joyce8/EMBER2024-capa huggingface dataset:
Function at 0x38fd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x60
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov r12, rdx
mov rsi, rcx
movzx r10d, bx
movsx rax, r10w
inc r10w
mov dword [rsp + rax*4 + 0x40], ebx
cmp r10w, 4
jb 0x38ffb
movzx ecx, bx
movsx rax, cx
inc cx
mov dword [rsp + rax*4 + 0x20], ebx
cmp cx, 4
jb 0x39011
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
mov eax, dword [rsi + rcx*4 + 0x10]
xor eax, dword [r12 + rcx*4 + 0x10]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x39025
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.00038eb8
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.00038d4c
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x39070
lea rcx, [rsp + 0x20]
call fcn.00038cc8
movzx edx, bx
cmp word [rbp], bx
je 0x390bd
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
xor eax, dword [rbp + rcx*4 + 4]
xor eax, dword [rsp + rcx*4 + 0x20]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rdi + rcx*4], eax
cmp dx, 4
jb 0x39098
jmp 0x390dc
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rdi + rcx*4], eax
cmp dx, 4
jb 0x390bd
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [rdi + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x390df
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.00038d4c
movsx rcx, bx
inc bx
mov eax, dword [rsi + rcx*4 + 0x10]
xor eax, dword [rdi + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
mov dword [rdi + rcx*4 + 0x10], eax
cmp bx, 4
jb 0x3910a
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x39148
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
lea rdx, [rax - 0x28]
mov rdi, r8
mov rbp, rcx
call fcn.00038eb8
lea rdx, [rbp + 0x10]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.00038d4c
xor ebx, ebx
movzx r9d, bx
movsx rcx, r9w
inc r9w
mov eax, dword [rbp + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
mov dword [rsp + rcx*4 + 0x30], eax
cmp r9w, 4
jb 0x39187
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rcx*4 + 0x50], eax
cmp dx, 4
jb 0x391a5
lea rcx, [rsp + 0x50]
call fcn.00038cc8
movzx edx, bx
cmp word [rdi], bx
je 0x391ea
movsx rcx, dx
inc dx
mov eax, dword [rdi + rcx*4 + 4]
xor eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x391cc
jmp 0x39202
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x391ea
movzx ecx, bx
movsx rax, cx
inc cx
or dword [rsp + rax*4 + 0x20], 0xffffffff
cmp cx, 4
jb 0x39205
and dword [rsp + 0x20], 0x1ffff
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
xor dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x39222
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.00038d4c
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x3924c
lea rcx, [rsp + 0x40]
call fcn.00038cc8
movsx rcx, bx
inc bx
mov eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x40]
mov dword [rsi + rcx*4 + 0x10], eax
cmp bx, 4
jb 0x3926b
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x392a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor r13d, r13d
mov r12, r9
mov rsi, r8
lea r14d, [r13 + 1]
mov rbp, rdx
movzx r10d, r13w
movsx r8, r10w
add r10w, r14w
mov eax, dword [rcx + r8*4]
mov dword [rsp + r8*4 + 0x20], eax
cmp r10w, 4
jb 0x392df
mov edx, r13d
movzx ecx, r13w
movsx rax, cx
add cx, r14w
or edx, dword [rsp + rax*4 + 0x20]
cmp cx, 4
jb 0x392fe
cmp edx, r13d
jne 0x39347
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsi + rax*4], r13d
cmp cx, 4
jb 0x39319
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsi + rax*4 + 0x10], r13d
cmp cx, 4
jb 0x3932f
jmp 0x394e3
movzx ebx, r13w
mov r11d, 3
test byte [rsp + 0x2c], r14b
je 0x39387
mov al, byte [rsp + 0x2c]
mov ecx, 2
and al, r11b
sub cl, al
movsx rax, bx
mov byte [rsp + rax + 0x60], cl
jns 0x39390
movzx ecx, r11w
movsx rax, cx
add dword [rsp + rax*4 + 0x20], r14d
jne 0x39390
add cx, 0xffff
jns 0x39374
jmp 0x39390
movsx rax, bx
mov byte [rsp + rax + 0x60], r13b
and dword [rsp + 0x2c], 0xfffffffe
lea rcx, [rsp + 0x20]
call fcn.00038d08
add bx, r14w
mov edx, r13d
movzx ecx, r13w
movsx rax, cx
add cx, r14w
or edx, dword [rsp + rax*4 + 0x20]
cmp cx, 4
jb 0x393aa
cmp edx, r13d
jne 0x39351
dec bx
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x393c8
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4 + 0x10]
mov dword [rsi + rcx*4 + 0x10], eax
cmp dx, 4
jb 0x393e1
cmp bx, r13w
jle 0x394e3
movsx rax, bx
lea rdi, [rsp + rax + 0x60]
lea rdx, [rsp + 0x20]
mov r8, r12
mov rcx, rsi
call fcn.00039148
sub rdi, r14
dec bx
cmp byte [rdi], 0xff
je 0x39475
cmp byte [rdi], r13b
je 0x39440
cmp byte [rdi], r14b
jne 0x394d9
lea rdx, [rsp + 0x20]
mov rcx, rbp
jmp 0x394ce
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rsp + rcx*4 + 0x20]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x39444
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4 + 0x10], eax
cmp dx, 4
jb 0x3945d
jmp 0x394d9
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x39479
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsp + rax*4 + 0x50], r13d
cmp cx, 4
jb 0x39493
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4 + 0x10]
xor eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x50], eax
cmp dx, 4
jb 0x394aa
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov r9, r12
mov r8, rsi
call fcn.00038fd0
cmp bx, r13w
jg 0x3940a
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.00039af0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x395f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x1f0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov esi, 1
xor ebp, ebp
lea r12d, [rsi + 0x70]
mov cx, si
movzx r8d, bp
movsx rax, cx
movsx ecx, cx
mov word [rsp + rax*2 + 0x10], r8w
add ecx, ecx
mov eax, 0x24168e19
add r8w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r8w, r12w
jl 0x39634
mov r8d, 0xe2
cmp cx, si
jne 0x396ae
movzx r9d, bp
movsx rax, r8w
movsx ecx, r8w
mov word [rsp + rax*2 + 0x10], r9w
add ecx, ecx
mov eax, 0x24168e19
add r9w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r9w, r12w
mov r8w, cx
jl 0x39675
jmp 0x396e4
movzx r9d, r12w
movsx rax, cx
movsx ecx, cx
mov word [rsp + rax*2 + 0x10], r9w
add ecx, ecx
mov eax, 0x24168e19
add r9w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r9w, r8w
jl 0x396b2
or eax, 0xffffffff
mov word [0x0004bfc0], si
mov bx, si
lea r11d, [rax + 0x71]
mov word [0x0004c186], ax
mov r8, rsi
mov r10, r11
movsx ebx, bx
mov eax, 0x24168e19
add ebx, ebx
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ebx, edx
movsx rdx, bx
mov rcx, rdx
neg rcx
movzx eax, word [rsp + rcx*2 + 0x1d8]
mov word [rsp], ax
movzx eax, word [rsp + rcx*2 + 0x1d4]
movzx ecx, bp
mov word [rsp + 2], ax
movzx eax, word [rsp + rdx*2 + 0xe]
mov word [rsp + 4], ax
movzx eax, word [rsp + rdx*2 + 0x12]
movzx edx, bp
mov word [rsp + 6], ax
movsx rax, dx
movzx r9d, word [rsp + rax*2]
cmp r9w, r12w
jge 0x39789
movsx rax, cx
lea rdi, [0x0004bfc0]
imul rax, rax, 0xe3
add rax, r8
add cx, si
mov word [rdi + rax*2], r9w
add dx, si
cmp cx, 2
jl 0x3975d
add r8, rsi
sub r10, rsi
jne 0x39702
lea edx, [r10 + 0x10]
movzx r8d, bp
mov word [0x0004bfa4], bp
mov r10d, edx
mov r9d, 0xffff0000
mov ecx, r9d
and ecx, r11d
je 0x397c5
add r8w, dx
mov r11d, ecx
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
movsx edx, ax
mov eax, r9d
mov ecx, edx
mov r10d, edx
shr eax, cl
xor r9d, eax
cmp dx, bp
jne 0x397b6
mov word [0x0004bfa4], r8w
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.00039af0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x39820
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x230
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r12, rcx
movsxd r13, edx
xor ebx, ebx
lea rcx, [rsp + 0x20]
jmp 0x39881
mov al, byte [r8]
cmp al, 0x20
je 0x3987e
cmp al, 9
je 0x3987e
cmp al, 0xd
je 0x3987e
cmp al, 0xa
je 0x3987e
cmp al, 0x61
jl 0x39879
cmp al, 0x7a
jg 0x39879
sub al, 0x20
mov byte [rcx], al
inc rcx
inc r8
cmp byte [r8], bl
jne 0x3985c
mov r10, qword [0x0004cf48]
mov byte [rcx], bl
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
or esi, 0xffffffff
repne scasb al, byte [rdi]
not rcx
lea rbp, [rcx - 1]
cmp r10, rbx
jne 0x39932
mov edx, 0x400
xor ecx, ecx
mov r8d, 0xcc4d5053
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r9d, ebx
mov r8, rbx
mov r10, rax
mov qword [0x0004cf48], rax
mov eax, 1
mov ecx, ebx
lea edx, [rax + 0x7f]
test r9d, eax
je 0x398e3
or ecx, edx
add eax, eax
shr edx, 1
jne 0x398dc
shl ecx, 0x18
mov eax, 8
bt ecx, 0x1f
jae 0x39901
add ecx, ecx
xor ecx, 0x4c11db7
jmp 0x39903
add ecx, ecx
sub rax, 1
jne 0x398f1
lea edi, [rax + 1]
mov edx, ebx
mov eax, 0x80000000
test ecx, edi
je 0x39919
or edx, eax
add edi, edi
shr eax, 1
jne 0x39913
mov dword [r10 + r8*4], edx
inc r8
inc r9d
cmp r8, 0x100
jl 0x398d2
mov eax, ebp
lea rdi, [rsp + 0x20]
lea rdx, [rsp + rax + 0x20]
lea rax, [rsp + 0x20]
cmp rax, rdx
jae 0x39966
movsx ecx, byte [rdi]
mov eax, esi
inc rdi
xor rcx, rax
movzx eax, cl
mov ecx, esi
mov esi, dword [r10 + rax*4]
shr ecx, 8
xor esi, ecx
cmp rdi, rdx
jb 0x39948
cmp r13, rbx
mov dword [0x0004bfb8], esi
jle 0x39987
mov ecx, 0x100
call fcn.00037a18
xor byte [rbx + r12], al
inc rbx
cmp rbx, r13
jl 0x39971
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.00039af0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x2e57c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
setl r10b
mov qword [rsp + 0x10], rdi
sub edi, edi
movsx ebx, r13w
movzx ebx, r8b
mov r11, rcx
mov r8, rdi
setb r9b
nop
movzx r9d, byte [r11]
movzx r10d, r11w
movzx r10d, byte [rdx]
jmp 0x2e57f9
inc r11
jmp 0x2e5801
inc rdx
test r8b, 0xd
test sp, di
test bl, bl
jmp 0x2e5812
je 0x2e583b
mov ecx, r8d
mov eax, 0x625a2112
rol eax, cl
clc
stc
add al, r8b
cmc
xor r9b, al
jmp 0x2e5830
inc r8
cmp rbx, 0x36af0916
cmc
test r9b, r9b
jmp 0x2e5843
je 0x2e5857
cmp r9b, r10b
jmp 0x2e5851
je 0x2e57e8
cmp r9b, r10b
jmp 0x2e585f
jae 0x2e5878
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
jmp 0x2e5877
ret
mov rbx, qword [rsp + 8]
cbw
seta dil
movsx rax, r11w
cmovle rax, r13
lahf
mov eax, edi
mov rdi, qword [rsp + 0x10]
jmp 0x2e5898
ret
Function at 0x140001ec0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x40
call fcn.1400013d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x48]
lea rdx, str.Installer_made_by_Nano_and_edited_by_Pixeluted___discord.gg_runesoftware
lea rcx, [rsp + 0x20]
call fcn.140001990
lea rcx, [rsp + 0x20]
call fcn.1400012d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x36]
lea rdx, str.Big_thanks_to_cereal_for_making_uwp_update_bypasser__n_n
lea rcx, [rsp + 0x20]
call fcn.140001990
lea rcx, [rsp + 0x20]
call fcn.1400012d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8d, 0x94
lea rdx, str.Fluster_is_patched_as_of_right_now__Please_wait_until_it_gets_unpatched__if_you_want_to_get_notification_join_discord_server_discord.gg_runesoftware
lea rcx, [rsp + 0x20]
call fcn.140001990
lea rcx, [rsp + 0x20]
call fcn.1400011d0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x140002a3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002a86
mov ecx, ?good@ios_base@std@@QEBA_NXZ
cmp word [rax], cx
jne 0x140002a86
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002a86
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002a86
cmp dword [rcx + 0x84], 0xe
jbe 0x140002a86
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002a88
xor al, al
add rsp, 0x28
ret
Function at 0x140064ed0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140064edd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140064eed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140064ed5
lea eax, [rcx + 1]
jmp 0x140064efb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140064f0e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140064ef4
sub eax, 3
jb 0x140064f2e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140064f7d
sar eax, 1
movsxd rbp, eax
jb 0x140064f64
jmp 0x140064f3c
add ebx, ebx
jne 0x140064f3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140064f64
inc ecx
add ebx, ebx
jne 0x140064f4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140064f64
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140064f5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140064f4c
add ecx, 2
jmp 0x140064f69
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140064e92
jmp 0x140064edd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x28800
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140064fc9
cmp rsi, rcx
jae 0x140064fd1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140064fb0
cmp al, 0x8f
ja 0x140064fb0
cmp byte [rsi - 2], 0xf
je 0x140064fb6
sub al, 0xe8
cmp al, 1
ja 0x140064f9a
cmp rsi, rcx
jae 0x140064fd1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140064fa0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140064fd1
lodsb al, byte [rsi]
jmp 0x140064fb0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x62000]
mov eax, dword [rdi]
or eax, eax
je 0x14006503a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x744c0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140064fde
jns 0x140065013
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14006501d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140065034
mov qword [rbx], rax
add rbx, 8
jmp 0x140064ffe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140065074
cmp al, 0xef
ja 0x140065066
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140065046
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140065055
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400650c8
sub rsp, 0xffffffffffffff80
jmp 0x14000b310
Function at 0x14000f880
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000f903
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x14000f8ce
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.1400146c0
mov rcx, qword [rsi]
call fcn.140014650
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x14000f8fc
mov qword [rsi], rdi
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140014680
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
iretd
invalid
invalid
invalid
nop dword [rbx + 0x6ff88c21]
sbb byte [rbx + 0x6ff88c21], ch
sbb dh, byte [rax - 0x1b]
jg 0x1400c3dd1
xchg edx, eax
jnp 0x1400c3e32
jnp 0x1400c3e3e
invalid
push 0xffffffffffffff80
loop 0x1400c3e16
je 0x1400c3e23
invalid
out dx, eax
jbe 0x1400c3e33
cli
push rcx
mov ebx, 0x14658bd1
jge 0x1400c3e27
mov gs, word [rdx]
invalid
insb byte [rdi], dx
invalid

Function at 0x140010e90
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x140065020]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov r8d, 0x104
mov rdx, rdi
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140010eff
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140010e20
test al, al
jne 0x140010f0d
add rbx, 8
cmp rbx, 0x18
jne 0x140010ecd
xor esi, esi
jmp 0x140010f10
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14002a340
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18000c21c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x18000c294
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x18000c294
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x18000c294
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x18000c288
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x18000c2a6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x18000c276
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x18000c296

Function at 0x18000c760
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000c788
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18000c788
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140005680
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [rcx]
test edx, edx
jne 0x1400056a8
mov dword [rcx + 4], 2
lea rax, [rcx + 4]
cmp edx, 3
jne 0x1400056d1
mov dword [rax], 4
cmp edx, 0x22
jne 0x1400056dc
mov dword [rax], 0x4a
ret
cmp edx, 1
jne 0x1400056b2
mov dword [rcx + 4], edx
jmp 0x14000568d
cmp edx, 2
jne 0x14000568d
lea rax, [rcx + 4]
mov dword [rax], 3
cmp edx, 0x17
jne 0x140005874
mov dword [rax], 0x38
ret
cmp edx, 4
jne 0x1400056e8
mov dword [rax], 5
cmp edx, 0x23
jne 0x1400056f3
mov dword [rax], 0x4b
ret
cmp edx, 5
jne 0x1400056ff
mov dword [rax], 6
cmp edx, 0x24
jne 0x14000570a
mov dword [rax], 0x4c
ret
cmp edx, 6
jne 0x140005716
mov dword [rax], 8
cmp edx, 0x25
jne 0x140005721
mov dword [rax], 0x4d
ret
cmp edx, 7
jne 0x14000572d
mov dword [rax], 9
cmp edx, 0x26
jne 0x140005738
mov dword [rax], 0x4e
ret
cmp edx, 8
jne 0x140005744
mov dword [rax], 0xc
cmp edx, 0x27
jne 0x14000574f
mov dword [rax], 0x4f
ret
cmp edx, 9
jne 0x14000575b
mov dword [rax], 0xd
cmp edx, 0x28
jne 0x140005766
mov dword [rax], 0x50
ret
cmp edx, 0xa
jne 0x140005772
mov dword [rax], 0x10
cmp edx, 0x29
jne 0x14000577d
mov dword [rax], 0x51
ret
cmp edx, 0xb
jne 0x140005789
mov dword [rax], 0x11
cmp edx, 0x2a
jne 0x140005794
mov dword [rax], 0x52
ret
cmp edx, 0xc
jne 0x1400057a0
mov dword [rax], 0x12
cmp edx, 0x2b
jne 0x1400057ab
mov dword [rax], 0x53
ret
cmp edx, 0xd
jne 0x1400057b7
mov dword [rax], 0x13
cmp edx, 0x2c
jne 0x1400057c2
mov dword [rax], 0x54
ret
cmp edx, 0xe
jne 0x1400057ce
mov dword [rax], 0x14
cmp edx, 0x2d
jne 0x1400057d9
mov dword [rax], 0x55
ret
cmp edx, 0xf
jne 0x1400057e5
mov dword [rax], 0x30
cmp edx, 0x2e
jne 0x1400057f0
mov dword [rax], 0x56
ret
cmp edx, 0x10
jne 0x1400057fc
mov dword [rax], 0x31
cmp edx, 0x2f
jne 0x140005807
mov dword [rax], 0x57
ret
cmp edx, 0x11
jne 0x140005813
mov dword [rax], 0x32
cmp edx, 0x30
jne 0x14000581e
mov dword [rax], 0x58
ret
cmp edx, 0x12
jne 0x14000582a
mov dword [rax], 0x33
cmp edx, 0x31
jne 0x140005835
mov dword [rax], 0x59
ret
cmp edx, 0x13
jne 0x140005841
mov dword [rax], 0x34
cmp edx, 0x32
jne 0x14000584c
mov dword [rax], 0x5a
ret
cmp edx, 0x14
jne 0x140005858
mov dword [rax], 0x35
cmp edx, 0x33
jne 0x140005857
mov dword [rax], 0x18
ret
cmp edx, 0x15
jne 0x140005864
mov dword [rax], 0x36
ret
cmp edx, 0x16
jne 0x1400056c1
mov dword [rax], 0x37
ret
cmp edx, 0x18
jne 0x140005880
mov dword [rax], 0x39
ret
cmp edx, 0x19
jne 0x14000588c
mov dword [rax], 0x41
ret
cmp edx, 0x1a
jne 0x140005898
mov dword [rax], 0x42
ret
cmp edx, 0x1b
jne 0x1400058a4
mov dword [rax], 0x43
ret
cmp edx, 0x1c
jne 0x1400058b0
mov dword [rax], 0x44
ret
cmp edx, 0x1d
jne 0x1400058bc
mov dword [rax], 0x45
ret
cmp edx, 0x1e
jne 0x1400058c8
mov dword [rax], 0x46
ret
cmp edx, 0x1f
jne 0x1400058d4
mov dword [rax], 0x47
ret
cmp edx, 0x20
jne 0x1400058e0
mov dword [rax], 0x48
ret
cmp edx, 0x21
jne 0x14000569c
mov dword [rax], 0x49
ret