x140474a9f
mov eax, dword [rbp + rsi + 0x10]
test rax, rax
je 0x140474a18
xor ecx, ecx
mov dl, byte [rbx + rcx + 0x228]
xor dl, 0x5c
mov byte [rsp + rcx + 0x20], dl
inc rcx
cmp rcx, rax
jb 0x140474a02
mov rcx, rbx
call qword [rbp + rsi + 0x58]
test eax, eax
jne 0x140474a9f
lea rax, [rsi + rbp]
add rax, 0x10
mov r8d, dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [rax + 0x50]
test eax, eax
jne 0x140474a9f
lea rax, [rsi + rbp]
add rax, 0x60
lea rdx, [rsp + 0xa0]
mov rcx, rbx
mov r8d, r14d
call qword [rax]
test eax, eax
jne 0x140474a9f
lea rax, [rsi + rbp]
add rax, 0x68
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [rax]
test eax, eax
jne 0x140474a9f
xor eax, eax
mov ecx, 0
test r14d, r14d
je 0x140474a9c
xor edx, edx
xor ecx, ecx
mov ebp, dword [r15]
cmp rdx, rbp
jae 0x140474a9a
mov bl, byte [rsp + rdx + 0x20]
mov byte [rdi + rdx], bl
inc rdx
inc ecx
cmp rdx, r14
jb 0x140474a7f
jmp 0x140474a9c
mov ecx, edx
mov dword [r15], ecx
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14048fa90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov r10d, dword [rsp + 0x50]
mov ebp, dword [rsp + 0x48]
mov r11d, r10d
neg r11d
mov esi, ebp
neg esi
cmp r8, 0xc
jb 0x14048fb5e
add esi, r11d
add esi, r9d
mov eax, r10d
shr eax, 0xd
xor eax, esi
add ebp, r11d
sub ebp, eax
mov esi, eax
shl esi, 8
xor esi, ebp
sub r10d, eax
sub r10d, esi
mov edi, esi
shr edi, 0xd
xor edi, r10d
sub eax, esi
sub eax, edi
mov r9d, edi
shr r9d, 0xc
xor r9d, eax
sub esi, edi
sub esi, r9d
mov eax, r9d
shl eax, 0x10
xor eax, esi
sub edi, r9d
sub edi, eax
mov esi, eax
shr esi, 5
xor esi, edi
sub r9d, eax
sub r9d, esi
mov ebx, esi
shr ebx, 3
xor ebx, r9d
sub eax, esi
sub eax, ebx
mov edi, ebx
shl edi, 0xa
xor edi, eax
sub esi, ebx
sub esi, edi
mov eax, edi
shr eax, 0xf
xor eax, esi
mov r9d, dword [rdx]
mov ebp, dword [rdx + 4]
mov r10d, dword [rdx + 8]
xor ebx, r9d
xor edi, ebp
xor eax, r10d
mov dword [rcx], ebx
mov dword [rcx + 4], edi
mov dword [rcx + 8], eax
add rdx, 0xc
add rcx, 0xc
add r8, 0xfffffffffffffff4
mov r11d, r10d
neg r11d
mov esi, ebp
neg esi
cmp r8, 0xb
ja 0x14048fab1
test r8, r8
je case.default.0x14048fbf5
dec r8
cmp r8, 0xa
ja case.default.0x14048fbf5
add esi, r11d
add esi, r9d
mov eax, r10d
shr eax, 0xd
xor eax, esi
add ebp, r11d
sub ebp, eax
mov ebx, eax
shl ebx, 8
xor ebx, ebp
sub r10d, eax
sub r10d, ebx
mov ebp, ebx
shr ebp, 0xd
xor ebp, r10d
sub eax, ebx
sub eax, ebp
mov edi, ebp
shr edi, 0xc
xor edi, eax
sub ebx, ebp
sub ebx, edi
mov esi, edi
shl esi, 0x10
xor esi, ebx
sub ebp, edi
sub ebp, esi
mov eax, esi
shr eax, 5
xor eax, ebp
sub edi, esi
sub edi, eax
mov r9d, eax
shr r9d, 3
xor r9d, edi
sub esi, eax
sub esi, r9d
mov ebp, r9d
shl ebp, 0xa
xor ebp, esi
sub eax, r9d
sub eax, ebp
mov r10d, ebp
shr r10d, 0xf
xor r10d, eax
lea rax, [0x14048fc70]
movsxd rbx, dword [rax + r8*4]
add rbx, rax
jmp rbx
mov eax, r10d
shr eax, 0x10
xor al, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
mov eax, r10d
shr eax, 8
xor al, byte [rdx + 9]
mov byte [rcx + 9], al
xor r10b, byte [rdx + 8]
mov byte [rcx + 8], r10b
mov eax, ebp
shr eax, 0x18
xor al, byte [rdx + 7]
mov byte [rcx + 7], al
mov eax, ebp
shr eax, 0x10
xor al, byte [rdx + 6]
mov byte [rcx + 6], al
shr ebp, 8
xor bpl, byte [rdx + 5]
mov byte [rcx + 5], bpl
xor sil, byte [rdx + 4]
mov byte [rcx + 4], sil
mov eax, r9d
shr eax, 0x18
xor al, byte [rdx + 3]
mov byte [rcx + 3], al
mov eax, r9d
shr eax, 0x10
xor al, byte [rdx + 2]
mov byte [rcx + 2], al
mov eax, r9d
shr eax, 8
xor al, byte [rdx + 1]
mov byte [rcx + 1], al
xor r9b, byte [rdx]
mov byte [rcx], r9b
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140001040
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov edx, 0x47
lea rcx, [entry0]
mov al, byte [rcx + rdx]
xor al, 0x27
add al, 0xc2
xor al, 0x83
mov byte [rcx + rdx], al
inc rdx
cmp rdx, 0x2d9
jl 0x140001068
pop rsi
xlatb
fst qword [rbx + rdx*4 - 0x25]
leave
out 0x2f, eax
pop rdx
sbb esi, dword [rsi]
mov ch, 0x77
invalid
Function at 0x14009d650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14009d6ca
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14009d6c0
cmp r11, r10
ja 0x14009d761
cmp r10, rdx
ja 0x14009d773
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14009d6c2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14009d6a0
jmp 0x14009d737
ja 0x14009d6ca
mov r11, r10
cmp rax, r8
jne 0x14009d672
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14009d73b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14009d710
mov r8, r10
sub ecx, r9d
jns 0x14009d72e
jmp 0x14009d73d
cmp r10, rdx
je 0x14009d749
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14009d73d
xor al, 1
cmp r8, rdx
jne 0x14009d6f0
jmp 0x14009d73d
xor eax, eax
jmp 0x14009d73d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1400c4771]
lea r8, [0x1400c65c0]
mov edx, 0x2b
call fcn.1400944c0
lea r8, str._a_b_n_v
mov rcx, r11
mov rdx, r10
call fcn.14009a950
lea r8, str._a_b_n_v
mov rcx, r10
call fcn.14009a8d0
int3

Function at 0x1400a9c90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400d14c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400a9cb0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400a9cb8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400a9cb0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400a9d0d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400a9d04
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400a9cb0
add rax, 0x28
cmp rax, r9
jne 0x1400a9cf0
xor eax, eax
ret

Function at 0x1400a9d10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400d14c0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400a9d2f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400a9d38
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400a9d2f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400a9dd0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400d14c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400a9def
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400a9df8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140f4b114
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f4b11e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f4b147
pop rbp
sub rbp, 0x33
sub rbp, 0xf4b114
sub rsp, 0x20
jmp 0x140f4b166
mov rax, 0xf4b114
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffe1ffa642
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f4b185
jmp 0x140f4b19c
or cl, bl
stosd dword [rdi], eax
leave
retf

Function at 0x141b77058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141b771df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141b77089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b7706f
add dl, dl
jne 0x141b77096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b770f6
xor eax, eax
add dl, dl
jne 0x141b770a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b771ad
add dl, dl
jne 0x141b770b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b770c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b770d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b770dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141b770ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141b7707e
mov eax, 1
add dl, dl
jne 0x141b77106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b77113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b770fb
sub eax, ebx
mov ebx, 1
jne 0x141b7714c
mov ecx, 1
add dl, dl
jne 0x141b7712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b7713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b77123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b7707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141b77168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b77175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b7715d
cmp eax, 0x7d00
jae 0x141b7719b
cmp eax, 0x500
jb 0x141b77196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b7707e
cmp eax, 0x7f
ja 0x141b7719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b7707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141b771d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141b7707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004bd9b0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x004bd9c0]
mov dword [rax], 1
mov rax, qword [0x004bd9d0]
mov dword [rax], 1
mov rax, qword [0x004bd9a0]
mov dword [rax], 1
mov rax, qword [0x004bd870]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x004bd990]
mov dword [0x004e400c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x004bd950]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004bccb0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x401560
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov ecx, dword [rbp + 0x10]
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
shr ax, 0xf
add rsp, 0x20
pop rbp
ret

Function at 0x401581
Capabilities:
Lock the desktop

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [sym.imp.USER32.dll_LockWorkStation]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0
jne 0x4015bd
lea rdx, str.Failed_to_lock_the_screen_
mov rcx, qword [0x004bd270]
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rdx, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rcx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
nop
add rsp, 0x30
pop rbp
ret

Function at 0x40c3c0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]