joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031a60
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x140050040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x140050780]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140031c7f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140031c7f
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x140050780]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x140031b34
movsx rdx, word [r8 + 0x5438]
lea rax, [r8 + 0x543c]
mov r9d, dword [r8 + 0x3fe8]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x140031b29
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x5438], cx
movsx rax, cx
lea rax, [rax*8 + 0x543c]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x5430]
test rdi, rdi
je 0x140031b51
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x140031b54
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x140048bc8]
mov qword [rsi + 0x88], rax
mov qword [rsi + 0x98], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x140031b97
mov rsi, qword [r8 + 0x98]
jmp 0x140031b9a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140031bc5
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x140050780]
mov rcx, qword [rax + 0x4bd0]
mov rax, qword [rdi]
mov rdx, qword [rcx]
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x28], rax
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140031c3f
inc rbx
cmp rbx, 5
jl 0x140031c21
jmp 0x140031c6b
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x140031c81
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140040ce0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x14004187c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400418c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400418c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400418c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400418c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400418c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400418c8
xor al, al
add rsp, 0x28
ret
Function at 0x14000404c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
mov word [rsp + 0x10], r8w
movsxd r10, edx
mov r9, rcx
movzx r8d, r11w
test edx, edx
jle 0x140004093
lea edx, [r11 + 1]
mov cl, byte [r9]
cmp dx, r8w
mov eax, r11d
cmovne ax, r8w
add cl, 0x20
movzx r8d, ax
mov al, byte [rsp + r8*2 + 0x10]
add r8w, dx
xor al, cl
mov byte [r9], al
add r9, rdx
sub r10, rdx
jne 0x140004067
ret
Function at 0x14000e7e8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14000e5bc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e5bc
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e5bc
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e5bc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e5bc
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e5bc
cmp dword [rcx + 0xf8], esi
je 0x14000e5bc
mov ecx, r14d
call fcn.14000e704
mov ecx, 2
call fcn.1400138f8
nop
cmp byte [0x141ec2aa0], 0
jne 0x14000e686
mov r15d, 1
mov eax, r15d
xchg dword [0x141ec2a90], eax
test ebx, ebx
jne 0x14000e62f
mov rdi, qword [0x141ebf640]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x141ec2a98]
cmp rcx, rax
je 0x14000e626
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14000659c]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x141ec2bd8]
jmp 0x14000e63b
cmp ebx, r15d
jne 0x14000e641
lea rcx, [0x141ec2bf0]
call fcn.14000f178
nop
test ebx, ebx
jne 0x14000e658
lea rdx, [0x14001c4a0]
lea rcx, [0x14001c480]
call fcn.14000f4b0
lea rdx, [0x14001c4b0]
lea rcx, [0x14001c4a8]
call fcn.14000f4b0
movzx eax, byte [0x141ec2aa0]
test esi, esi
cmove eax, r15d
mov byte [0x141ec2aa0], al
jmp 0x14000e686
mov ecx, 2
call fcn.14001394c
test esi, esi
jne 0x14000e69d
mov ecx, r14d
call fcn.14000e6b8
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000e54c
Function at 0x140006630
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
mov r8d, 0x20
call fcn.14000b3f0
test rax, rax
je 0x14000669c
mov qword [rbp + 0x48], rax
mov rcx, rax
mov qword [rbp + 0x50], rdx
call qword [rdx]
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140006705
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x48]
call fcn.1400088c0
jmp 0x140006705
movaps xmm0, xmmword [rbp + 0x20]
movaps xmm1, xmmword [rbp + 0x30]
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x60], xmm0
lea r8, [0x14002ae40]
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x60]
mov r9d, 8
call fcn.14000b1c0
mov rax, qword [rbp - 0x40]
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [rbp - 0x28]
movaps xmmword [rbp], xmm0
mov rcx, qword [rbp - 0x18]
mov qword [rbp + 0x10], rcx
mov rcx, qword [rdi + 0x30]
mov qword [rdi + 0x38], rcx
mov qword [rdi], rax
movaps xmm0, xmmword [rbp - 0x10]
movaps xmm1, xmmword [rbp]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rax, qword [rbp + 0x10]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
jmp fcn.140008cd0

Function at 0x140008900
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x14000b6a0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14000b712
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
jmp 0x14000b6d8
add rdi, rbx
sub rsi, rbx
je 0x14000b712
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x14000b6d0
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x14000b6d0
and ebp, 0x7fffffff
jmp 0x14000b714
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400113b0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov qword [rbp + 0x3f0], rcx
mov qword [rbp + 0x3f8], 0
mov qword [rbp + 0x400], 2
mov qword [rbp + 0x408], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140011450
jmp 0x14001143f
jae 0x14001150f
cmp r8, 0x201
jae 0x140011450
mov r14d, 0x200
lea r15, [rbp - 0x60]
mov r12, r8
jmp 0x1400114a7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14001147f
lea rcx, [rbp + 0x3f8]
mov rdx, rbx
call fcn.140027e90
mov rsi, qword [rbp + 0x3f8]
mov rax, qword [rbp + 0x400]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x408], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3e8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1400114d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140011589
mov r8d, r13d
cmp r12, r8
jne 0x140011430
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400115bd
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14001143f
jmp 0x140011450
cmp r14, r8
jb 0x1400115d7
lea rcx, [rbp + 0x3c8]
mov rdx, r15
call fcn.1400130a0
movups xmm0, xmmword [rbp + 0x3c8]
movups xmm1, xmmword [rbp + 0x3d8]
movaps xmmword [rbp + 0x3b0], xmm1
movaps xmmword [rbp + 0x3a0], xmm0
mov rsi, qword [rbp + 0x3f0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
je 0x140011572
mov rcx, qword [rbp + 0x400]
add rdx, rdx
mov r8d, 2
call fcn.1400088c0
mov rax, rsi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3f0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3f8]
test rdx, rdx
jne 0x14001155d
jmp 0x140011572
lea rcx, str.internal_error:_entered_unreachable_code_rustc_9b00956e56009bab2aa15d7bff10916599e3d6d6library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULsT
mov edx, 0x28
call fcn.140028f90
jmp 0x1400115ec
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULsT
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140029370
ud2
Function at 0x140017c30
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x14002da00]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140017c68
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140017cca
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140017cd5
xor edx, edx
jmp 0x140017ce5
cmp eax, 0x103
je 0x140017d10
test eax, eax
js 0x140017cf0
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.140012e70
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.14000f9f0
mov ecx, 7
int 0x29
ud2

Function at 0x140017d80
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rcx
movups xmm0, xmmword [0x14002da00]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140017db8
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x88], rcx
test r9, r9
mov qword [rsp + 0x80], r9
lea rcx, [rsp + 0x88]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140017e21
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140017e55
test eax, eax
js 0x140017e35
mov rdx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0xb0
pop rsi
ret
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb0
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x80]
call fcn.140012e70
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x78]
call fcn.14000f9f0
mov ecx, 7
int 0x29
ud2
Function at 0x140025f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140025fea
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140025fe0
cmp r11, r10
ja 0x140026075
cmp r10, rdx
ja 0x140026087
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140025fe2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140025fc0
jmp 0x140026057
ja 0x140025fea
mov r11, r10
cmp rax, r8
jne 0x140025f92
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14002605b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140026030
mov r8, r10
sub ecx, r9d
jns 0x14002604e
jmp 0x14002605d
cmp r10, rdx
je 0x140026069
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14002605d
xor al, 1
cmp r8, rdx
jne 0x140026010
jmp 0x14002605d
xor eax, eax
jmp 0x14002605d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140028e80
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140029380
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140029370
int3

Function at 0x1400276d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002771a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002771a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002771a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002771a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002771a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002771c
xor al, al
add rsp, 0x28
ret
Function at 0x141001058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1410011df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141001089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14100106f
add dl, dl
jne 0x141001096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410010f6
xor eax, eax
add dl, dl
jne 0x1410010a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1410011ad
add dl, dl
jne 0x1410010b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410010c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410010d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1410010dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1410010ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14100107e
mov eax, 1
add dl, dl
jne 0x141001106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141001113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1410010fb
sub eax, ebx
mov ebx, 1
jne 0x14100114c
mov ecx, 1
add dl, dl
jne 0x14100112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14100113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141001123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14100107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141001168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141001175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14100115d
cmp eax, 0x7d00
jae 0x14100119b
cmp eax, 0x500
jb 0x141001196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14100107e
cmp eax, 0x7f
ja 0x14100119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14100107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1410011d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14100107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400022c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002312
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002312
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002312
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002312
cmp dword [rcx + 0x84], 0xe
jbe 0x140002312
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002314
xor al, al
add rsp, 0x28
ret
Function at 0x14000299c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400029e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400029e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400029e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400029e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400029e8
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x920
mov eax, dword [0x140027bc8]
mov rdi, rcx
cmp dword [rcx], eax
je 0x1400010cc
mov rax, qword [0x140027bc0]
xor ebx, ebx
cmp rax, rbx
je 0x14000104f
cmp word [0x140027bc2], bx
je 0x140001043
call rax
mov qword [0x140027bc0], rax
mov ecx, eax
call fcn.1400027a0
mov rcx, rax
jmp 0x1400010b6
mov ecx, 0x27
call fcn.1400027a0
mov r9, qword [rdi + 0x10]
mov r8d, dword [rdi]
lea rcx, [rsp + 0x120]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
cmp dword [rdi + 0x18], ebx
jbe 0x1400010ae
lea rsi, [rdi + 0x20]
mov r8, qword [rsi]
lea rdx, str._t0x_p_n
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
add ebx, 1
add rsi, 8
cmp ebx, dword [rdi + 0x18]
jb 0x14000107a
lea rcx, [rsp + 0x120]
call fcn.14000c698
call fcn.140005cc4
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r11, [rsp + 0x920]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140001764
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
test rdx, rdx
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
je 0x14000178a
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + VariantCopy]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140001799
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
lea rcx, [rdi + 0x18]
mov rdx, rsi
mov qword [rdi + 0x10], rbx
call fcn.1400013d4
lea rcx, [rdi + 0x18]
mov dx, 0x5c
call fcn.140001548
and dword [0x140027be0], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x14000135c]
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [0x140027bd0], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x140027c40], 2
mov qword [0x140027bd8], rax
je 0x140001803
call fcn.14000bb50
mov rax, qword [0x140027bd8]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8d, dword [0x140027be0]
and qword [0x140027d08], 0
test r8d, r8d
je 0x140001872
cmp r8d, 1
je 0x140001864
cmp r8d, 2
je 0x14000185d
cmp r8d, 3
je 0x140001856
cmp r8d, 0x67
jle 0x140001845
cmp r8d, 0x6a
jle 0x1400018dd
mov edx, 0x14
xor ecx, ecx
call fcn.14000c7f4
jmp 0x1400018dd
mov edx, 0x12
jmp 0x140001869
mov edx, 0x13
jmp 0x140001869
mov edx, reloc.COMCTL32.dll_InitCommonControls
xor ecx, ecx
call fcn.14000c7f4
jmp 0x1400018dd
cmp dword [0x140027d04], 0
jne 0x1400018dd
mov rcx, qword [0x140027bd8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [rsp + 0x40]
test eax, eax
je 0x14000189d
test ecx, ecx
jne 0x14000189d
xor eax, eax
jmp 0x1400018e2
mov edx, 0x80070000
mov eax, ecx
and eax, edx
cmp eax, edx
je 0x1400018b4
mov r8d, ecx
mov edx, 0x21
jmp 0x14000184a
movzx ecx, cx
cmp ecx, 0xe
jne 0x1400018c5
cmp dword [0x140027c44], 0xffffffff
je 0x1400018dd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, dword [rsp + 0x40]
mov edx, 0x22
lea ecx, [rdx - 0x21]
call fcn.14000c7f4
mov eax, 0x80004005
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140001f34
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140001f7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140001f62
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140001f80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001f7b
test al, 0x10
jne 0x140001f7b
mov ecx, 0xb7
jmp 0x140001f58
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140001f88
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x40], cl
mov ecx, 0xfffffff5
mov byte [rsp + 0x41], InitCommonControls
mov byte [rsp + 0x42], 0xa
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rax
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret