joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ad84
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140035a08
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14004ae0e
cmp byte [rbp - 0x21], r15b
je 0x14004ae09
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14004ae44
call fcn.14003fdb0
test eax, eax
jne 0x14004ae30
cmp byte [rbp - 0x21], r15b
je 0x14004ae28
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14004ae44
cmp byte [rbp - 0x21], r15b
je 0x14004ae41
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140038734
test eax, eax
jne 0x14004aee4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140035a08
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14004ae83
cmp byte [rbp - 0x21], r15b
je 0x14004aeb8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14004aeb8
call fcn.14003fdb0
test eax, eax
jne 0x14004aea4
cmp byte [rbp - 0x21], r15b
je 0x14004ae9d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14004aeb8
cmp byte [rbp - 0x21], r15b
je 0x14004aeb5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140038734
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14004aee4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14004aee7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14004aef5
mov rcx, rdi
call fcn.14003c65c
cmp byte [rbp + 0x3f], r15b
je 0x14004af04
mov rcx, qword [rbp + 0x27]
call fcn.14003c65c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14004c540
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14004c568
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14004c568
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x65b531c0
Capabilities:
Get storage device properties

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rbx, [rsp + 0x70]
mov rdi, rdx
mov ebp, ecx
xor edx, edx
mov rcx, rdi
mov rsi, r8
call fcn.65bc1ce8
mov rcx, rbx
mov r8d, ebp
lea rdx, str..PhysicalDrive_d
call qword [0x65be4558]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [0x65be4270]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x65b532ac
lea r12, [0x65bdb240]
xor edx, edx
mov r8d, 0x2710
mov dword [rsp + 0x60], 0
lea r13, [rsp + 0x64]
mov qword [rsp + 0x64], 0
mov rcx, r12
mov dword [rsp + 0x6c], 0
call fcn.65bc1ce8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x2710
mov qword [rsp + 0x20], r12
mov r9d, 0xc
mov r8, r13
mov qword [rsp + 0x30], rax
mov edx, 0x2d1400
mov rcx, rbx
call qword [0x65be4288]
test eax, eax
jne 0x65b532d4
mov rcx, rbx
call qword [0x65be4268]
cmp rsi, 0x13
jbe 0x65b53480
mov rdx, rdi
mov ecx, ebp
call fcn.65b52e10
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x65bdb258]
test eax, eax
je 0x65b532a3
add rax, r12
mov r15, qword [0x65be44a8]
mov r13d, 0x64
mov qword [rsp + 0x58], rax
mov r12, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov r14, rax
test r13d, r13d
movzx edx, byte [r12]
je 0x65b533b0
test dl, dl
je 0x65b533b0
movsx ecx, dl
mov byte [rsp + 0x4e], dl
call r15
test eax, eax
je 0x65b53450
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x39
jg 0x65b53430
sub edx, 0x30
movsx ecx, byte [r12 + 1]
shl edx, 4
mov byte [rsp + 0x4e], dl
mov byte [rsp + 0x4f], cl
call r15
test eax, eax
je 0x65b53450
movzx edx, byte [rsp + 0x4f]
cmp dl, 0x39
jg 0x65b53440
sub edx, 0x30
or dl, byte [rsp + 0x4e]
add r12, 2
movzx ecx, dl
mov byte [rsp + 0x4e], dl
call qword [0x65be44a0]
test eax, eax
je 0x65b53450
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x20
je 0x65b53306
sub r13d, 1
mov byte [r14], dl
add r14, 1
test r13d, r13d
movzx edx, byte [r12]
jne 0x65b53314
mov r8, qword [rsp + 0x50]
mov byte [r14], 0
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x65b533b9
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov ecx, eax
cmove r8, rdx
add cl, al
sbb r8, 3
sub r8, qword [rsp + 0x50]
cmp r8d, esi
mov r12d, r8d
jae 0x65b532a3
mov rdx, qword [rsp + 0x50]
add r8, 1
mov rcx, rdi
call fcn.65bc1cf8
mov rcx, rbx
call qword [0x65be4268]
test r12d, r12d
je 0x65b532ac
xor eax, eax
jmp 0x65b532c0
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x65b5333f
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x65b5336c
mov rcx, qword [rsp + 0x58]
call fcn.65bc1ca0
cmp eax, esi
mov r12d, eax
jae 0x65b532a3
mov rdx, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, rdi
call fcn.65bc1cf8
jmp 0x65b53410
mov eax, 0xffffffff
jmp 0x65b532c0
Function at 0x65b536d0
Capabilities:
Get storage device properties

Disassembly:
sub rsp, 0x28
test r9, r9
mov eax, ecx
mov rcx, rdx
jne 0x65b53702
test eax, eax
je 0x65b53720
cmp eax, 1
je 0x65b53740
cmp eax, 2
je 0x65b53750
cmp eax, 3
je 0x65b53760
cmp eax, 4
jne 0x65b5376a
mov edx, r8d
add rsp, 0x28
jmp fcn.65b530c0
test eax, eax
je 0x65b53730
cmp eax, 1
jne 0x65b53789
cmp byte [r9], 0x2a
mov edx, r8d
jne 0x65b53760
add rsp, 0x28
jmp fcn.65b52940
mov edx, r8d
add rsp, 0x28
jmp fcn.65b53490
mov r8d, r8d
mov rcx, r9
add rsp, 0x28
jmp fcn.65b53560
mov edx, r8d
add rsp, 0x28
jmp fcn.65b52b30
mov edx, r8d
add rsp, 0x28
jmp fcn.65b52cc0
mov eax, 0xffffffff
add rsp, 0x28
ret
lea r8, str.Unsupported_hardware_type
lea rcx, str..._src_hdinfo.c
mov edx, 0x89
call fcn.65b441f0
mov eax, 0xffffffff
jmp 0x65b53765
lea r8, str.Unsupported_hardware_type_with_name
lea rcx, str..._src_hdinfo.c
mov edx, 0x74
call fcn.65b441f0
mov eax, 0xffffffff
jmp 0x65b53765
Function at 0x65b58fc0
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x65b58ffa
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0
mov qword [rcx], 0
add rsp, 0x28
ret
lea rdx, str.src_hashes_md5.c
lea rcx, [0x65bce291]
mov r8d, 0xe9
call fcn.65b5df60
nop
nop
nop word cs:[rax + rax]
Function at 0x65b59020
Capabilities:
Hash data with md5

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x65b59230
test rdx, rdx
je 0x65b59249
mov edx, dword [rcx + 0x18]
mov eax, 0x10
cmp edx, 0x3f
jbe 0x65b59054
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r8d, [rdx*8]
add r8, qword [rcx]
mov eax, edx
mov qword [rcx], r8
lea ecx, [rdx + 1]
cmp ecx, 0x38
mov dword [rbx + 0x18], ecx
mov byte [rbx + rax + 0x1c], pe_nt_image_headers64
ja 0x65b591b0
cmp ecx, 0x38
lea rdi, [rbx + 0x1c]
je 0x65b59179
mov edx, ecx
lea r9d, [rcx + 1]
mov eax, ecx
not edx
mov byte [rbx + rax + 0x1c], 0
and edx, 7
cmp r9d, 0x38
je 0x65b59172
test edx, edx
je 0x65b5911d
cmp edx, 1
je 0x65b5910b
cmp edx, 2
je 0x65b590ff
cmp edx, 3
je 0x65b590f3
cmp edx, 4
je 0x65b590e6
cmp edx, 5
je 0x65b590d9
cmp edx, 6
je 0x65b590cd
mov byte [rbx + r9 + 0x1c], 0
lea r9d, [rcx + 2]
mov ecx, r9d
add r9d, 1
mov byte [rbx + rcx + 0x1c], 0
mov r10d, r9d
add r9d, 1
mov byte [rbx + r10 + 0x1c], 0
mov r11d, r9d
add r9d, 1
mov byte [rbx + r11 + 0x1c], 0
mov edx, r9d
add r9d, 1
mov byte [rbx + rdx + 0x1c], 0
mov eax, r9d
add r9d, 1
mov byte [rbx + rax + 0x1c], 0
mov ecx, r9d
add r9d, 1
cmp r9d, 0x38
mov byte [rbx + rcx + 0x1c], 0
je 0x65b59172
lea r11d, [r9 + 1]
lea edx, [r9 + 2]
mov r10d, r9d
mov byte [rbx + r10 + 0x1c], 0
lea eax, [r9 + 3]
lea ecx, [r9 + 4]
mov byte [rbx + r11 + 0x1c], 0
lea r10d, [r9 + 5]
mov byte [rbx + rdx + 0x1c], 0
lea r11d, [r9 + 6]
lea edx, [r9 + 7]
add r9d, 8
cmp r9d, 0x38
mov byte [rbx + rax + 0x1c], 0
mov byte [rbx + rcx + 0x1c], 0
mov byte [rbx + r10 + 0x1c], 0
mov byte [rbx + r11 + 0x1c], 0
mov byte [rbx + rdx + 0x1c], 0
jne 0x65b5911d
mov dword [rbx + 0x18], 0x38
mov qword [rbx + 0x54], r8
mov rdx, rdi
mov rcx, rbx
call fcn.65b58780
mov r9d, dword [rbx + 8]
xor eax, eax
mov dword [rsi], r9d
mov edi, dword [rbx + 0xc]
mov dword [rsi + 4], edi
mov r8d, dword [rbx + 0x10]
mov dword [rsi + 8], r8d
mov ebx, dword [rbx + 0x14]
mov dword [rsi + 0xc], ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp ecx, 0x40
je 0x65b59217
lea edi, [rdx + 2]
mov byte [rbx + rcx + 0x1c], 0
cmp edi, 0x40
je 0x65b59210
lea r8d, [rdx + 3]
mov byte [rbx + rdi + 0x1c], 0
cmp r8d, 0x40
je 0x65b59210
lea r9d, [rdx + 4]
mov byte [rbx + r8 + 0x1c], 0
cmp r9d, 0x40
je 0x65b59210
lea r10d, [rdx + 5]
mov byte [rbx + r9 + 0x1c], 0
cmp r10d, 0x40
je 0x65b59210
lea r11d, [rdx + 6]
mov byte [rbx + r10 + 0x1c], 0
cmp r11d, 0x40
je 0x65b59210
cmp edx, 0x38
mov byte [rbx + r11 + 0x1c], 0
jne 0x65b59210
mov byte [rbx + 0x5b], 0
mov dword [rbx + 0x18], 0x40
lea rdi, [rbx + 0x1c]
mov rcx, rbx
mov rdx, rdi
call fcn.65b58780
mov r8, qword [rbx]
xor ecx, ecx
jmp 0x65b59085
lea rdx, str.src_hashes_md5.c
lea rcx, [0x65bce291]
mov r8d, 0x106
call fcn.65b5df60
lea rdx, str.src_hashes_md5.c
lea rcx, [0x65bce29c]
mov r8d, 0x107
call fcn.65b5df60
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x65ba13a0
Capabilities:
Check for software breakpoints

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r8d, r8d
mov rbp, rcx
je 0x65ba13e0
mov rcx, qword [rdx + 0x10]
cmp dword [rcx + 8], 0xcd
je 0x65ba13d2
test byte [rcx + 0xd], 0x10
jne 0x65ba13d2
cmp qword [rdx + 0x28], 0
jne 0x65ba13d2
cmp qword [rcx + 0x28], rdx
je 0x65ba13e3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdx
mov rsi, qword [rdx + 0x18]
mov rbx, qword [rcx]
mov rdi, qword [rdx + 0x20]
and esi, 0x7fff
test rbx, rbx
je 0x65ba13d2
mov edx, dword [rbx + 8]
movsxd r12, esi
cmp edx, 0x5c
je 0x65ba1463
ja 0x65ba1480
lea eax, [rdx - 7]
cmp eax, 1
jbe 0x65ba13d2
mov rcx, rbp
call fcn.65ba0f90
test al, 4
jne 0x65ba13d2
mov edx, eax
and edx, 3
cmp edx, 3
je 0x65ba1500
mov edx, eax
and edx, 0x300
cmp edx, 0x300
je 0x65ba1530
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
je 0x65ba1556
mov rbx, qword [rcx]
test rbx, rbx
je 0x65ba13d2
mov edx, dword [rbx + 8]
cmp edx, 0x5c
jne 0x65ba1404
mov rax, qword [rbx + 0x10]
and eax, 0x7fff
cmp r12, rax
je 0x65ba1493
mov rcx, rbx
jmp 0x65ba144f
cmp edx, 0xcd
jne 0x65ba140e
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp word [rbx + 0xc], 0
jne 0x65ba13d2
cmp qword [rbx + 0x18], rdi
jne 0x65ba13d2
cmp rcx, rbx
mov rax, qword [rbx]
je 0x65ba1590
mov qword [rcx], rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rdx, qword [rax + 0x100]
mov qword [rbx], rdx
mov qword [rax + 0x100], rbx
jmp 0x65ba144f
test al, 8
je 0x65ba1570
mov edx, dword [rbx + 0x10]
and edx, 0x7fff
cmp edx, esi
je 0x65ba13d2
mov edx, dword [rbx + 0x14]
and edx, 0x7fff
cmp edx, esi
jne 0x65ba1428
jmp 0x65ba13d2
mov rdx, qword [rbx + 0x18]
and edx, 0x7fff
cmp r12, rdx
je 0x65ba13d2
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
jne 0x65ba144f
mov rax, qword [rbx + 0x20]
and eax, 0x7fff
cmp r12, rax
jne 0x65ba144f
jmp 0x65ba13d2
mov rdx, qword [rbx + 0x10]
and edx, 0x7fff
cmp r12, rdx
jne 0x65ba1428
jmp 0x65ba13d2
mov rdx, qword [rbp + 0x38]
mov qword [rdx], rax
jmp 0x65ba14b7
Function at 0x65bbf8c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x20
cmp dword [rcx + 0x244], 0x10
ja 0x65bbf940
mov rbx, rcx
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov edi, r8d
call fcn.65b5dfa0
test eax, eax
mov r14d, eax
jne 0x65bbf946
mov eax, dword [rbx + 0x240]
test eax, eax
jne 0x65bbf931
movsxd rcx, dword [rbx + 0x244]
test ecx, ecx
jne 0x65bbf960
cmp qword [rbx + 0x248], 0
je 0x65bbfb50
lea r13, [rbx + 0x228]
lea r12, [rbx + 0x1f8]
jmp 0x65bbf9da
cmp eax, 1
je 0x65bbfb60
nop word [rax + rax]
mov r14d, 0x10
lea rsp, [rbp - 0x38]
mov eax, r14d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbx + 0x23c]
lea r13, [rbx + 0x228]
test eax, eax
jne 0x65bbf9a0
cmp ecx, 0xc
jne 0x65bbf9a0
mov rax, qword [rbx + 0x228]
mov qword [rbx + 0x208], rax
mov eax, dword [r13 + 8]
mov dword [rbx + 0x214], 0x1000000
mov dword [rbx + 0x210], eax
jmp 0x65bbfa45
lea eax, [rcx - 1]
lea r12, [rbx + 0x1f8]
lea r8, [rbx + rax + 0x1f9]
mov rdx, r12
movzx eax, byte [rdx + 0x30]
xor byte [rdx], al
add rdx, 1
cmp rdx, r8
jne 0x65bbf9b5
shl rcx, 3
add qword [rbx + 0x248], rcx
mov rdx, r12
mov rcx, rbx
call fcn.65b580c0
mov edx, 8
mov rcx, r13
call fcn.65b5eaa0
mov rax, qword [rbx + 0x248]
mov rdx, r12
bswap rax
mov qword [rbx + 0x230], rax
lea rax, [rbx + 0x208]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rax, rdx
jne 0x65bbfa02
mov rdx, r12
mov rcx, rbx
call fcn.65b580c0
mov rdx, qword [rbx + 0x200]
mov rax, qword [rbx + 0x1f8]
mov rcx, r12
mov qword [rbx + 0x210], rdx
mov qword [rbx + 0x208], rax
mov edx, 0x10
call fcn.65b5eaa0
mov rdx, qword [rbx + 0x210]
mov rax, qword [rbx + 0x208]
mov rcx, r13
mov qword [rbx + 0x220], rdx
mov qword [rbx + 0x218], rax
mov edx, 0x10
call fcn.65b5eaa0
mov qword [rbx + 0x240], 1
mov qword [rbx + 0x248], 0
mov r13d, edi
and r13d, 0xfffffff0
je 0x65bbfb80
lea r15, [rbx + 0x1f8]
xor r12d, r12d
nop dword [rax + rax]
mov eax, r12d
mov rdx, r15
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [r12 + 8]
add r12d, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.65b580c0
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12d, r13d
jb 0x65bbfaa0
mov eax, r12d
add rsi, rax
cmp edi, r12d
jbe 0x65bbf946
sub edi, 1
sub edi, r12d
lea r12, [rsi + rdi + 1]
lea rdi, [rbx + 0x1f8]
jmp 0x65bbfb09
cmp rsi, r12
je 0x65bbf946
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
movzx ecx, byte [rsi - 1]
lea eax, [rdx + 1]
mov dword [rbx + 0x244], eax
xor byte [rbx + rdx + 0x1f8], cl
cmp eax, 0x10
jne 0x65bbfb00
mov rdx, rdi
mov rcx, rbx
call fcn.65b580c0
mov dword [rbx + 0x244], 0
sub qword [rbx + 0x248], 0xffffffffffffff80
jmp 0x65bbfb00
mov r14d, 1
jmp 0x65bbf946
mov eax, dword [rbx + 0x244]
cmp eax, 0xf
jg 0x65bbf940
xor r12d, r12d
test eax, eax
jne 0x65bbfae0
jmp 0x65bbfa84
xor r12d, r12d
jmp 0x65bbfae0
Function at 0x65bbffb0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
mov ebp, 0x10
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x240]
test eax, eax
jne 0x65bc00f1
cmp dword [rcx + 0x244], 0xf
mov rbx, rcx
ja 0x65bc00f1
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov r12d, r8d
call fcn.65b5dfa0
test eax, eax
mov ebp, eax
jne 0x65bc00f1
mov eax, dword [rbx + 0x244]
lea edx, [rax + r12]
cmp edx, 0xc
jbe 0x65bc0012
or dword [rbx + 0x23c], 1
xor edi, edi
test eax, eax
jne 0x65bc006b
mov r13d, r12d
and r13d, 0xfffffff0
je 0x65bc0102
lea r14, [rbx + 0x1f8]
nop dword [rax]
mov eax, edi
mov rdx, r14
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [rdi + 8]
add edi, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.65b580c0
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp edi, r13d
jb 0x65bc0030
mov eax, edi
add rsi, rax
cmp r12d, edi
jbe 0x65bc00f1
sub r12d, 1
lea r13, [rbx + 0x1f8]
sub r12d, edi
lea rdi, [rbx + 0x208]
lea r12, [rsi + r12 + 1]
jmp 0x65bc0095
cmp r12, rsi
je 0x65bc00f1
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
lea ecx, [rdx + 1]
mov dword [rbx + 0x244], ecx
movzx eax, byte [rsi - 1]
cmp ecx, 0x10
mov byte [rbx + rdx + 0x228], al
jne 0x65bc0090
mov rdx, r13
nop dword [rax]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rdi, rdx
jne 0x65bc00c0
mov rdx, r13
mov rcx, rbx
call fcn.65b580c0
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12, rsi
mov dword [rbx + 0x244], 0
jne 0x65bc0095
add rsp, 0x20
mov eax, ebp
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, eax
jmp 0x65bc006b
Function at 0x66327058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x663271df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x66327089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x6632706f
add dl, dl
jne 0x66327096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x663270f6
xor eax, eax
add dl, dl
jne 0x663270a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x663271ad
add dl, dl
jne 0x663270b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x663270c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x663270d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x663270dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x663270ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x6632707e
mov eax, 1
add dl, dl
jne 0x66327106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x66327113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x663270fb
sub eax, ebx
mov ebx, 1
jne 0x6632714c
mov ecx, 1
add dl, dl
jne 0x6632712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6632713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x66327123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x6632707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x66327168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x66327175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x6632715d
cmp eax, 0x7d00
jae 0x6632719b
cmp eax, 0x500
jb 0x66327196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x6632707e
cmp eax, 0x7f
ja 0x6632719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x6632707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x663271d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x6632707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003090
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rbp + 0x20], r14d
cmp qword [r8 + 0x18], 7
jbe 0x1400030bf
mov r8, qword [r8]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400030f0
mov dword [rbx], eax
mov byte [rbx + 0x20], r14b
jmp 0x14000319e
mov r8d, dword [rbp + 0x20]
shr r8, 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov edx, 0x20
lea rcx, [rbp - 0x28]
call fcn.140007a70
nop
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rax, qword [rbp - 0x28]
cmp qword [rdi + 0x18], 7
jbe 0x14000312d
mov rdi, qword [rdi]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 2
mov r8, rdi
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400031b6
mov dword [rbx], eax
mov byte [rbx + 0x20], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14000319e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003199
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003284
call fcn.1400253f4
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, dword [rbp + 0x20]
shr rcx, 1
dec rcx
mov r8, qword [rbp - 0x18]
cmp rcx, r8
ja 0x1400031e1
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rcx
mov word [rax + rcx*2], r14w
jmp 0x140003231
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 0x10]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140003225
mov qword [rbp - 0x18], rcx
lea r9, [rbp - 0x28]
cmp rdi, 7
cmova r9, qword [rbp - 0x28]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14000321a
movzx eax, r14w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r14w
jmp 0x140003231
mov r9, rdx
lea rcx, [rbp - 0x28]
call fcn.140007d00
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140002250
mov byte [rbx + 0x20], 1
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14000319e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003199
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003199
call fcn.140036744
int3
Function at 0x1400145e0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbx
push r12
push r14
push r15
sub rsp, 0x38
lea r14, [rcx + 8]
mov rbx, rdx
mov edx, dword [r14]
lea rax, [rsp + 0x60]
sub edx, dword [rcx]
mov r15, rcx
mov rcx, qword [rcx]
xor r12d, r12d
xor r9d, r9d
mov dword [rsp + 0x60], r12d
mov r8d, 0x40000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x14001476d
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx + 0x18]
cmp r8, rcx
ja 0x140014667
cmp rdi, 7
mov rax, rbx
lea rdi, [rbx + 0x10]
jbe 0x14001465c
mov rax, qword [rbx]
lea r14, [r15 + 8]
mov qword [rbx + 0x10], r8
mov word [rax + r8*2], r12w
jmp 0x1400146b5
mov rdx, r8
mov rax, rdi
sub rdx, rcx
sub rax, rcx
cmp rdx, rax
ja 0x1400146a6
mov qword [rbx + 0x10], r8
mov r9, rbx
cmp rdi, 7
jbe 0x140014688
mov r9, qword [rbx]
lea rdi, [r9 + rcx*2]
test rdx, rdx
je 0x14001469b
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
mov word [r9 + r8*2], r12w
lea r14, [r15 + 8]
jmp 0x1400146b1
mov r9, rdx
mov rcx, rbx
call fcn.140007d00
lea rdi, [rbx + 0x10]
cmp qword [rbx + 0x18], 7
mov r9, rbx
jbe 0x1400146c8
mov r9, qword [rbx]
lea rsi, [rbx + 0x10]
jmp 0x1400146cb
mov rsi, rdi
mov edx, dword [r14]
lea rax, [rsp + 0x60]
sub edx, dword [r15]
mov r8d, 0x40000001
mov rcx, qword [r15]
mov qword [rsp + 0x20], rax
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ebp, eax
test eax, eax
je 0x14001475e
mov ecx, dword [rsp + 0x60]
mov r8, qword [rdi]
mov r9, qword [rbx + 0x18]
cmp rcx, r8
ja 0x140014716
cmp r9, 7
jbe 0x14001470c
mov rbx, qword [rbx]
mov rdi, rsi
mov qword [rdi], rcx
mov word [rbx + rcx*2], r12w
jmp 0x14001475c
mov rdx, rcx
mov rax, r9
sub rdx, r8
sub rax, r8
cmp rdx, rax
ja 0x140014751
mov qword [rsi], rcx
cmp r9, 7
jbe 0x140014733
mov rbx, qword [rbx]
lea rdi, [rbx + r8*2]
test rdx, rdx
je 0x140014746
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [rbx + rax*2], r12w
jmp 0x14001475c
mov r9, rdx
mov rcx, rbx
call fcn.140007d00
mov eax, ebp
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r12
pop rbx
ret