joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001ff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
movsxd rax, dword [rcx + 0x3c]
mov ebp, dword [0x180020a84]
lea r11d, [rbp - 1]
imul r11d, ebp
cmp dword [rcx + rax + 0x8c], 0
mov r8d, dword [0x180020a88]
je 0x180002072
mov eax, dword [rcx + rax + 0x88]
cmp r8d, 0xa
jl 0x180002032
mov ebp, r11d
and ebp, 1
je 0x180002032
jmp 0x180002030
cmp dword [rcx + rax + 0x14], 0
je 0x180002072
mov r9d, dword [rcx + rax + 0x18]
test r9d, r9d
je 0x180002072
mov r10d, dword [rcx + rax + 0x1c]
cmp dword [0x180020a8c], 0xa
jl 0x180002092
mov esi, dword [0x180020a90]
lea edi, [rsi - 1]
imul edi, esi
and edi, 1
je 0x180002092
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x180002070
xor ecx, ecx
cmp r8d, 0xa
jl 0x1800020ff
mov eax, r11d
and eax, 1
je 0x1800020ff
nop word cs:[rax + rax]
jmp 0x180002090
add r10, rcx
mov r15d, dword [rcx + rax + 0x20]
mov r14d, dword [rcx + rax + 0x24]
add r15, rcx
add r14, rcx
xor edi, edi
nop word [rax + rax]
mov esi, dword [r15]
add rsi, rcx
xor eax, eax
nop dword [rax + rax]
movzx ebx, byte [rdx + rax]
movzx ebp, byte [rsi + rax]
test bl, bl
je 0x1800020d5
add rax, 1
cmp bl, bpl
je 0x1800020c0
cmp bl, bpl
je 0x1800020f4
add edi, 1
add r15, 4
add r14, 2
cmp edi, r9d
jne 0x1800020b0
xor ecx, ecx
cmp r8d, 0xa
jge 0x180002105
jmp 0x180002112
movzx eax, word [r14]
mov eax, dword [r10 + rax*4]
add rcx, rax
cmp r8d, 0xa
jl 0x180002112
and r11d, 1
je 0x180002112
nop dword [rax + rax]
jmp 0x180002110
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180002ba0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180020a94]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a98], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r9b
or r9b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r14b
or r14b, al
lea rax, [rcx - 1]
mov r15, r10
test r8b, r8b
je 0x180002cd0
mov r15, qword [r15]
cmp r15, r10
je 0x180002cf2
mov rdi, rax
test r9b, r9b
je 0x180002ce0
nop word cs:[rax + rax]
nop
cmp byte [rdi + 1], 0
lea rdi, [rdi + 1]
jne 0x180002c50
test r14b, r14b
je 0x180002cf0
sub rdi, rcx
je 0x180002cb8
mov r12, qword [r15 + 0x60]
xor edx, edx
nop
movzx esi, word [r12 + rdx*2]
lea ebx, [rsi - 0x41]
lea ebp, [rsi + 0x20]
cmp bx, 0x1a
cmovae ebp, esi
movsx ebx, byte [rcx + rdx]
lea r13d, [rbx - 0x41]
lea r11d, [rbx + 0x20]
cmp r13b, 0x1a
cmovae r11d, ebx
sub ebp, r11d
test esi, esi
je 0x180002cb0
test ebp, ebp
jne 0x180002cb0
add rdx, 1
cmp rdi, rdx
jne 0x180002c70
jmp 0x180002cb8
test ebp, ebp
jne 0x180002c24
mov rax, qword [r15 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002cd0
jmp 0x180002ce0
jmp 0x180002cf0
xor eax, eax
jmp 0x180002cbc
Function at 0x180002a00
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a8c], 0xa
jl 0x180002a32
mov eax, dword [0x180020a90]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002a32
nop word cs:[rax + rax]
jmp 0x180002a30
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x10
mov eax, dword [0x180020a78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a74], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a94]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a98], 0xa
setl r9b
or r9b, al
lea r11, [rcx - 1]
xor eax, eax
mov r14, r10
mov r14, qword [r14]
cmp r14, r10
je 0x180002b2b
mov rsi, r11
test r8b, r8b
je 0x180002b10
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002aa0
sub rsi, rcx
je 0x180002b22
test r9b, r9b
je 0x180002b20
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop word [rax + rax]
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002b00
test ebp, ebp
jne 0x180002b00
add rbx, 1
cmp rsi, rbx
jne 0x180002ac0
jmp 0x180002b27
test ebp, ebp
jne 0x180002a8c
jmp 0x180002b27
jmp 0x180002b10
jmp 0x180002b20
test r9b, r9b
je 0x180002b40
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002b40
Function at 0x18069a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18069a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18069a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18069a06f
add dl, dl
jne 0x18069a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18069a0f6
xor eax, eax
add dl, dl
jne 0x18069a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18069a1ad
add dl, dl
jne 0x18069a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18069a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18069a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18069a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18069a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18069a07e
mov eax, 1
add dl, dl
jne 0x18069a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18069a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18069a0fb
sub eax, ebx
mov ebx, 1
jne 0x18069a14c
mov ecx, 1
add dl, dl
jne 0x18069a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18069a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18069a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18069a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18069a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18069a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18069a15d
cmp eax, 0x7d00
jae 0x18069a19b
cmp eax, 0x500
jb 0x18069a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18069a07e
cmp eax, 0x7f
ja 0x18069a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18069a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18069a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18069a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001570
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x1a8
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x68], 1
mov byte [rsp + 4], 1
lea rax, [rsp + 0xc0]
lea rcx, str.nDAXfZWKb
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x60], 9
mov byte [rsp + 5], 0x52
xor eax, eax
mov word [rsp + 0x18], ax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180001638
xor eax, eax
jmp 0x1800018a5
mov rax, qword [rsp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov eax, 6
mov word [rsp + 0x24], ax
mov qword [rsp + 0x80], 0
mov byte [rsp + 7], 1
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x64], 1
mov byte [rsp + 8], 0x70
mov rax, qword [rsp + 0x10]
cmp dword [rax], 0x4550
je 0x1800016ec
xor eax, eax
jmp 0x1800018a5
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0xf0]
lea rcx, str.aTLDIGyoRSgHfWzvlEjFnUZpA
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1a
rep movsb byte [rdi], byte [rsi]
mov dword [rsp], 0
jmp 0x18000173d
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jge 0x18000185d
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x1d0]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x180001780
inc rcx
test dl, dl
jne 0x18000176d
xor eax, eax
jmp 0x180001785
sbb eax, eax
or eax, 1
test eax, eax
jne 0x180001858
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x40]
mov eax, dword [rdx + rax + 8]
mov dword [rcx], eax
mov byte [rsp + 0xb], 0x75
mov eax, 7
mov word [rsp + 0x2c], ax
mov eax, 7
mov word [rsp + 0x30], ax
mov dword [rsp + 0x54], 5
mov byte [rsp + 0xc], 1
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0xd0]
lea rcx, str.jkNrnILVJ
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x1c0]
add rcx, rax
mov rax, rcx
jmp 0x1800018a5
jmp 0x180001735
xor eax, eax
jmp 0x1800018a5
add rsp, 0x1a8
pop rdi
pop rsi
ret
Function at 0x180002e60
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0xb8
xor eax, eax
mov word [rsp], ax
mov qword [rsp + 0x50], 0
mov byte [rsp + 4], 0x52
mov qword [rsp + 0x10], 0
mov byte [rsp + 5], 0x47
mov eax, 9
mov word [rsp + 0x20], ax
mov qword [rsp + 0x58], 0
mov byte [rsp + 6], 1
mov eax, 9
mov word [rsp + 0x24], ax
mov qword [rsp + 0x18], 0
mov qword [rsp + 0x60], 0
mov eax, 2
mov word [rsp + 0x28], ax
mov byte [rsp + 7], 1
mov byte [rsp + 8], 0x49
mov dword [rsp + 0x40], 0
mov rax, qword [rsp + 0xd8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0xd8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x18], rax
mov byte [rsp + 9], 1
mov eax, 7
mov word [rsp + 0x2c], ax
mov eax, 9
mov word [rsp + 0x30], ax
mov rax, qword [rsp + 0x18]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x18]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x10], rax
mov byte [rsp + 0xa], 1
mov byte [rsp + 0xb], 0x4e
mov dword [rsp + 0x44], 2
mov eax, 2
mov word [rsp + 0x34], ax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x80]
lea rcx, str.vqPlLGRuSxcrbNndVMeOktEfAjgUXFZpHTCWB
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26
rep movsb byte [rdi], byte [rsi]
mov eax, 0x28
imul rax, rax, 0
mov rcx, qword [rsp + 0x10]
mov eax, dword [rcx + rax + 0x14]
cmp dword [rsp + 0xd0], eax
jae 0x180002fa5
mov eax, dword [rsp + 0xd0]
jmp 0x180003072
xor eax, eax
mov word [rsp], ax
jmp 0x180002fb8
movzx eax, word [rsp]
inc ax
mov word [rsp], ax
movzx eax, word [rsp]
mov rcx, qword [rsp + 0x18]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x180003042
movzx eax, word [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x10]
mov eax, dword [rcx + rax + 0xc]
cmp dword [rsp + 0xd0], eax
jb 0x18000303d
movzx eax, word [rsp]
imul rax, rax, 0x28
movzx ecx, word [rsp]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x10]
mov eax, dword [rdx + rax + 0xc]
mov rdx, qword [rsp + 0x10]
add eax, dword [rdx + rcx + 0x10]
cmp dword [rsp + 0xd0], eax
jae 0x18000303d
movzx eax, word [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x10]
mov eax, dword [rcx + rax + 0xc]
mov ecx, dword [rsp + 0xd0]
sub ecx, eax
mov eax, ecx
movzx ecx, word [rsp]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x10]
add eax, dword [rdx + rcx + 0x14]
jmp 0x180003072
jmp 0x180002fad
xor eax, eax
jmp 0x180003072
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x180002770
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800027a2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800027a2
nop word cs:[rax + rax]
jmp 0x1800027a0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002878
mov rsi, r10
test r8b, r8b
je 0x180002890
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002810
test r9b, r9b
je 0x1800028a0
sub rsi, rcx
je 0x180002874
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002870
test ebp, ebp
jne 0x180002870
add rbx, 1
cmp rsi, rbx
jne 0x180002830
jmp 0x180002874
test ebp, ebp
jne 0x1800027fc
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002890
jmp 0x1800028a0
Function at 0x180002480
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800024b2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800024b2
nop word cs:[rax + rax]
jmp 0x1800024b0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a74], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002588
mov rsi, r10
test r8b, r8b
je 0x1800025a0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002520
test r9b, r9b
je 0x1800025b0
sub rsi, rcx
je 0x180002584
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002580
test ebp, ebp
jne 0x180002580
add rbx, 1
cmp rsi, rbx
jne 0x180002540
jmp 0x180002584
test ebp, ebp
jne 0x18000250c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1800025a0
jmp 0x1800025b0
Function at 0x140001390
Capabilities:
Delete file

Disassembly:
mov eax, dword [rsp + 0x9c]
xor eax, 0x7febaf4
cmp dword [rsp + 0x68], eax
je 0x140001e37
jmp 0x14000172c
dec dword [rcx + 0xac2494]
add byte [rax], al
mov edx, dword [rsp + 0xac]
shr edx, cl
mov dword [rsp + 0xac], edx
cmp rax, r8
ja 0x140001235
jmp 0x140001250
mov rax, qword [sym.imp.ADVAPI32.dll_SetPrivateObjectSecurity]
call rax
and ebx, dword [rbp + 0x8714785]
clc
stosb byte [rdi], al
jmp 0x1032c5a20
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call rax
and ebx, dword [rbp + 0x8714785]
jno 0x140001e4e
clc
stosb byte [rdi], al
jmp 0x1032c612b

Function at 0x14000162c
Capabilities:
Read .ini file

Disassembly:
loope 0x14000162f
mov qword [rsp + 0xa0], 0xffffffffc87d171f
mov dword [rsp + 0xa0], 0xc87d171f
mov dword [rsp + 0x74], 0xfffffffd
cmp ecx, 0
je 0x14000177e
jmp fcn.140001a2b
mov dword [rsp + 0xac], 0x5b090dbc
mov rax, qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]

Function at 0x14000167c
Capabilities:
Get common file path

Disassembly:
mov rax, qword [rsp + 0x48]
and rax, 0x71850cc1
mov qword [rsp + 0xa0], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call rax
and ebx, dword [rbp + 0x8714785]
clc
stosb byte [rdi], al
jmp 0x1032c55df
pop rbp
cmp byte [rcx - 0x73], dh
shr byte [rbx + 0x45901211], 0xa8
and cl, byte [rcx + 0x982484]
add byte [rax], al
cmp dword [rsp + 0x98], 0
je 0x140001ced
jmp 0x1400012d8
lea rax, [0x140002542]
call rax
and ebx, dword [rbp + 0x8714785]
clc
stosb byte [rdi], al
jmp 0x1032c5fe1

Function at 0x140001d70
Capabilities:
Delete file

Disassembly:
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x74], 2
test byte [rax + rbx + 0x30], ch
jbe 0x140001e37
jmp 0x140001cad

Function at 0x140001ea8
Capabilities:
Read .ini file

Disassembly:
cmp dword [rsp + 0x94], 0
je 0x14000197b
jmp 0x140001f51
mov eax, dword [rsp + 0xac]
mov rcx, qword [rsp + 0xb0]
or eax, 0x2ac10994
mov dword [rsp + 0xac], eax
add rcx, 0xfffffffffa87a921
lea rdx, [0x14000246a]
adc eax, ebp
xchg edi, eax
mov ch, 0x4f
pop rbp
cmp byte [rcx - 0x73], dh
shr byte [rbx + 0x45901211], 0xa8
and cl, byte [rcx + 0x982484]
add byte [rax], al
mov ecx, 0x43e33376
mov edx, dword [rsp + 0x98]
sub ecx, dword [rsp + 0xac]
mov dword [rsp + 0xac], ecx
mov dword [rsp + 0x94], edx
mov ecx, dword [rsp + 0x94]
mov edx, dword [rsp + 0x94]
mov r8d, dword [rsp + 0x94]
xor edx, 0xffffffff
mov rax, qword [rsp + 0x48]
imul r9, rax, 0x279dce3c
and ecx, ecx
mov qword [rsp + 0xa0], r9
xor r8d, 0xffffffff
mov r10d, dword [rsp + 0xac]
add r10d, dword [rsp + 0xac]
mov dword [rsp + 0xac], r10d
mov r10d, dword [rsp + 0xac]
and r8d, edx
xor r8d, 0xffffffff
mov dword [rsp + 0xac], r10d
cmp ecx, r8d
jne 0x14000177e
jmp 0x140001719
mov eax, dword [rsp + 0xac]
and eax, 0x13c331b4
mov ecx, dword [rsp + 0x9c]
add ecx, 0xf801450d
mov dword [rsp + 0xac], eax
mov rdx, qword [sym.imp.GDI32.dll_CreatePolygonRgn]
call rdx
and ebx, dword [rbp + 0x8714785]
clc
stosb byte [rdi], al
jmp 0x1032c6265
Function at 0x1400020d0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
imul ecx, eax, 0x5bfdf9a3
mov dword [rsp + 0x24], ecx
cmp eax, 4
jae 0x1400020fc
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffffe
call rax
ud2
add rsp, 0x28
ret

Function at 0x1400047b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
lea rax, [fcn.1400047b0]
mov dword [rsp + 0xc], 0x6272d252
mov qword [rsp + 0x18], rax
jmp 0x140004835
mov eax, 0x67f1755d
mov rcx, qword [rsp + 0x10]
movsxd rcx, dword [rcx + 0x3c]
mov rdx, qword [rsp + 0x10]
mov r8d, dword [rdx + rcx]
mov r9d, dword [rsp + 0xc]
or r9d, 0x720b7939
mov dword [rsp + 8], r8d
cmp eax, r9d
ja 0x140004851
cmp dword [rsp + 8], 0x4550
je 0x140004851
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
shr rax, cl
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x20], rax
add rdx, 0xfffffffffffff000
and rdx, 0xfffffffffffff000
mov qword [rsp + 0x18], rdx
mov r8d, dword [rsp + 4]
mov dword [rsp + 4], r8d
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
cmp word [rax], 0x5a4d
je 0x1400047ca
jmp 0x140004801
mov rax, qword [rsp + 0x10]
add rsp, 0x28
ret

Function at 0x140004860
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x37], 0x66
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x30], 0x70aa72f8
mov rdx, rax
xor rdx, 0x2c4ae713
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x1c], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 8], rax
jmp 0x1400048a2
mov eax, dword [rsp + 0x2c]
add rsp, 0x48
ret
mov eax, 0x66f7454c
mov ecx, eax
mov rdx, qword [rsp + 8]
xor rdx, 0x1014ff62
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 8]
mov qword [rsp], rcx
mov rcx, rdx
mov r8, qword [rsp]
shl r8, cl
mov qword [rsp + 0x38], r8
mov eax, dword [rsp + 0x1c]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x2c]
mov r8d, eax
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x1c], 0x2734dc11
or rdx, 0x5e800aad
mov qword [rsp + 0x38], rdx
cmp eax, 0x73774b30
ja 0x1400048a2
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 8]
shl rax, cl
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 8]
imul rdx, rax, 0x2288805
mov cl, byte [rsp + 0x37]
xor cl, 0x66
mov r8, qword [rsp + 0x20]
mov r9, qword [rsp + 0x10]
mov r10b, byte [r9 + r8]
mov qword [rsp + 0x38], rdx
mov r11d, dword [rsp + 0x2c]
add r11d, 1
mov dword [rsp + 0x1c], r11d
xor rax, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
cmp r10b, cl
je 0x140004899
jmp 0x1400048a2
Function at 0x14003f3b6
Capabilities:
Parse pe header

Disassembly:
jmp 0x140065f4c
xor r8d, r8d
xor edx, edx
jmp 0x140065c3c

Function at 0x1400401bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1400455f0
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400df300]
xor rax, rbp
mov qword [rbp + 0x188], rax
lea rcx, [0x1400eb0a4]
call fcn.140041e5e
nop
mov byte [rbp + 0x24], 0xf
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
mov byte [rbp + 0x68], 0x4e
mov byte [rbp + 0x69], 0x74
mov byte [rbp + 0x6a], 0x4f
mov byte [rbp + 0x6b], 0x70
mov byte [rbp + 0x6c], 0x65
mov byte [rbp + 0x6d], 0x6e
mov byte [rbp + 0x6e], 0x50
mov byte [rbp + 0x6f], 0x72
mov byte [rbp + 0x70], 0x6f
mov byte [rbp + 0x71], 0x63
mov byte [rbp + 0x72], 0x65
mov byte [rbp + 0x73], 0x73
mov byte [rbp + 0x74], 0x73
mov byte [rbp + 0x75], 0
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x98], rax
mov dword [rbp + 0xb4], 0
jmp 0x1400456b2
mov eax, dword [rbp + 0xb4]
inc eax
mov dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 0x40
jge 0x1400456f4
movsxd rax, dword [rbp + 0xb4]
mov rcx, qword [rbp + 0x98]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rbp + 0x24]
cmp eax, ecx
jne 0x1400456f2
movsxd rax, dword [rbp + 0xb4]
mov rcx, qword [rbp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [0x1400e04c0], rax
jmp 0x1400456f4
jmp 0x1400456a4
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400c7f70]
call fcn.14004162f
mov eax, edi
mov rcx, qword [rbp + 0x188]
xor rcx, rbp
call fcn.140040680
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret