joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008940
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008960
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x1400089a8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008954
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008995

Function at 0x1400089d0
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x14001a2c0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008a88
mov rdx, qword [0x14001a200]
lea rcx, [0x14001a200]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140008a58
cmp rdx, rcx
jne 0x140008a3a
mov qword [rdx], rax
cmp rax, rcx
je 0x140008a3f
nop dword [rax]
test rax, rax
je 0x140008a6a
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140008a28
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140008a6a
mov rdx, rax
jmp 0x140008a36
lea rcx, [0x14001a300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008aa6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140008a6a
Function at 0x14006f5b8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140104d10
mov rax, rcx
neg rcx
test rax, 7
je 0x140104d2d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140104d88
test al, 7
jne 0x140104d20
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140104d41
mov rdx, qword [rax - 8]
test dl, dl
je 0x140104db2
test dh, dh
je 0x140104dac
shr rdx, 0x10
test dl, dl
je 0x140104da6
test dh, dh
je 0x140104da0
shr rdx, 0x10
test dl, dl
je 0x140104d9a
test dh, dh
je 0x140104d94
shr edx, 0x10
test dl, dl
je 0x140104d8e
test dh, dh
jne 0x140104d41
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x14006f8d3
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14008f4b0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14008ee30
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14008f4ef
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14019f020]
jmp 0x14008f4f9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x14006fa1d
Capabilities:
Query environment variable

Disassembly:
jmp 0x14011dd30
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14011db60
lea rcx, [rsp + 0x40]
call fcn.14011dce0
movzx eax, al
test eax, eax
jne 0x14011dd78
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14011db90
mov rax, qword [rsp + 0x70]
jmp 0x14011df49
lea rcx, [rsp + 0x40]
call fcn.14011dcb0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14011dc50
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14011dcb0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.140070427
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14011de1e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14011db90
mov rax, qword [rsp + 0x80]
jmp 0x14011df49
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.14006f7d9
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14006f6bc
lea rcx, [rsp + 0x48]
call fcn.14006f39c
movzx eax, al
test eax, eax
jne 0x14011de85
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.14006e771
lea rcx, [rsp + 0x40]
call fcn.14011db90
mov rax, qword [rsp + 0x88]
jmp 0x14011df49
lea rcx, [rsp + 0x48]
call fcn.14006fcd4
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14011dcb0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.140070427
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14011df1b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.14006e771
lea rcx, [rsp + 0x40]
call fcn.14011db90
mov rax, qword [rsp + 0xa0]
jmp 0x14011df49
lea rcx, [rsp + 0x48]
call fcn.14006f699
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.14006e771
lea rcx, [rsp + 0x40]
call fcn.14011db90
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x14006fa2c
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14008f3e0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14008edb0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14008f421
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14019f020]
jmp 0x14008f427
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x14006faa9
Capabilities:
Get geographical location

Disassembly:
jmp 0x14012ae40
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140129d70
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14012aea7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x14019f030]
jmp 0x14012aec9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.14006f347
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x14006fabd
Capabilities:
Terminate process

Disassembly:
jmp 0x1400788e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14006fc84
Capabilities:
Print debug messages

Disassembly:
jmp 0x140138720
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x140188038]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x140138746
jmp 0x1401387c3
mov rcx, qword [rbp + 0x30]
call fcn.14006f5b8
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14013875f
jmp 0x1401387c3
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14013877c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14006e8bb
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.14006ec76
test eax, eax
jne 0x1401387c3
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.14006f76b
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1400700f3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140076fb0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140076fd0
xor al, al
jmp 0x140077051
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140076fe3
xor al, al
jmp 0x140077051
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14007700d
xor al, al
jmp 0x140077051
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140077021
xor al, al
jmp 0x140077051
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140077033
xor al, al
jmp 0x140077051
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14007704f
xor al, al
jmp 0x140077051
mov al, 1
add rsp, 0x38
ret
Function at 0x14007027e
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x140074ce0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [0x140189230]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rbp + 8], rax
mov eax, dword [0x140189230]
inc eax
cdqe
shl rax, 3
mov rcx, rax
call fcn.14006fc5c
mov qword [0x140189238], rax
mov dword [rbp + 0x44], 0
jmp 0x140074d4a
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
mov eax, dword [0x140189230]
cmp dword [rbp + 0x44], eax
jge 0x140074dc9
movsxd rax, dword [rbp + 0x44]
mov r8d, 0x270f
mov rcx, qword [rbp + 8]
mov rdx, qword [rcx + rax*8]
xor ecx, ecx
call fcn.1400709ea
inc rax
mov dword [rbp + 0x64], eax
movsxd rax, dword [rbp + 0x64]
mov rcx, rax
call fcn.14006fc5c
movsxd rcx, dword [rbp + 0x44]
mov rdx, qword [0x140189238]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rbp + 0x64]
movsxd rcx, dword [rbp + 0x44]
movsxd rdx, dword [rbp + 0x44]
mov qword [rbp + 0x158], rdx
mov r8, rax
mov rax, qword [rbp + 8]
mov rdx, qword [rax + rcx*8]
mov rax, qword [0x140189238]
mov rcx, qword [rbp + 0x158]
mov rcx, qword [rax + rcx*8]
call fcn.1400709ea
jmp 0x140074d42
movsxd rax, dword [0x140189230]
mov rcx, qword [0x140189238]
mov qword [rcx + rax*8], 0
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.14006e497
mov dword [rbp + 0x24], eax
mov dword [rbp + 0x84], 0
jmp 0x140074e0b
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov eax, dword [0x140189230]
cmp dword [rbp + 0x84], eax
jge 0x140074e32
movsxd rax, dword [rbp + 0x84]
mov rcx, qword [0x140189238]
mov rcx, qword [rcx + rax*8]
call fcn.14006f194
jmp 0x140074dfd
mov rcx, qword [0x140189238]
call fcn.14006f194
mov eax, dword [rbp + 0x24]
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x1400705ad
Capabilities:
Terminate process

Disassembly:
jmp 0x140105700
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14010572e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140070cb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140070d0f
Capabilities:
Print debug messages

Disassembly:
jmp 0x140115a00
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140070db4
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x14008f520
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14008ee70
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14008f569
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14019f020]
jmp 0x14008f578
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret
Function at 0x140141260
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14006e8bb
sub rsp, rax
mov rax, qword [0x140188038]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14018fd00]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140141452
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1401413a6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1401413a6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14014138b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140141328
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140141412
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140141471
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14014144d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140141471
jmp 0x1401412fe
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14006f76b
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140141520
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14006e8bb
sub rsp, rax
mov rax, qword [0x140188038]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x14018fd00]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14014172d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140141679
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140141679
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140141659
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1401415e8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401416ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14014174c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x140141728
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14014174c
jmp 0x1401415be
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.14006f76b
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x141627058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1416271df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141627089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14162706f
add dl, dl
jne 0x141627096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416270f6
xor eax, eax
add dl, dl
jne 0x1416270a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416271ad
add dl, dl
jne 0x1416270b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416270c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416270d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416270dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1416270ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14162707e
mov eax, 1
add dl, dl
jne 0x141627106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141627113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416270fb
sub eax, ebx
mov ebx, 1
jne 0x14162714c
mov ecx, 1
add dl, dl
jne 0x14162712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14162713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141627123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14162707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141627168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141627175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14162715d
cmp eax, 0x7d00
jae 0x14162719b
cmp eax, 0x500
jb 0x141627196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14162707e
cmp eax, 0x7f
ja 0x14162719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14162707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1416271d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14162707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400086d0
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r8, rcx
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.140016598
cmp dword [rsp + 0x70], 0x5c005c
jne 0x14000874d
mov ebx, 0x5c
lea rcx, [rsp + 0x74]
mov edx, ebx
call fcn.14000dbb0
test rax, rax
je 0x140008799
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.14000dbb0
xor ecx, ecx
test rax, rax
jne 0x140008747
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], cx
jne 0x140008737
add rax, rax
mov dword [rax], ebx
jmp 0x140008754
mov word [rax + 2], cx
jmp 0x140008754
xor ecx, ecx
mov word [rsp + 0x76], cx
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x1400087bc
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000c070
add rsp, 0x290
pop rbx
ret
lea rdx, [0x14003a268]
lea rcx, [rsp + 0x40]
call fcn.14000a050
lea rdx, [0x14003df60]
lea rcx, [rsp + 0x40]
call fcn.14000de30
int3
lea rdx, [0x14003a288]
lea rcx, [rsp + 0x40]
call fcn.14000a050
lea rdx, [0x14003df60]
lea rcx, [rsp + 0x40]
call fcn.14000de30
int3