joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009e34c
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0x934eca57
pushf
not eax
add eax, 0xee178860
xor eax, 0xb96567b9
rol eax, 0x25
popf
pushf
not eax
add eax, 0xfd4dac0e
xor eax, 0xfcde72d4
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xfbe7cd4f
xor eax, 0xe5fa9d32
rol eax, 0x3a
popf
cmp eax, 2
jne 0x14009e39c
popf
pop rax
jmp 0x14009e4c6
cmp eax, 0
jne 0x14009e3ab
popf
pop rax
jmp 0x14009e3ba
cmp eax, 1
jne 0x14009e3ba
popf
pop rax
jmp 0x14009e4b7
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1932a7a35]
pushf
sub r9, 0x5326ed4d
popf
xor ecx, ecx
lea r8, [0x19c9e5fbb]
pushf
sub r8, 0x5c9ad2db
popf
lea rdx, [0x1912b11ee]
pushf
sub rdx, 0x51278506
popf
call fcn.140015b9c
test rax, rax
je 0x14009e45e
push rax
pushf
mov eax, 0xce938877
pushf
not eax
add eax, 0xda32f754
xor eax, 0xd53ba433
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xc910247c
xor eax, 0xb00c6aaf
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xe4069a5a
xor eax, 0xa8e26715
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xcad5f24b
xor eax, 0xcd234900
rol eax, 0xef
popf
jmp 0x14009e38d
push rax
pushf
mov eax, 0x266c9dc8
pushf
not eax
add eax, 0xc5068c00
xor eax, 0xab19fe62
rol eax, 0x64
popf
pushf
not eax
add eax, 0xdcfe2a94
xor eax, 0xc1114e3b
rol eax, 0xab
popf
pushf
not eax
add eax, 0xb77a7bb6
xor eax, 0xdd79a7b6
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xee6b7de4
xor eax, 0xbde216d9
rol eax, 0xbf
popf
jmp 0x14009e38d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x140036430]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1400c567a
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x14a99642
pushf
not eax
add eax, 0xebe48fd7
xor eax, 0xf9d7219c
rol eax, 0x93
popf
pushf
not eax
add eax, 0xd482aca5
xor eax, 0xba0a5405
rol eax, 0xa2
popf
pushf
not eax
add eax, 0x913168dc
xor eax, 0x8cae079e
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xe3ffb1dd
xor eax, 0x8d0de832
rol eax, 0x75
popf
cmp eax, 2
jne 0x1400c56dd
popf
pop rax
jmp 0x1400c5798
cmp eax, 0
jne 0x1400c56ec
popf
pop rax
jmp 0x1400c56fb
cmp eax, 1
jne 0x1400c56fb
popf
pop rax
jmp 0x1400c5786
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140127513
test al, al
je 0x1400c573f
push rax
pushf
mov eax, 0x12ce14cc
pushf
not eax
add eax, 0xe0b4d8c4
xor eax, 0x941a0fc0
rol eax, 0xab
popf
pushf
not eax
add eax, 0xb6929a65
xor eax, 0xf030df95
rol eax, 0xa3
popf
jmp 0x1400c56ce
push rax
pushf
mov eax, 0xc180682f
pushf
not eax
add eax, 0xc9a73ae6
xor eax, 0xb6536bc0
rol eax, 0xba
popf
pushf
not eax
add eax, 0xae24f942
xor eax, 0x91bf2dcb
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xb72a6176
xor eax, 0xd1d9bc72
rol eax, 0xaa
popf
jmp 0x1400c56ce
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1400c5792
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1400bbeb0
mov ecx, ebx
jmp 0x1400c57a2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400dbcb7
Capabilities:
Get geographical location

Disassembly:
push rax
pushf
mov eax, 0x4509610a
pushf
not eax
add eax, 0xf1c8480c
xor eax, 0xc6a540aa
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xfc330b8d
xor eax, 0xe881fd70
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xd40d6130
xor eax, 0x8107b060
rol eax, 0xa7
popf
cmp eax, 2
jne 0x1400dbd07
popf
pop rax
jmp 0x1400dbeaa
cmp eax, 0
jne 0x1400dbd16
popf
pop rax
jmp 0x1400dbd34
cmp eax, 3
jne 0x1400dbd25
popf
pop rax
jmp 0x1400dbf0b
cmp eax, 1
jne 0x1400dbd34
popf
pop rax
jmp 0x1400dbe28
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x1ba03afbf]
pushf
sub r9, 0x79ffdd07
popf
mov rbp, rcx
lea r8, [0x19f2d571e]
pushf
sub r8, 0x5f29846e
popf
lea rdx, [0x1bb6f8ba5]
pushf
sub rdx, 0x7b6bb8ed
popf
mov ecx, 0xc68517fb
pushf
not ecx
add ecx, 0xdead22c9
xor ecx, 0xe6c287da
rol ecx, 0xbe
popf
pushf
not ecx
add ecx, 0x8f729ca7
xor ecx, 0x81b7f961
rol ecx, 0xa7
popf
call fcn.14002618c
test rax, rax
je 0x1400dbdf5
push rax
pushf
mov eax, 0x9adbba59
pushf
not eax
add eax, 0x91868b78
xor eax, 0xa948d17a
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xe6b38703
xor eax, 0xda278a82
rol eax, 0x7a
popf
jmp 0x1400dbcf8
push rax
pushf
mov eax, 0xb81a523b
pushf
not eax
add eax, 0x862958a9
xor eax, 0x81f20ff9
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xd06750fc
xor eax, 0xd896b7b7
rol eax, 0xc6
popf
jmp 0x1400dbcf8
movabs r10, 0xa884ec45f93d54cd
pushf
not r10
add r10, 0x7220122b
xor r10, 0x72dc36a4
rol r10, 0x7d
popf
pushf
not r10
add r10, 0x5d7dd768
xor r10, 0x73f244cd
rol r10, 0x37
popf
pushf
not r10
add r10, 0x7a77d993
xor r10, 0x5625b935
rol r10, 0x8c
popf
pushf
not r10
add r10, 0x4027097a
xor r10, 0x710ec851
rol r10, 0x97
popf
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
jmp 0x1400dbea2
call qword [0x140036438]
jmp 0x1400dbf0b
xor edx, edx
mov rcx, rbp
call fcn.1400f0cfb
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x1400dbebf
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push rax
pushf
mov eax, 0x8306d0a8
pushf
not eax
add eax, 0xdfec18b8
xor eax, 0xee3fcd0b
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xb6d077b3
xor eax, 0xbe4c297a
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x90c517d0
xor eax, 0x9d7cb602
rol eax, 0xa3
popf
jmp 0x1400dbcf8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401c040c
Capabilities:
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0xd476088e
pushf
not eax
add eax, 0x9963682b
xor eax, 0x8bd56805
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xb596176b
xor eax, 0x9581422c
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x8e59af3a
xor eax, 0xa5c717e8
rol eax, 0x5a
popf
cmp eax, 4
jne 0x1401c045c
popf
pop rax
jmp 0x1401c05b9
cmp eax, 0
jne 0x1401c046b
popf
pop rax
jmp 0x1401c04a7
cmp eax, 3
jne 0x1401c047a
popf
pop rax
jmp 0x1401c057d
cmp eax, 1
jne 0x1401c0489
popf
pop rax
jmp 0x1401c052c
cmp eax, 5
jne 0x1401c0498
popf
pop rax
jmp 0x1401c060d
cmp eax, 2
jne 0x1401c04a7
popf
pop rax
jmp 0x1401c0577
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401c04e6
push rax
pushf
mov eax, 0x1333335b
pushf
not eax
add eax, 0xb4eabe5c
xor eax, 0x98b1445f
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xa8010533
xor eax, 0xce151e92
rol eax, 0x19
popf
jmp 0x1401c044d
push rax
pushf
mov eax, 0xb02aff67
pushf
not eax
add eax, 0x88a1116c
xor eax, 0xb7d755ce
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xb6d05e4e
xor eax, 0xae646bd5
rol eax, 7
popf
pushf
not eax
add eax, 0xaa557169
xor eax, 0xd1446f58
rol eax, 0x3b
popf
jmp 0x1401c044d
call fcn.1400d6737
mov dword [rax], socket
call fcn.1401288d9
or eax, 0xffffffff
jmp 0x1401c060d
sub dword [rcx + 0x10], 1
jns 0x1401c05b9
add rsp, 0x28
jmp fcn.1400bc31d
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
push rax
pushf
mov eax, 0xeed811e
pushf
not eax
add eax, 0xb068229c
xor eax, 0x925158f7
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xff5436f8
xor eax, 0xff409c51
rol eax, 0x73
popf
pushf
not eax
add eax, 0xc5b41166
xor eax, 0xb5e5af55
rol eax, 0x29
popf
jmp 0x1401c044d
add rsp, 0x28
ret

Function at 0x1401c4d7a
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
xor r11d, r11d
mov rsi, r8
mov ebp, edx
mov rdi, qword [rax + 0x10]
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
movzx eax, word [rbx + 0x14]
lea r9, [rbx + 0x18]
movzx r10d, word [rbx + 6]
add r9, rax
test r10, r10
je 0x1401c4e39
mov dword [rsp + 0x20], 0x6544302e
mov byte [rsp + 0x24], 0x76
movups xmm2, xmmword [r9]
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [r9 + 0x10]
movsd xmm1, qword [r9 + 0x20]
movd edx, xmm2
movups xmmword [rsp + 0x28], xmm2
movsd qword [rsp + 0x48], xmm1
movups xmmword [rsp + 0x38], xmm0
test dl, dl
je 0x1401c4e21
lea rax, [rsp + 0x20]
lea r8, [rsp + 0x28]
sub r8, rax
movzx eax, dl
nop
movzx edx, al
cmp al, byte [rcx]
jne 0x1401c4e21
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x1401c4e0a
cmp dl, byte [rcx]
lea rdx, [rsp + 0x28]
cmovne rdx, r11
add r9, 0x28
mov r11, rdx
sub r10, 1
jne 0x1401c4dcc
mov eax, dword [r11 + 0xc]
mov rdx, rsi
mov ecx, dword [rbx + 8]
mov eax, dword [rax + rdi]
xor eax, dword [rbx + 0x68]
ror eax, cl
mov ecx, ebp
add rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp rax
Function at 0x180003e00
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1260
call fcn.180004a90
sub rsp, rax
mov rax, qword [0x18002e018]
xor rax, rsp
mov qword [rsp + 0x1250], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
xor edi, edi
call fcn.1800067d0
test rbx, rbx
jne 0x180003eb9
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x1000
call fcn.1800067d0
lea edx, [rdi + 0x5c]
lea rcx, [0x180029e90]
call fcn.1800063dc
test rax, rax
jne 0x180003e73
lea rax, [0x180029ef0]
jmp 0x180003e77
add rax, 2
mov dword [rsp + 0x28], 0x7d
lea r9, [0x180029f48]
lea r8, str._s__s:_d__Error_During_Parameter_is_Null_n
mov edx, 0x7ff
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x250]
call fcn.180002d00
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, edi
jmp 0x180003fe2
mov rcx, qword [0x180031fd8]
lea rdx, [rsp + 0x40]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x180003f60
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x1000
call fcn.1800067d0
mov edx, 0x5c
lea rcx, [0x180029fc0]
call fcn.1800063dc
mov rbx, rax
test rax, rax
jne 0x180003f10
lea rbx, [0x18002a020]
jmp 0x180003f14
add rbx, 2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea r9, [0x18002a078]
mov dword [rsp + 0x28], 0x83
mov edx, 0x7ff
lea r8, str._s__s:_d__Error_During_GetModuleFileName_Err:_d_n
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x250]
call fcn.180002d00
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, edi
jmp 0x180003fe2
mov edx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.1800063dc
test rax, rax
jne 0x180003fc7
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x1000
call fcn.1800067d0
mov edx, 0x5c
lea rcx, [0x18002a100]
call fcn.1800063dc
test rax, rax
jne 0x180003fa8
lea rax, [0x18002a160]
jmp 0x180003fac
add rax, 2
mov dword [rsp + 0x28], 0x8a
lea r9, [0x18002a1b8]
lea r8, str._s__s:_d__Error_During_Not_Find_Dest_Character_n
jmp 0x180003e8d
lea r8, [rsp + 0x40]
mov word [rax + 2], di
mov edx, 0x104
mov rcx, rbx
call fcn.18000f538
mov eax, 1
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.180004600
mov rbx, qword [rsp + 0x1278]
add rsp, 0x1260
pop rdi
ret
Function at 0x1800149fc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180014a2c
xor eax, eax
jmp 0x180014aef
mov rbp, rbx
cmp word [rax], si
je 0x180014a51
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180014a38
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180014a34
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18001494c
movsxd r14, eax
test eax, eax
jne 0x180014a8f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180014a25
mov rcx, r14
call fcn.180010bfc
mov rdi, rax
test rax, rax
jne 0x180014aa8
xor ecx, ecx
call fcn.180010bc0
jmp 0x180014a84
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18001494c
test eax, eax
jne 0x180014ad9
mov rcx, rdi
call fcn.180010bc0
jmp 0x180014ae3
xor ecx, ecx
call fcn.180010bc0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400011c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0x104
lea rdx, [rsp + 0x30]
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x140001220
movabs rbp, 0x7ffffffffffffffe
cmp rbx, rbp
ja 0x140001355
mov qword [rsp + 0x278], rsi
mov qword [rdi + 0x18], 7
cmp rbx, 7
ja 0x140001274
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov rcx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r14w
jmp 0x140001326
mov rax, rbx
or rax, 7
cmp rax, rbp
jbe 0x140001290
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400012c2
mov ecx, 0xa
mov rbp, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb rbp, rcx
lea rcx, [rbp + 1]
cmp rcx, rax
ja 0x14000135b
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400012f1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000135b
mov rcx, rax
call fcn.140001bf0
test rax, rax
je 0x1400012ea
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001303
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001300
call fcn.140001bf0
mov rsi, rax
jmp 0x140001303
mov rsi, r14
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
add rbx, rbx
mov qword [rdi], rsi
mov r8, rbx
mov qword [rdi + 0x18], rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r14w
mov rsi, qword [rsp + 0x278]
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001bd0
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rdi
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3
Function at 0x140001370
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
lea rcx, [rsp + 0x50]
call fcn.1400011c0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140001660
nop
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r8, qword [rsp + 0x30]
xor ebp, ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea rdx, str.http:__example.com
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x140001441
lea rax, [rsp + 0x30]
cmp rbx, rax
je 0x14000143d
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova r9, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov rax, qword [rbx + 0x18]
cmp rdi, rax
ja 0x140001432
mov rsi, rbx
cmp rax, 7
jbe 0x140001417
mov rsi, qword [rbx]
mov qword [rbx + 0x10], rdi
lea r8, [rdi + rdi]
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov word [rsi + rdi*2], bp
mov bl, 1
jmp 0x140001466
mov rdx, rdi
mov rcx, rbx
call fcn.1400019e0
mov bl, 1
jmp 0x140001466
lea rdx, str.Failed_to_download_random_content.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400017c0
mov rcx, rax
lea rdx, [0x1400019a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor bl, bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1400014ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001c2c
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140001503
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001c2c
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001bd0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140002550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000259a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000259a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000259a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000259a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000259a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000259c
xor al, al
add rsp, 0x28
ret

Function at 0x1407a8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407a81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407a8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407a806f
add dl, dl
jne 0x1407a8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407a80f6
xor eax, eax
add dl, dl
jne 0x1407a80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407a81ad
add dl, dl
jne 0x1407a80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407a80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407a80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407a80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407a80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407a807e
mov eax, 1
add dl, dl
jne 0x1407a8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407a8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407a80fb
sub eax, ebx
mov ebx, 1
jne 0x1407a814c
mov ecx, 1
add dl, dl
jne 0x1407a812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407a813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407a8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407a807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407a8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407a8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407a815d
cmp eax, 0x7d00
jae 0x1407a819b
cmp eax, 0x500
jb 0x1407a8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407a807e
cmp eax, 0x7f
ja 0x1407a819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407a807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407a81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407a807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140005890
Capabilities:
Check os version

Disassembly:
sub rsp, 0x18
mov rax, qword gs:[0x60]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov eax, dword [rax + 0x118]
mov dword [rsp], eax
cmp dword [rsp], 6
jb 0x1400058d4
mov eax, dword [0x7ffe0004]
mov rcx, qword [0x7ffe0320]
imul rcx, rax
mov rax, rcx
shr rax, 0x18
jmp 0x1400058ea
mov eax, dword [0x7ffe0000]
mov ecx, dword [0x7ffe0004]
imul rax, rcx
shr rax, 0x18
add rsp, 0x18
ret
Function at 0x1400072c0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 4], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x18]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 8]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x10], rax
mov dword [rsp], 0
jmp 0x140007342
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 8]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jae 0x1400073d5
mov eax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x10]
add rcx, rax
mov rax, rcx
lea rcx, str..text
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140007383
inc rcx
test dl, dl
jne 0x140007370
xor eax, eax
jmp 0x140007388
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1400073d0
mov eax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x10]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov eax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x10]
mov eax, dword [rdx + rax + 0x10]
mov dword [rcx], eax
mov dword [rsp + 4], 1
jmp 0x1400073d5
jmp 0x14000733a
mov eax, dword [rsp + 4]
add rsp, 0x28
ret

Function at 0x1400098d0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
add rax, 0x10
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x10]
mov qword [rsp], rax
mov rax, qword [rsp]
mov rax, qword [rax + 0x30]
cmp qword [rsp + 0x30], rax
jb 0x14000993f
mov rax, qword [rsp]
mov eax, dword [rax + 0x40]
mov rcx, qword [rsp]
add rax, qword [rcx + 0x30]
cmp qword [rsp + 0x30], rax
jae 0x14000993f
mov rax, qword [rsp]
mov rax, qword [rax + 0x30]
jmp 0x140009957
mov rax, qword [rsp]
mov rax, qword [rax]
mov qword [rsp], rax
mov rax, qword [rsp + 0x18]
cmp qword [rsp], rax
jne 0x140009910
xor eax, eax
add rsp, 0x28
ret
Function at 0x140009960
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword gs:[0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rax, 0x10
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x20], rax
jmp 0x1400099b4
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x1400099ff
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
cmp qword [rax + 0x30], rcx
jne 0x1400099d2
jmp 0x1400099a7
xor r8d, r8d
mov edx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x30]
call fcn.140009a10
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400099f6
jmp 0x1400099a7
mov rax, qword [rsp + 0x30]
jmp 0x140009a01
xor eax, eax
add rsp, 0x58
ret