joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7c15bd988
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
push rdi
sub rsp, 0x30
xor edi, edi
mov r9, r8
mov dword [rax + 0x20], edi
lea rax, [rax + 0x20]
mov rbx, rcx
mov qword [rsp + 0x28], rax
mov r8, rdx
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x7ff7c15bd9f7
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15bda5e
test byte [rcx + 0x1c], 4
je 0x7ff7c15bda5e
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x2f]
lea r8, [0x7ff7c15fb178]
call fcn.7ff7c15a1e00
jmp 0x7ff7c15bda5e
mov ebx, 0x80004005
call qword [sym.imp.msvcrt.dll__errno]
mov edx, dword [rax]
sub edx, 0xb
je 0x7ff7c15bda26
sub edx, 1
je 0x7ff7c15bda18
sub edx, 1
je 0x7ff7c15bda1f
cmp edx, 9
jne 0x7ff7c15bda2b
mov ebx, 0x8007000e
jmp 0x7ff7c15bda2b
mov ebx, 0x80070005
jmp 0x7ff7c15bda2b
mov ebx, 0x8007009b
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15bda5c
test byte [rcx + 0x1c], 1
je 0x7ff7c15bda5c
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff7c15fb178]
mov edx, 0x30
mov r9d, ebx
call fcn.7ff7c15a1eb4
mov edi, ebx
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x7ff7c15bdad4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x7ff7c15bdb48
call fcn.7ff7c15bfd78
mov ebx, eax
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15bdb44
test byte [rcx + 0x1c], 1
je 0x7ff7c15bdb44
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff7c15fb178]
mov edx, 0x38
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.7ff7c15a595c
mov eax, ebx
jmp 0x7ff7c15bdb6a
cmp r9d, ebx
ja 0x7ff7c15bdb5e
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x7ff7c15bdb65
mov eax, 0x8000ffff
jmp 0x7ff7c15bdb6a
test ebx, ebx
je 0x7ff7c15bdb65
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x7ff7c15bdd58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x7ff7c15bddc1
call fcn.7ff7c15bfd78
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x7ff7c15bddc5
mov rcx, qword [0x7ff7c161b240]
lea rax, [0x7ff7c161b240]
cmp rcx, rax
je 0x7ff7c15bddbd
test byte [rcx + 0x1c], 1
je 0x7ff7c15bddbd
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff7c15fb178]
mov edx, 0x3d
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.7ff7c15a595c
mov eax, ebx
jmp 0x7ff7c15bddc5
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff7c15bf058
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, qword [rdx]
or rsi, 0xffffffffffffffff
mov rdi, rsi
xor r12d, r12d
mov r14, rcx
mov ebx, 0x2db39507
inc rdi
cmp word [r15 + rdi*2], r12w
jne 0x7ff7c15bf083
mov rbp, r12
test rdi, rdi
je 0x7ff7c15bf0e2
movzx ecx, word [r15 + rbp*2]
call qword [sym.imp.msvcrt.dll_towlower]
mov word [rsp + 0x50], ax
mov rdx, r12
movzx ecx, byte [rsp + rdx + 0x50]
movabs r8, 0xf000000000000000
shl rbx, 4
inc rdx
add rcx, rbx
mov rax, rcx
and rax, r8
mov rbx, rax
shr rbx, 0x38
xor rbx, rax
xor rbx, rcx
cmp rdx, 2
jb 0x7ff7c15bf0a8
inc rbp
cmp rbp, rdi
jb 0x7ff7c15bf095
mov rcx, qword [r14 + 0x28]
mov rax, rcx
and rax, rbx
cmp qword [r14 + 0x30], rax
ja 0x7ff7c15bf0fb
shr rcx, 1
sub rsi, rcx
add rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x7ff7c15c055c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x7ff7c1621170]
test rcx, rcx
jne 0x7ff7c15c0582
call fcn.7ff7c15c061c
test eax, eax
je 0x7ff7c15c05bb
mov rcx, qword [0x7ff7c1621170]
call qword [sym.imp.api_ms_win_core_interlocked_l1_1_0.dll_InterlockedPopEntrySList]
xor ecx, ecx
test rax, rax
je 0x7ff7c15c059f
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], ecx
mov word [rax + 0x14], cx
jmp 0x7ff7c15c060f
mov edx, 0x1000
mov r9d, 0x40
mov r8d, edx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x7ff7c15c05bf
xor eax, eax
jmp 0x7ff7c15c060f
mov eax, dword [rax]
mov rcx, qword [0x7ff7c1621170]
call qword [sym.imp.api_ms_win_core_interlocked_l1_1_0.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x7ff7c15c05ec
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualFree]
mov rax, rdi
jmp 0x7ff7c15c060f
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x7ff7c1621170]
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_interlocked_l1_1_0.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x7ff7c15c05f3
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7c15e5a08
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x28]
xor edi, edi
mov rbx, rcx
test eax, eax
jne 0x7ff7c15e5b97
lea ecx, [rdi + 0x18]
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
je 0x7ff7c15e5a38
and qword [rax], rdi
mov qword [rsp + 0x58], rax
test rax, rax
je 0x7ff7c15e5b2a
mov rdx, rbx
xchg qword [rax], rdx
test rdx, rdx
je 0x7ff7c15e5a68
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff7c15f6588]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x7ff7c15f6588]
mov rax, qword [rsp + 0x58]
lea rcx, [0x7ff7c15d22d0]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x10], rcx
lock inc dword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov r9, qword [rsp + 0x58]
lea r8, [0x7ff7c15e5bb0]
and qword [rsp + 0x28], rdi
xor edx, edx
and dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x7ff7c15e5b21
or ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x7ff7c15e5ae8
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x7ff7c161b240]
lea rdx, [0x7ff7c161b240]
cmp rcx, rdx
je 0x7ff7c15e5b63
test byte [rcx + 0x1c], 1
je 0x7ff7c15e5b63
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff7c15fc378]
mov edx, 0xb
mov r9d, eax
call fcn.7ff7c15a1eb4
jmp 0x7ff7c15e5b63
xor eax, eax
xchg qword [rsp + 0x58], rax
jmp 0x7ff7c15e5b63
mov rcx, qword [0x7ff7c161b240]
lea rdx, [0x7ff7c161b240]
cmp rcx, rdx
je 0x7ff7c15e5b58
test byte [rcx + 0x1c], 1
je 0x7ff7c15e5b58
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff7c15fc378]
mov edx, 0xc
call fcn.7ff7c15a1e00
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
xchg qword [rsp + 0x58], rbx
test rbx, rbx
je 0x7ff7c15e5b97
mov rcx, qword [rbx]
test rcx, rcx
je 0x7ff7c15e5b8e
mov rax, qword [rcx]
movsxd rdx, dword [rax + 4]
add rcx, rdx
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x7ff7c15f6588]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff7c15e74d4
Capabilities:
Parse pe header

Disassembly:
test cx, cx
jne 0x7ff7c15e75b8
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, 0x5a4d
mov rdi, rcx
cmp word [rcx], ax
jne 0x7ff7c15e75ae
test byte [rcx + 0x3c], 3
jne 0x7ff7c15e75ae
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x7ff7c15e75ae
cmp dword [rdx + 0x84], 6
jb 0x7ff7c15e75ae
mov r8d, dword [rdx + 0x50]
mov r9d, dword [rdx + 0xb8]
lea eax, [r8 - 1]
lea ecx, [r9 - 1]
cmp ecx, eax
jae 0x7ff7c15e75ae
mov ecx, dword [rdx + 0xbc]
mov eax, r8d
sub eax, r9d
cmp ecx, eax
ja 0x7ff7c15e75ae
movabs rax, 0x2492492492492493
lea r10, [rdi + r9]
mul rcx
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 4
test ecx, ecx
je 0x7ff7c15e75ae
dec ecx
mov eax, ecx
imul rbx, rax, 0x1c
add rbx, r10
cmp dword [rbx + 0xc], 2
jne 0x7ff7c15e7567
cmp dword [rbx + 0x14], r8d
jae 0x7ff7c15e7567
mov eax, r8d
sub eax, dword [rbx + 0x14]
cmp dword [rbx + 0x10], eax
ja 0x7ff7c15e7567
mov edx, 0x1c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
test eax, eax
je 0x7ff7c15e75ae
mov ecx, dword [rbx + 0x14]
mov edx, dword [rbx + 0x10]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7c15e76dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x7ff7c1621320], rbx
je 0x7ff7c15e7728
cmp rax, rbx
jne 0x7ff7c15e771b
mov ebx, 1
mov esi, ebx
jmp 0x7ff7c15e772d
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x7ff7c15e7700
mov ebx, 1
mov eax, dword [0x7ff7c1621328]
cmp eax, ebx
jne 0x7ff7c15e7743
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x7ff7c15e77a8
mov eax, dword [0x7ff7c1621328]
test eax, eax
jne 0x7ff7c15e77a2
mov dword [0x7ff7c1621328], ebx
lea r15, [0x7ff7c15f6678]
lea rdi, [0x7ff7c15f6660]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x7ff7c15e7794
test eax, eax
jne 0x7ff7c15e7798
cmp qword [rdi], 0
je 0x7ff7c15e7789
mov rax, qword [rdi]
mov rcx, qword [0x7ff7c15f6588]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x7ff7c15e776a
test eax, eax
je 0x7ff7c15e77a8
mov eax, 0xff
jmp 0x7ff7c15e7884
mov dword [0x7ff7c1620384], ebx
mov eax, dword [0x7ff7c1621328]
cmp eax, ebx
jne 0x7ff7c15e77cf
lea rdx, [0x7ff7c15f6658]
lea rcx, [0x7ff7c15f6590]
call sub.msvcrt.dll__initterm
mov dword [0x7ff7c1621328], 2
test esi, esi
jne 0x7ff7c15e77dc
xor eax, eax
xchg qword [0x7ff7c1621320], rax
cmp qword [0x7ff7c1621340], 0
je 0x7ff7c15e7810
lea rcx, [0x7ff7c1621340]
call fcn.7ff7c15e7b60
test eax, eax
je 0x7ff7c15e7810
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x7ff7c1621340]
mov r9, qword [0x7ff7c15f6588]
call r9
mov r8, qword [0x7ff7c1620398]
mov rdx, qword [0x7ff7c1620390]
mov ecx, dword [0x7ff7c1620388]
call fcn.7ff7c15a1778
mov dword [0x7ff7c1620380], eax
cmp dword [0x7ff7c16203a0], 0
jne 0x7ff7c15e7840
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x7ff7c1620384], 0
jne 0x7ff7c15e7855
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x7ff7c1620380]
jmp 0x7ff7c15e7884
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.7ff7c15e7be0
add rsp, 0x28
jmp 0x7ff7c15e76dc

Function at 0x7ff7c15e7a70
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x7ff7c15e7abc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff7c15e7ab4
cmp dword [rcx + 0x3c], edx
jl 0x7ff7c15e7ab4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x7ff7c15e7ab4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x7ff7c15e7abc
mov rax, rdx
add rsp, 0x18
ret
Function at 0x7ff7c15e8204
Capabilities:
Print debug messages

Disassembly:
jmp 0x7ff7c15e820c
push rbx
sub rsp, 0x540
mov rax, qword [0x7ff7c1620328]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x7ff7c15e8289
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlVirtualUnwind]
jmp 0x7ff7c15e82a9
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.7ff7c15e78d0
add rsp, 0x540
pop rbx
ret

Function at 0x7ff7c15e820c
Capabilities:
Print debug messages

Disassembly:
jmp 0x7ff7c15e820c
push rbx
sub rsp, 0x540
mov rax, qword [0x7ff7c1620328]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x7ff7c15e8289
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_rtlsupport_l1_1_0.dll_RtlVirtualUnwind]
jmp 0x7ff7c15e82a9
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.7ff7c15e78d0
add rsp, 0x540
pop rbx
ret
Function at 0x140027db0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b754
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b754
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f00
cmp rax, 0xffffffffffffffff
je 0x140027f00
xor edi, edi
test rbp, rbp
jle 0x140027eab
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dd40
mov rbx, rax
test rax, rax
jne 0x140027e38
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027ea1
mov edx, 0x8000
mov ecx, r14d
call fcn.1400158f8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c430
cmp eax, 0xffffffff
je 0x140027e81
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027e48
mov edx, r15d
mov ecx, r14d
call fcn.1400158f8
jmp 0x140027ea1
cmp byte [rsi + 0x38], dil
je 0x140027e98
cmp dword [rsi + 0x34], 5
jne 0x140027e98
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027ea1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019e18
jmp 0x140027f14
jns 0x140027f14
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b754
cmp rax, 0xffffffffffffffff
jne 0x140027ecc
cmp byte [rsi + 0x30], dil
je 0x140027f14
mov edi, dword [rsi + 0x2c]
jmp 0x140027f14
mov ecx, r14d
call fcn.140016ef8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027f14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027f14
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f0d
mov eax, dword [rsi + 0x2c]
jmp 0x140027f12
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b754
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140a05000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x140a0500a
jmp 0x140a0700f
jmp fcn.1406dc058
Function at 0x420e80
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00754895], 0
jne 0x420fe5
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x420f8e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x420fda
lea rbx, [0x00736738]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x420f4f
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x420faa
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x420eb5
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x420eb5
mov ecx, 0x40
nop
call fcn.004671c0
lea rax, [0x00509063]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.00436900
nop
int3
Function at 0x4516a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x451859
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rdx]
test ebx, ebx
jne 0x4516d6
movzx esi, byte [rsp + 0x48]
test sil, sil
je 0x451807
bt ebx, 7
nop word [rax + rax]
jae 0x4517f9
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x451700
lea esi, [rcx + 7]
mov rcx, rax
mov eax, r8d
nop word [rax + rax]
cmp rcx, rax
jbe 0x451854
movzx edi, byte [rax + rdx]
lea r8d, [rax + 1]
mov r9d, edi
and edi, 0x7f
mov rax, rcx
mov ecx, esi
shl edi, cl
or ebx, edi
test r9b, 0x80
jne 0x4516ee
mov esi, ebx
and ebx, 1
neg ebx
shr esi, 1
xor ebx, esi
mov rsi, qword [rsp + 0x40]
add dword [rsi], ebx
nop dword [rax + rax]
cmp rax, r8
jb 0x451849
sub rax, r8
mov rbx, qword [rsp + 0x30]
sub rbx, r8
mov rsi, rbx
neg rbx
sar rbx, 0x3f
and r8, rbx
lea rbx, [rdx + r8]
test rax, rax
jbe 0x45183f
movzx edx, byte [rdx + r8]
bt edx, 7
jae 0x4517f1
xor ecx, ecx
xor edx, edx
xor edi, edi
nop
jmp 0x451788
lea edi, [rcx + 7]
mov ecx, r9d
cmp rax, rcx
jbe 0x451832
movzx r8d, byte [rcx + rbx]
lea r9d, [rcx + 1]
mov r10d, r8d
and r8d, 0x7f
mov ecx, edi
shl r8d, cl
or edx, r8d
test r10b, 0x80
jne 0x451782
cmp rax, r9
jb 0x451827
mov rcx, qword [rsp + 0x38]
add qword [rcx], rdx
sub rsi, r9
mov rcx, rsi
neg rsi
sar rsi, 0x3f
and rsi, r9
lea rdx, [rbx + rsi]
mov qword [rsp + 0x50], rdx
sub rax, r9
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov r9d, 1
jmp 0x4517af
mov rax, rcx
mov r8d, 1
jmp 0x451726
mov qword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov eax, r9d
call fcn.00467260
mov rdx, rax
mov eax, ecx
mov rcx, rdx
call fcn.004671a0
mov rcx, rax
xor eax, eax
call fcn.004671a0
mov rcx, rax
mov eax, r8d
call fcn.00467260
call fcn.004671a0
xor eax, eax
nop dword [rax + rax]
call fcn.004671a0
nop
int3

Function at 0x458a80
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x458b61
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00460940]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00464e60
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.00464fc0
jmp fcn.00458a80
Function at 0x466c40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00754b60]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x00754894], 0
je 0x466c7d
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00754de0]
aesenc xmm0, xmmword [0x00754df0]
aesenc xmm0, xmmword [0x00754e00]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x409a80

Function at 0x4739e0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x473ab9
lea rsi, [rdx + rdx*2]
lea rdi, [0x00706a60]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x473a62
inc rdx
nop
jmp 0x473a38
cmp r9, 0xffffffffffffffe0
jle 0x473a6d
dec rdx
jmp 0x473a38
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.004671a0
nop
int3