joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000ddf4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15d, edx
mov rbx, rcx
test rcx, rcx
je 0x18000de64
movsxd rax, dword [rcx + 0x3c]
xor r14d, r14d
mov edi, dword [rax + rcx + 0x88]
movsxd r12, dword [rax + rcx + 0x8c]
add rdi, rcx
mov ebp, dword [rdi + 0x20]
mov esi, dword [rdi + 0x24]
add rbp, rcx
add rsi, rcx
cmp dword [rdi + 0x18], r14d
jbe 0x18000de64
mov ecx, dword [rbp]
or edx, 0xffffffff
add rcx, rbx
call fcn.18000d31c
cmp eax, r15d
je 0x18000de7f
inc r14d
add rbp, 4
add rsi, 2
cmp r14d, dword [rdi + 0x18]
jb 0x18000de40
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
movzx eax, word [rsi]
test eax, eax
js 0x18000de64
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov r8d, dword [rcx + rax*4]
add r8, rbx
cmp r8, rdi
jbe 0x18000df49
lea rax, [rdi + r12]
cmp r8, rax
jae 0x18000df49
mov al, byte [r8]
xor edx, edx
cmp al, 0x2e
je 0x18000decc
lea r9, [rsp + 0x20]
mov rcx, r8
sub r9, r8
mov byte [r9 + rcx], al
inc rcx
inc edx
mov al, byte [rcx]
cmp al, 0x2e
jne 0x18000debd
lea ecx, [rdx + 1]
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0x2e
movsxd rax, ecx
movsxd rbx, ecx
mov byte [rsp + rax + 0x20], 0x64
inc ecx
add rbx, r8
movsxd rax, ecx
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [rcx + 1]
xor ecx, ecx
cmp byte [rbx], 0x23
cdqe
mov dword [rsp + 0x70], ecx
mov word [rsp + rax + 0x20], 0x6c
jne 0x18000df2d
inc rbx
mov al, byte [rbx]
test al, al
je 0x18000df28
lea ecx, [rcx + rcx*4]
movsx eax, al
inc rbx
lea ecx, [rcx - 0x18]
lea ecx, [rax + rcx*2]
mov al, byte [rbx]
test al, al
jne 0x18000df0f
mov dword [rsp + 0x70], ecx
lea rbx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [0x180020f48]
mov rdx, rbx
mov rcx, rax
call qword [0x180020f40]
jmp 0x18000de66
mov rax, r8
jmp 0x18000de66

Function at 0x18000df54
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword gs:[0x60]
mov ebp, ecx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x18000dfee
mov r15d, 0x3f
xor r14d, r14d
cmp word [rbx + 0x58], r15w
jae 0x18000dfe6
mov r8, qword [rbx + 0x60]
mov esi, r14d
mov rcx, r14
cmp word [r8], r14w
je 0x18000dfc7
movsxd rax, esi
cmp rax, r15
jae 0x18000dfc7
mov al, byte [r8 + rcx*2]
inc rcx
inc esi
mov byte [rsp + rcx + 0x1f], al
mov r8, qword [rbx + 0x60]
cmp word [r8 + rcx*2], r14w
jne 0x18000dfa7
mov byte [rsp + rcx + 0x20], r14b
lea rcx, [rsp + 0x20]
call fcn.18000dcd0
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.18000d31c
cmp ebp, eax
je 0x18000e00a
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x18000df90
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rax, qword [rbx + 0x30]
jmp 0x18000dff0
Function at 0x18000eb44
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
and dword [0x180023138], 0
mov edx, 0xd26f2a4
xor ecx, ecx
call fcn.18000e0e4
call rax
lea rcx, [0x18001f7e0]
xor dword [rcx], eax
lea rdx, [0x18001f824]
add rcx, 4
cmp rcx, rdx
jl 0x18000eb64
add rsp, 0x28
ret

Function at 0x180010900
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
call fcn.18000d560
movsxd r14, eax
mov rcx, r14
call fcn.18000c824
cmp byte [rdi], 0
mov rcx, rbp
mov rsi, rax
je 0x18001095c
mov rdx, rax
sub rdx, rdi
mov al, byte [rdi]
xor al, byte [rcx]
inc rcx
mov byte [rdx + rdi], al
inc rdi
cmp byte [rcx], 0
cmove rcx, rbp
cmp byte [rdi], 0
jne 0x180010943
mov r8, rbx
mov edx, r14d
mov rcx, rsi
call fcn.1800109bc
mov rcx, rsi
call fcn.18000ca8c
movsxd rdx, dword [rbx + 8]
mov rax, rdx
test edx, edx
jle 0x180010991
mov rcx, qword [rbx]
cmp byte [rcx + rax - 1], 0x3d
jne 0x180010991
dec rax
dec edx
test rax, rax
jg 0x180010980
mov rcx, rbx
call fcn.18000d894
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x18001321c
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rbp, dword [rcx + 0x3c]
mov r13d, edx
xor edx, edx
add rbp, rcx
mov r12, rcx
mov r15d, edx
movzx eax, word [rbp + 0x14]
cmp dx, word [rbp + 6]
jae 0x180013341
lea r14, [rbp + 0x3c]
add r14, rax
mov ecx, dword [r14 - 0x14]
test r13d, r13d
jne 0x1800132fe
mov eax, dword [r14]
lea esi, [r13 + 1]
and eax, 0xe0000000
cmp eax, 0x20000000
je 0x1800132d2
cmp eax, 0x40000000
je 0x1800132cb
cmp eax, 0x60000000
je 0x1800132c4
cmp eax, 0x80000000
je 0x1800132bd
cmp eax, 0xa0000000
je 0x1800132b6
cmp eax, 0xc0000000
je 0x1800132af
cmp eax, 0xe0000000
jne 0x1800132d7
lea esi, [r13 + 0x40]
jmp 0x1800132d7
mov esi, 4
jmp 0x1800132d7
mov esi, 0x80
jmp 0x1800132d7
mov esi, 8
jmp 0x1800132d7
mov esi, 0x20
jmp 0x1800132d7
mov esi, 2
jmp 0x1800132d7
mov esi, 0x10
test dword [r14], 0x4000000
je 0x1800132e4
bts esi, 9
test ecx, ecx
jne 0x180013305
test byte [r14], 0x40
je 0x1800132f3
mov ecx, dword [rbp + 0x20]
jmp 0x180013301
test byte [r14], 0x80
je 0x18001332d
mov ecx, dword [rbp + 0x24]
jmp 0x180013301
mov esi, r13d
test ecx, ecx
je 0x18001332d
mov edi, dword [r14 - 0x18]
mov ebx, dword [r14 - 0x1c]
mov edx, 0x72d1864
xor ecx, ecx
add rdi, r12
call fcn.18000e0e4
lea r9, [rsp + 0x50]
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call rax
xor edx, edx
movzx eax, word [rbp + 6]
inc r15d
add r14, 0x28
cmp r15d, eax
jl 0x18001325f
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180014e48
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movsxd rbx, dword [rcx + 0x3c]
mov rbp, rcx
mov r14, r9
mov ecx, dword [rbx + rcx + 0x50]
mov r15, r8
mov rdi, rdx
mov qword [rdx], rcx
add rcx, 0x100
call fcn.18000c824
mov r8d, dword [rdi]
mov rdx, rbp
mov rcx, rax
mov rsi, rax
call fcn.18000ca1c
mov ecx, dword [rbx + rbp + 0xb0]
mov r9d, dword [rbx + rbp + 0xb4]
mov r8, r15
add rcx, rbp
mov rdx, rsi
sub r8, rbp
call fcn.18001382c
lea rcx, [rsp + 0x50]
mov edx, 4
call fcn.18000eb00
xor r8d, r8d
test qword [rdi], 0xfffffffffffffffc
jbe 0x180014eee
mov rdx, rsi
mov eax, dword [rsp + 0x50]
inc r8d
xor dword [rdx], eax
mov rcx, qword [rdi]
movsxd rax, r8d
shr rcx, 2
lea rdx, [rdx + 4]
cmp rax, rcx
jb 0x180014ed2
mov rax, r15
mov rdx, r15
sub rax, rbp
add qword [r14], rax
mov rcx, qword [rdi]
mov eax, dword [rsp + 0x50]
mov r9, qword [r14]
mov r8d, dword [rdi]
add rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.180014ccc
mov rdx, qword [rdi]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rdx, r15
cdqe
mov qword [r14], rdx
add qword [rdi], rax
mov rax, rsi
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1800152fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, [0x18001f460]
mov r8d, 0xc8
mov rdi, rcx
call fcn.18000c9bc
xor r9d, r9d
mov r8d, r9d
mov ecx, r9d
mov rdx, qword [rdi]
mov al, byte [rdx + r8]
inc r8
xor byte [rdx + rcx + 2], al
cmp r8, 2
cmove r8, r9
inc rcx
cmp rcx, 0xc6
jl 0x180015324
mov edx, dword [rdi + 8]
mov rax, qword [rdi]
mov rcx, rdi
movzx ebx, byte [rax + 2]
lea r8d, [rdx - 3]
sub edx, r8d
call fcn.18000ce04
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18000cde4
Function at 0x18001aa3c
Capabilities:
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
xor eax, eax
xor r15d, r15d
mov ebx, r8d
mov rsi, rcx
mov rdi, rdx
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rax
lea r8d, [rax + 0x68]
lea rcx, [rbp - 0x29]
xor edx, edx
mov dword [rbp - 0x61], 0x18
mov dword [rbp - 0x51], 1
mov qword [rbp - 0x59], r15
mov qword [rbp + 0x7f], r15
mov qword [rbp - 0x69], r15
call fcn.18000cdc4
xor ecx, ecx
mov qword [rbp - 0x49], rcx
mov qword [rbp - 0x41], rcx
mov qword [rbp - 0x39], rcx
lea rcx, [rbp + 0x7f]
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x69]
xor r9d, r9d
mov dword [rbp - 0x29], 0x68
mov dword [rbp + 0x13], 1
mov word [rbp + 0x17], r15w
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x18001aadc
lea eax, [r15 + 1]
jmp 0x18001ab68
mov rax, qword [rbp - 0x69]
bts dword [rbp + 0x13], 8
xor r9d, r9d
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x2f], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18001ab52
mov rdx, qword [rbp + 0x7f]
mov rcx, qword [rbp - 0x49]
mov r9d, ebx
mov r8, rdi
call fcn.18001ab80
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x18001ab80
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r13
push r14
sub rsp, 0x440
mov rdi, rdx
lea rax, [rsp + 0x30]
mov ebp, r9d
mov r14, r8
mov rsi, rcx
xor ebx, ebx
and qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov rcx, rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18001ac84
mov r13d, 0x400
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x18001ac29
movsxd rax, ecx
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x40]
cmp rax, r13
cmova ecx, r13d
and qword [rsp + 0x20], 0
mov r8d, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9d, dword [rsp + 0x34]
lea r8, [rsp + 0x40]
mov edx, ebp
mov rcx, r14
call fcn.180018964
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x34]
mov dword [rsp + 0x30], ecx
jne 0x18001abdf
jmp 0x18001ac5b
test ebx, ebx
jne 0x18001ac47
lea edx, [rbx + 0x64]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x18001ac5b
mov ebx, 0xa
jmp 0x18001ac5b
mov eax, ebx
dec ebx
cmp eax, 1
je 0x18001ac84
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x18001abd7
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x14005cbd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.140061540
sub rsp, rax
mov rax, qword [0x14009b2e8]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x14005cc92
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14005cc3d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14005cc30
cmp rcx, 1
jb 0x14005ccea
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14005cc60
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14006db64
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14005cc20
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14005ccc3
lea rcx, [rsp + 0x80]
call fcn.140070498
jmp 0x14005ccc5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400615a0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400636c8
int3
Function at 0x140060b20
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14009b2e8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x140060bc5
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x140060b7d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140060b70
cmp rcx, 1
jb 0x140060bf6
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140060b93
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14006db64
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140060b60
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400615a0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.1400636c8
int3
Function at 0x140060ca0
Capabilities:
Set environment variable

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0xb0
mov rax, qword [0x14009b2e8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x14009ede0]
mov rbp, r8
mov rsi, rdx
mov r14, rcx
test rax, rax
jne 0x140060cf0
lea rcx, [0x14007ccc4]
call qword [sym.imp.python310.dll_PyImport_ImportModule]
mov qword [0x14009ede0], rax
test rax, rax
je 0x140060f2a
mov qword [rsp + 0xa8], rbx
lea rdx, str.environ
mov qword [rsp + 0xa0], rdi
mov rcx, rax
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x90], r15
call qword [sym.imp.python310.dll_PyObject_GetAttrString]
mov rcx, rsi
mov r15, rax
call qword [sym.imp.python310.dll_PyUnicode_FromString]
movzx edx, byte [rsi]
lea rbx, [rsp + 0x30]
xor ecx, ecx
mov r13, rax
mov word [rsp + 0x30], cx
lea edi, [rcx + 0x28]
test rbp, rbp
je 0x140060e26
test dl, dl
je 0x140060dc2
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x140060d6d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140060d60
cmp rcx, 1
jb 0x140060f30
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140060d90
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14006db64
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140060d50
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, rbp
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov rdx, r13
mov rcx, r15
mov r8, rax
mov rbx, rax
call qword [sym.imp.python310.dll_PyObject_SetItem]
test eax, eax
je 0x140060e0d
mov ecx, 1
call qword [sym.imp.python310.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python310.dll_Py_Exit]
int3
sub qword [rbx], 1
jne 0x140060ec7
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x140060ec7
test dl, dl
je 0x140060ea2
nop word [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x140060e4d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140060e40
cmp rcx, 1
jb 0x140060f24
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140060e70
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14006db64
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140060e30
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.python310.dll_PyObject_DelItem]
test eax, eax
je 0x140060ec7
mov rcx, r14
call fcn.140001fc0
sub qword [r13], 1
jne 0x140060ed8
mov rax, qword [r13 + 8]
mov rcx, r13
call qword [rax + 0x30]
sub qword [r15], 1
jne 0x140060ee8
mov rax, qword [r15 + 8]
mov rcx, r15
call qword [rax + 0x30]
mov r13, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400615a0
add rsp, 0xb0
pop r14
pop rsi
pop rbp
ret
call fcn.1400636c8
int3
call fcn.1400636c8
int3
call fcn.1400636c8
int3
Function at 0x140064ce0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140064b6b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140064b6b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140064b6b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140064b6b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140064b6b
cmp dword [rcx + 0x84], 0xe
jbe 0x140064b6b
cmp dword [rcx + 0xf8], 0
je 0x140064b6b
mov ecx, ebx
call fcn.140064c0c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400649e8
cmp dword [rbp + 0x20], 0
je 0x140064bb8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140064bc0
int3
xor r8d, r8d
xor edx, edx
jmp 0x140064b04
Function at 0x1402afd2e
Capabilities:
Encode data using xor

Disassembly:
invalid
push 0xffffffffc507b2fb
call fcn.14036b61e
rcl dword [rdi + rdi*2], 0x29
push rdx
xor dword [rcx + riz*8 + 0x7a916c48], esp
and cl, byte [rsi + 0x44]
xor ecx, dword [rax + 0x217a10ea]
jge 0x1402afd92
jno 0x1402afcd6
pop rdi
or byte [rdi + 0x10], dh
invalid
pop rsp
in eax, dx
xchg r11d, eax
lodsd eax, dword [rsi]
invalid
jne 0x1402afd84
invalid
Function at 0x14105e1b8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14105e33f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14105e1e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14105e1cf
add dl, dl
jne 0x14105e1f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14105e256
xor eax, eax
add dl, dl
jne 0x14105e205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14105e30d
add dl, dl
jne 0x14105e216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14105e223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14105e230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14105e23d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14105e24a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14105e1de
mov eax, 1
add dl, dl
jne 0x14105e266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14105e273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14105e25b
sub eax, ebx
mov ebx, 1
jne 0x14105e2ac
mov ecx, 1
add dl, dl
jne 0x14105e28e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14105e29b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14105e283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14105e1de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14105e2c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14105e2d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14105e2bd
cmp eax, 0x7d00
jae 0x14105e2fb
cmp eax, 0x500
jb 0x14105e2f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14105e1de
cmp eax, 0x7f
ja 0x14105e2fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14105e1de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14105e332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14105e1de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18000ac75
Capabilities:
Create thread

Disassembly:
push rax
pushf
mov eax, 0x9a482e9d
pushf
not eax
add eax, 0xa80a1d28
xor eax, 0x913646d6
rol eax, 0xc4
popf
pushf
not eax
add eax, 0x87c1bae4
xor eax, 0xda38b79b
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xece97e8d
xor eax, 0xd8de6a90
rol eax, 0xbf
popf
cmp eax, 2
jne 0x18000acc5
popf
pop rax
jmp 0x18000add3
cmp eax, 0
jne 0x18000acd4
popf
pop rax
jmp 0x18000ace3
cmp eax, 1
jne 0x18000ace3
popf
pop rax
jmp 0x18000ad9e
sub rsp, 0x38
cmp edx, 1
jne 0x18000ad45
push rax
pushf
mov eax, 0x9ec1fb47
pushf
not eax
add eax, 0x9b59cb44
xor eax, 0xb5215c3c
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xb2ff4f1b
xor eax, 0xfa447723
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xa3a84789
xor eax, 0xf0c43688
rol eax, 0xba
popf
pushf
not eax
add eax, 0xc45a8b55
xor eax, 0xac990954
rol eax, 2
popf
jmp 0x18000acb6
push rax
pushf
mov eax, 0x48f306c4
pushf
not eax
add eax, 0xa6b4da8d
xor eax, 0xab70152c
rol eax, 0x46
popf
pushf
not eax
add eax, 0x9539432e
xor eax, 0xed4d51e0
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xa07d3ed4
xor eax, 0xa50f48a5
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xe819b228
xor eax, 0xd4cbcb10
rol eax, 0x74
popf
jmp 0x18000acb6
xor eax, eax
lea r8, [0x1e5151a80]
pushf
sub r8, 0x65150a80
popf
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
jmp 0x18000adc3
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
jmp 0x18000adcd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x56868e28
pushf
not eax
add eax, 0xf6f9f5f2
xor eax, 0xab57c4d5
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xb5afcf16
xor eax, 0xdce7969e
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xeb4fbce6
xor eax, 0xba34a8ef
rol eax, 0xe9
popf
add rsp, 0x38
ret
Function at 0x18000190c
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x18010f610]
syscall
ret

Function at 0x180001918
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x18010f614]
syscall
ret

Function at 0x1800019b1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1082
syscall
ret

Function at 0x1800019c7
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1044
syscall
ret