joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d779e
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
shr ebx, 0xec
movsx bx, ah
jmp 0x1404d77b4
push rdi
sub rsp, 0x20
bsr bx, r9w
xor esi, esi
mov rdi, rdx
mov rbx, rcx
test cx, r15w
test rcx, rcx
jmp 0x1404d77d2
je 0x1404d7885
cmp word [rcx], si
jmp 0x1404d77e0
je 0x1404d7885
lea rdx, [0x1400d1d08]
jmp 0x1404d77f2
call fcn.140262904
test eax, eax
jmp 0x1404d77fe
je 0x1404d7885
lea rdx, [0x1400d1d00]
movzx cx, spl
setb ch
mov rcx, rbx
call fcn.140262904
test eax, eax
jmp 0x1404d7822
jne 0x1404d7873
mov ecx, dword [rdi + 8]
setl r9b
not dx
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x23e740dd
movsx edx, r12w
cmovb dx, ax
mov edx, 0x2000000b
jmp 0x1404d7852
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d785f
je 0x1404d78bd
mov eax, dword [rsp + 0x30]
jmp 0x1404d786e
jmp 0x1404d78e0
mov rcx, rbx
jmp 0x1404d787b
call fcn.1404e0762
jmp 0x1404d78e0
mov ecx, dword [rdi + 8]
cwd
movzx r9w, cl
lea r8, [rsp + 0x30]
mov r9d, 2
cdq
movsx dx, r12b
mov edx, 0x20001004
jmp 0x1404d78aa
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x1404d78b7
jne 0x1404d78c9
sub eax, eax
jmp 0x1404d78c4
jmp 0x1404d78e0
mov eax, dword [rsp + 0x30]
test eax, eax
jmp 0x1404d78d4
jne 0x1404d78e0
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
clc
ror dil, cl
sbb sil, r9b
mov rsi, qword [rsp + 0x40]
shr edi, cl
add rsp, 0x20
jmp 0x1404d7900
pop rdi
jmp 0x1404d7906
ret

Function at 0x1404d7907
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
rcr bh, 0x2d
cmp bpl, 0xac
mov qword [rsp + 0x18], rsi
add sil, dl
xchg sil, bl
push rdi
rol bh, cl
btr si, 0xb7
sub rsp, 0x20
mov si, r13w
bswap rsi
movzx bx, r12b
mov esi, edx
movzx ebx, dx
mov ebx, ecx
jmp 0x1404d7942
call fcn.1404c9973
mov ecx, ebx
lea r8, [rsp + 0x30]
bsf r9d, r9d
mov dil, 0xe8
and ecx, 0x3ff
xchg edx, edi
mov dil, r11b
cmovns r9w, r12w
mov r9d, 2
bt di, 0xb7
bts ecx, 0xa
mov edx, 0x20000001
cmovae di, sp
movsx di, dl
mov di, 0x13fa
mov rdi, rax
jmp 0x1404d798d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub r10d, r10d
test eax, eax
jmp 0x1404d799d
je 0x1404d7a61
cmp ebx, dword [rsp + 0x30]
jmp 0x1404d79ac
je 0x1404d7a57
test esi, esi
jmp 0x1404d79b9
je 0x1404d7a57
mov r9, qword [rdi + 0x98]
mov r8d, r10d
ror dx, 0x82
or cl, r13b
rcr ah, 0x28
movzx edx, word [r9]
shl ax, 0x28
btr rcx, rsp
rol cl, 0x48
lea rcx, [r9 + 2]
cmc
lahf
stc
lea eax, [rdx - 0x41]
stc
cmp ax, 0x19
jmp 0x1404d79f6
jbe 0x1404d7a0f
sub dx, 0x61
cmp dx, 0x19
jmp 0x1404d7a09
ja 0x1404d7a2d
movzx edx, word [rcx]
inc r8d
cmp esi, 0x104c7cfa
clc
cmp dx, sp
add rcx, 2
jmp 0x1404d7a28
jmp 0x1404d79e9
or rcx, 0xffffffffffffffff
jmp 0x1404d7a36
inc rcx
cmp word [r9 + rcx*2], r10w
jmp 0x1404d7a43
jne 0x1404d7a36
cmp r8d, ecx
jmp 0x1404d7a51
je 0x1404d7a61
mov eax, 1
jmp 0x1404d7a66
xor eax, eax
not sil
mov rbx, qword [rsp + 0x38]
or edi, 0x5c92451e
bt esi, r13d
mov rsi, qword [rsp + 0x40]
jmp 0x1404d7a86
add rsp, 0x20
setae dil
pop rdi
ret
Function at 0x1404d910a
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
stc
test rdx, rsp
mov qword [rax + 8], rbx
cmp edx, eax
jmp 0x1404d9126
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
stc
push r14
sub rsp, 0x40
jmp 0x1404d913e
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
bsf ebx, esp
cmp spl, dl
mov rbx, rax
test r8b, 0x77
test rax, rax
jmp 0x1404d915c
je 0x1404d92d7
mov rsi, rax
jmp 0x1404d916a
cmp word [rax], r14w
jmp 0x1404d9173
je 0x1404d91b0
or rax, 0xffffffffffffffff
jmp 0x1404d9182
inc rax
cmc
test r14d, r10d
cmp r9, rbx
cmp word [rsi + rax*2], r14w
jne 0x1404d9182
lea rsi, [rsi + rax*2]
stc
add rsi, 2
clc
cmp word [rsi], r14w
jmp 0x1404d91aa
jne 0x1404d9179
mov qword [rsp + 0x38], r14
btr r8w, di
shr r8w, 0x7e
sal r9b, cl
sub rsi, rbx
rcl r8w, cl
movzx r8d, ax
mov qword [rsp + 0x30], r14
movzx r8w, al
ror r8b, cl
add rsi, 2
bsr r8, rbx
sar rsi, 1
btr r9w, 0x7a
rcl r8, 0x24
mov r8, rbx
xadd r9b, r9b
jmp 0x1404d91fb
mov r9d, esi
cmc
mov dword [rsp + 0x28], r14d
sub edx, edx
cmc
test ch, 0xea
test ax, sp
mov qword [rsp + 0x20], r14
stc
cmc
cmp rsp, 0x69c8038b
xor ecx, ecx
jmp 0x1404d9222
call fcn.1404c9779
movsxd rbp, eax
test eax, eax
jmp 0x1404d9231
je 0x1404d92d7
mov rcx, rbp
jmp 0x1404d923f
call fcn.1404c96bb
mov rdi, rax
test rax, rax
je 0x1404d92b8
mov qword [rsp + 0x38], r14
movsx r9w, r15b
mov r9d, esi
xor r8, 0x71845c79
mov qword [rsp + 0x30], r14
shr r8, cl
mov r8, rbx
test r8b, 0x52
cmc
cmp r11w, 0x7a96
mov dword [rsp + 0x28], ebp
test al, 0x1e
xor edx, edx
cmp sp, 0x7b18
test rsi, r14
sub ecx, ecx
jmp 0x1404d9291
mov qword [rsp + 0x20], rax
jmp 0x1404d929b
call fcn.1404c9779
test eax, eax
jmp 0x1404d92a7
je 0x1404d92b8
mov rsi, rdi
mov rdi, r14
jmp 0x1404d92c5
mov rsi, r14
not cx
movzx ecx, di
movzx rcx, r8w
mov rcx, rdi
jmp 0x1404d92cd
call fcn.1404c963e
jmp 0x1404d92e2
mov rsi, r14
test ch, 0x63
jmp 0x1404d92e2
test rbx, rbx
jmp 0x1404d92ea
je 0x1404d92fe
mov rcx, rbx
jmp 0x1404d92f8
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
lahf
rcl bpl, cl
mov rax, rsi
not sil
clc
xor di, r9w
mov rsi, qword [rsp + 0x60]
btc bp, 3
movsx r14w, r13b
cmovno bp, r10w
mov rbp, qword [rsp + 0x58]
bt di, ax
sbb r14b, r8b
mov rdi, qword [rsp + 0x68]
mov r14d, esi
mov r14b, 0xa3
add rsp, 0x40
setle r14b
xchg r14b, r14b
pop r14
jmp 0x1404d934f
ret
Function at 0x1404d9350
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
cmp al, 0x6d
clc
mov qword [rsp + 0x10], rbp
cmp r11w, r15w
test dx, 0x7f30
mov qword [rsp + 0x18], rsi
test r9b, 0x14
cmp r11b, spl
clc
push rdi
clc
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jmp 0x1404d938c
je 0x1404d9464
mov rbp, rax
cmc
cmp word [rax], si
je 0x1404d93d3
or rax, 0xffffffffffffffff
inc rax
test dil, 0x6e
test r11, r14
cmp word [rbp + rax*2], si
jmp 0x1404d93b7
jne 0x1404d93a3
lea rbp, [rbp + rax*2]
test sil, r13b
add rbp, 2
cmp word [rbp], si
jne 0x1404d939f
sub rbp, rbx
shl ecx, cl
add rbp, 2
xadd cl, cl
rcr cx, 0x49
sar rbp, 1
shld cx, r8w, 0xa7
rol ch, 0x72
add rbp, rbp
seta ch
mov rcx, rbp
jmp 0x1404d93fd
call fcn.1404c96bb
mov rdi, rax
test r9w, 0xbc8
cmp r14d, 0x633f41de
test rax, rax
jmp 0x1404d941a
je 0x1404d944a
mov r8, rbp
setle dh
mov dx, 0x259d
mov rdx, rbx
movsx rcx, bx
mov rcx, rax
jmp 0x1404d9439
call fcn.1404a3857
mov rsi, rdi
test dil, 0x2b
cmp r13b, 0xa9
cmc
sub ecx, ecx
jmp 0x1404d9451
call fcn.1404c963e
mov rcx, rbx
jmp 0x1404d945e
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
cwde
adc al, r10b
sal bpl, 0xb3
mov rax, rsi
cmc
bsf di, cx
cmp r9b, r13b
mov rsi, qword [rsp + 0x40]
bsr ebp, r11d
mov rbp, qword [rsp + 0x38]
movzx edi, bp
add rsp, 0x20
mov dil, r10b
pop rdi
jmp 0x1404d949a
ret
Function at 0x1404dc28c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsxd rax, esi
mov qword [rsp + 0x18], rbp
push rsi
xchg al, al
setg ah
movzx ax, r12b
push rdi
movzx eax, r10w
push r14
cbw
movzx ax, r9b
mov eax, 0x1450
jmp 0x1404dc2bc
call fcn.140448aad
sub rsp, rax
or al, dil
mov rax, qword [0x1400b7288]
bsf edi, r15d
bt rbp, 0x9c
xor rax, rsp
ror r14b, cl
xor sil, 0xf3
mov qword [rsp + 0x1440], rax
shl ebp, 0x81
and r10w, 0x3863
movsxd r10, edx
movsx rdx, r8w
bswap si
mov rdi, rcx
movsx esi, r14w
test r9b, 0x56
xadd cl, r14b
mov rax, r10
bt edx, 0x77
shld rbp, rdi, 0xb2
sal edx, 0x2d
mov ebp, r9d
shl cx, 0xfb
bts ecx, r11d
sar rax, 6
sar cx, 0x15
rcr si, cl
lea rcx, [0x1400ba940]
not dx
and r10d, 0x3f
cmp si, 0x16e0
rol rdx, cl
add rbp, r8
mov rsi, r8
mov rax, qword [rcx + rax*8]
mov r14d, r13d
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
jmp 0x1404dc365
mov qword [rdi], rax
cmc
mov dword [rdi + 8], eax
clc
cmp r8, rbp
jmp 0x1404dc375
jae 0x1404dc47d
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404dc388
jae 0x1404dc3eb
mov al, byte [rsi]
jmp 0x1404dc395
inc rsi
test dil, 6
cmp al, 0xa
jmp 0x1404dc3a3
jne 0x1404dc3bc
inc dword [rdi + 8]
jmp 0x1404dc3b1
mov byte [rbx], 0xd
jmp 0x1404dc3b9
inc rbx
mov byte [rbx], al
inc rbx
jmp 0x1404dc3cc
lea rax, [rsp + 0x143f]
cmp r12b, 0x79
jmp 0x1404dc3dd
cmp rbx, rax
jmp 0x1404dc3e5
jb 0x1404dc380
and qword [rsp + 0x20], 0
rdtsc
lea rax, [rsp + 0x40]
sub ebx, eax
movsx rcx, r8w
not dh
lea r9, [rsp + 0x30]
cmovne cx, r15w
bswap r8d
jmp 0x1404dc412
mov r8d, ebx
mov rdx, r10
cwd
movzx rcx, r9w
lea rdx, [rsp + 0x40]
mov rcx, 0x150303a3
bswap ecx
mov rcx, r14
jmp 0x1404dc434
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404dc46a
mov eax, dword [rsp + 0x30]
clc
test ebp, ebp
add dword [rdi + 4], eax
cmp dil, dil
cmp eax, ebx
jb 0x1404dc47d
cmp rsi, rbp
jmp 0x1404dc45f
jb 0x1404dc37b
jmp 0x1404dc47d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bsr ax, dx
rol ax, 0xb9
cmp r8b, spl
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404dc490
call fcn.14049fbde
lea r11, [rsp + 0x1450]
movsxd rbp, edx
not sil
mov rbx, qword [r11 + 0x20]
xchg dil, bpl
mov rbp, qword [r11 + 0x30]
xchg rsi, r14
movzx di, r13b
mov rsp, r11
not esi
mov r14b, 0x1e
pop r14
setg sil
pop rdi
cmovp esi, esi
pop rsi
ret
Function at 0x1404dc4ca
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
cbw
movzx rax, r9w
mov ax, r13w
push rsi
movsx ax, sil
mov eax, 0xb9d668b
cdqe
push rdi
cwde
movsxd rax, r13d
push r14
movsx ax, bpl
mov eax, 0x1450
jmp 0x1404dc501
call fcn.140448aad
sub rsp, rax
ror bpl, cl
movzx r10w, r11b
mov rax, qword [0x1400b7288]
adc dil, sil
add r14b, bl
btc r14w, r15w
xor rax, rsp
shr dil, cl
stc
bsr ebp, edx
mov qword [rsp + 0x1440], rax
movzx r10, r13w
xadd ax, bp
movsxd r10, edx
mov rdi, rcx
btc ax, 0xbb
ror si, cl
cmp rax, rdx
mov rax, r10
mov ebp, r9d
bts r14d, r12d
sar rax, 6
movsx rcx, r15w
xor cx, si
lea rcx, [0x1400ba940]
jmp 0x1404dc571
and r10d, 0x3f
movzx dx, sil
lea rbp, [rbp + r8]
dec esi
mov rsi, r8
rol r14, cl
mov rax, qword [rcx + rax*8]
btc r14d, r10d
cmp r14w, 0x3d22
lea rdx, [r10 + r10*8]
rcr r14b, cl
mov r14, qword [rax + rdx*8 + 0x28]
cmp spl, spl
test r12w, ax
sub eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404dc5b8
jae 0x1404dc6c1
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404dc5cb
jae 0x1404dc626
movzx eax, word [rsi]
add rsi, 2
clc
cmp ax, 0xa
jmp 0x1404dc5e2
jne 0x1404dc5fe
add dword [rdi + 8], 2
mov ecx, 0xd
cmc
clc
test edi, r11d
mov word [rbx], cx
add rbx, 2
clc
mov word [rbx], ax
cmc
sal ah, 0xa0
add rbx, 2
cwde
bswap ax
sal ah, 0x8d
lea rax, [rsp + 0x143e]
cmp rbx, rax
jmp 0x1404dc620
jb 0x1404dc5c3
and qword [rsp + 0x20], 0
and al, r10b
test r11w, 0x6bbb
lea rax, [rsp + 0x40]
xchg ecx, r9d
sub rbx, rax
cwd
xor r9b, 0xf7
lea r9, [rsp + 0x30]
sar cl, cl
clc
rcr dx, 0x4a
sar rbx, 1
shl dl, 0x3c
lea rdx, [rsp + 0x40]
add ebx, ebx
movsx rcx, si
mov rcx, r14
bswap r8d
mov r8d, ebx
jmp 0x1404dc671
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dc67e
je 0x1404dc6af
mov eax, dword [rsp + 0x30]
clc
test ah, 0xba
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404dc696
jb 0x1404dc6c1
cmp rsi, rbp
jmp 0x1404dc6a4
jb 0x1404dc5be
jmp 0x1404dc6c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
bt eax, r11d
mov cx, 0x3d56
sar al, cl
mov rax, rdi
bsr cx, r8w
cmc
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404dc6da
call fcn.14049fbde
lea r11, [rsp + 0x1450]
movzx rbx, r13w
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movsxd rsi, r11d
movzx si, spl
mov rsp, r11
movzx rsi, bx
movsx rsi, r12w
movzx r14d, cx
pop r14
jmp 0x1404dc714
pop rdi
xchg si, si
setno sil
pop rsi
jmp 0x1404dc722
ret
Function at 0x1404e00e7
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
movsx r9d, r11w
push rdi
bsr ebx, esi
sal bx, cl
sub rsp, 0x20
mov bl, 0x5f
mov rbx, rdx
cmovle r9w, r10w
mov dil, dil
seto dil
lea r9, [0x1400c8ea8]
bswap r8
movsxd rdx, ebp
mov dh, 0x5f
mov edi, ecx
bswap dx
mov r8w, 0x4e26
lea rdx, [0x1400cf748]
movsx rcx, r8w
mov ecx, 3
lea r8, [0x1400c8ea0]
jmp 0x1404e0142
call fcn.1404e0267
mov rdx, rbx
test r9w, r14w
btc rcx, 0xed
mov ecx, edi
clc
test rax, rax
jmp 0x1404e015e
je 0x1404e016f
call qword [0x1400b8d90]
jmp 0x1404e0175
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movzx edi, r11w
clc
add rsp, 0x20
bswap di
pop rdi
jmp 0x1404e018c
ret

Function at 0x1404e170d
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
stc
test rcx, rcx
jmp 0x1404e171a
jne 0x1404e173f
and qword [r8], 0
movsx ax, spl
seta ah
movsx eax, r8w
mov eax, 1
jmp 0x1404e173a
jmp 0x1404e186d
test edx, edx
jmp 0x1404e1746
jne 0x1404e1758
mov byte [rcx], dl
jmp 0x1404e1753
jmp 0x1404e1720
test edx, 0xffffff80
jmp 0x1404e1763
jne 0x1404e1770
mov byte [rcx], dl
jmp 0x1404e1730
test edx, 0xfffff800
jmp 0x1404e177b
jne 0x1404e1794
mov r9d, 1
mov r10b, 0xc0
jmp 0x1404e178f
jmp 0x1404e17fe
test edx, 0xffff0000
jne 0x1404e17c8
lea eax, [rdx - 0xd800]
cmc
cmp eax, 0x7ff
jmp 0x1404e17b1
jbe 0x1404e1851
mov r9d, 2
mov r10b, 0x3d
mov r10b, 0xe0
jmp 0x1404e17fe
test edx, 0xffe00000
jmp 0x1404e17d3
jne 0x1404e1851
cmp edx, 0x10ffff
jmp 0x1404e17e4
ja 0x1404e1851
mov r9d, 3
bsr r11w, r10w
mov r10b, 0xf0
dec al
shl al, cl
shr al, cl
mov r11, r9
mov al, dl
cmc
test r12w, 0x26da
shr edx, 6
stc
and al, 0x3f
jmp 0x1404e1815
or al, 0x80
mov byte [r11 + rcx], al
sub r11, 1
jmp 0x1404e1824
jne 0x1404e1801
or dl, r10b
sal al, cl
bsr eax, r14d
bt eax, r8d
lea rax, [r9 + 1]
stc
mov byte [rcx], dl
stc
jmp 0x1404e1844
and qword [r8], r11
jmp 0x1404e184c
jmp 0x1404e186d
and qword [r8], 0
jmp 0x1404e185a
call fcn.1404b575b
mov dword [rax], 0x2a
or rax, 0xffffffffffffffff
clc
cmp spl, r12b
add rsp, 0x28
jmp 0x1404e1876
ret
Function at 0x1404e6d80
Capabilities:
Encode data using base64

Disassembly:
jmp fcn.1404e170d
push rbx
and al, bh
shrd ax, di, 0x1d
sub rsp, 0x20
adc r9w, r8w
test r8, r8
mov r9b, dil
mov bh, 0x88
movsxd rbx, r15d
movzx r9d, dx
lea rbx, [0x1400bae30]
mov edx, 0x2400
mov al, 0x4c
not ax
cmovne rbx, r8
shl ah, cl
stc
or al, r9b
mov eax, 0x3ff
add edx, r9d
cmp dword [rbx], 0
jmp 0x1404e6dcc
jne 0x1404e6e77
cmp dx, ax
jmp 0x1404e6dda
ja 0x1404e6e02
and qword [rbx], 0
jmp 0x1404e6de9
call fcn.1404b575b
mov dword [rax], 0x2a
or rax, 0xffffffffffffffff
jmp 0x1404e6dfd
jmp 0x1404e6ec9
mov r8d, 0x2800
dec dx
movsx rdx, di
mov edx, r9d
stc
cmp dx, 0x721c
add r9w, r8w
test r14b, r9b
cmp r9w, ax
jmp 0x1404e6e28
ja 0x1404e6e58
shl edx, 0xa
jmp 0x1404e6e36
and edx, 0xfc9ffc00
test r15, 0x1de95ce8
add edx, 0x10000
cmc
mov dword [rbx], edx
sub eax, eax
jmp 0x1404e6e53
jmp 0x1404e6ec9
mov r8, rbx
cmp r14b, dil
inc ebx
add rsp, 0x20
movsx rbx, r13w
movzx ebx, r13w
pop rbx
jmp 0x1404e6e72
jmp 0x1400ec79a
cmp dx, ax
jmp 0x1404e6e7f
ja 0x1404e6de0
and qword [rsp + 0x40], 0
movsxd rdx, esi
movzx r8d, di
lea r8, [rsp + 0x40]
and dx, 0x6081
movzx edx, r10w
mov edx, r9d
test r12b, bpl
clc
stc
and edx, 0xffff23ff
add edx, dword [rbx]
jmp 0x1404e6eb5
call 0x1400ec79a
and qword [rbx], 0
movsx rbx, r10w
xadd bx, bx
cmp rdi, r15
add rsp, 0x20
bswap bx
xchg rbx, rbx
pop rbx
ret
Function at 0x1416d8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1416d81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1416d8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416d806f
add dl, dl
jne 0x1416d8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416d80f6
xor eax, eax
add dl, dl
jne 0x1416d80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416d81ad
add dl, dl
jne 0x1416d80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416d80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416d80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416d80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1416d80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1416d807e
mov eax, 1
add dl, dl
jne 0x1416d8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416d8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416d80fb
sub eax, ebx
mov ebx, 1
jne 0x1416d814c
mov ecx, 1
add dl, dl
jne 0x1416d812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1416d813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416d8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416d807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1416d8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1416d8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416d815d
cmp eax, 0x7d00
jae 0x1416d819b
cmp eax, 0x500
jb 0x1416d8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416d807e
cmp eax, 0x7f
ja 0x1416d819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416d807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1416d81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1416d807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x14169b000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x14169b00a
jmp 0x14169d00f
jmp fcn.140f390b0
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0061b500]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x0061b510]
mov dword [rax], 1
mov rax, qword [0x0061b520]
mov dword [rax], 1
mov rax, qword [0x0061b4f0]
mov dword [rax], 1
mov rax, qword [0x0061b3b0]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x0061b4e0]
mov dword [0x0061e00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x0061b4a0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x0061b360]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x617a61
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov r8d, 0x40
lea rcx, [sym.crypted__]
movsxd rdx, dword [0x0061a010]
lea r9, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r11d, dword [0x0061a010]
mov r10, qword [str.G2N56cA5dC2XQU12]
xor ecx, ecx
mov r9d, dword [0x0061a014]
lea r8, [sym.crypted__]
mov eax, ecx
cmp r11d, ecx
jle 0x617abd
cdq
idiv r9d
movsxd rdx, edx
mov al, byte [r10 + rdx]
xor byte [r8 + rcx], al
inc rcx
jmp 0x617aa2
call sym.crypted__
xor eax, eax
add rsp, 0x38
ret

Function at 0x617f80
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x617ff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x0061e614]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x618198
mov rax, qword [0x0061e618]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x61803c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x6180c7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x618020
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x6181d2
mov rax, qword [0x0061e618]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0061e618]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6181e1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x6180c0
sub eax, 4
and eax, 0xfffffffb
jne 0x618150
add dword [0x0061e614], 1
cmp ebx, 8
jae 0x6180f8
test bl, 4
jne 0x6181a0
test ebx, ebx
je 0x6180e9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x6181c0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x6180e9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x61812a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x0061e618]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6180c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor edi, edi
jmp 0x618047
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x6180e9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x6180e9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
mov rax, qword [0x0061e618]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call dbg.__report_error
nop
nop dword [rax]