joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006dd0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe0
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x88], 0
mov byte [rsp + 0x80], 0
mov dword [rsp + 0x84], 0xc00000bb
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb8], 0x240
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xa0]
mov edx, 0x110000
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0
jge 0x140006f16
mov eax, dword [rsp + 0x84]
jmp 0x140006ffd
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov edx, 0x110000
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
mov dword [rsp + 0x84], eax
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
cmp dword [rsp + 0x84], 0
jl 0x140006f78
cmp qword [rsp + 0x88], 0
jne 0x140006f81
mov eax, dword [rsp + 0x84]
jmp 0x140006ffd
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140006fc7
mov rax, qword [rsp + 0x98]
mov qword [rax + 0x10], 0
xor edx, edx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
mov byte [rsp + 0x80], al
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x140006ff6
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x84]
add rsp, 0xe0
pop rdi
ret

Function at 0x140007010
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
movsx eax, byte [rax + 0x43]
mov rcx, qword [rsp + 0x40]
movsx ecx, byte [rcx + 0x42]
inc ecx
movsx ecx, cl
cmp eax, ecx
jg 0x140007045
mov rax, qword [rsp + 0x40]
movsx eax, word [rax]
cmp eax, 6
je 0x140007067
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x12d
mov rdx, qword [rsp + 0x40]
mov ecx, 0x44
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
movzx edx, byte [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
add rsp, 0x38
ret
Function at 0x14000ea30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x100]
mov byte [rsp], al
mov rax, qword [rsp + 0x38]
movzx eax, byte [rax + 0x101]
mov byte [rsp + 1], al
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov dword [rsp + 4], 0
jmp 0x14000ea94
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 4], eax
jae 0x14000eb80
movzx eax, byte [rsp]
inc eax
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov byte [rsp], al
movzx eax, byte [rsp]
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 1]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov byte [rsp + 1], al
movzx eax, byte [rsp]
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
mov byte [rsp + 2], al
movzx eax, byte [rsp + 1]
movzx ecx, byte [rsp]
mov rdx, qword [rsp + 8]
mov r8, qword [rsp + 8]
movzx eax, byte [r8 + rax]
mov byte [rdx + rcx], al
movzx eax, byte [rsp + 1]
mov rcx, qword [rsp + 8]
movzx edx, byte [rsp + 2]
mov byte [rcx + rax], dl
movzx eax, byte [rsp]
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 1]
mov rdx, qword [rsp + 8]
movzx ecx, byte [rdx + rcx]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov byte [rsp + 3], al
mov eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x28]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 3]
mov rdx, qword [rsp + 8]
movzx ecx, byte [rdx + rcx]
xor eax, ecx
mov ecx, dword [rsp + 4]
mov rdx, qword [rsp + 0x20]
mov byte [rdx + rcx], al
jmp 0x14000ea8a
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp]
mov byte [rax + 0x100], cl
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 1]
mov byte [rax + 0x101], cl
add rsp, 0x18
ret
Function at 0x140010320
Capabilities:
Access pe header
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov dword [rsp + 0x30], 0xc00000bb
lea rax, [rsp + 0x180]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x3b8]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1400103a7
mov eax, 0xc000012f
jmp 0x1400104ec
cmp qword [rsp + 0x3b0], 0
je 0x14001042c
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
cmp word [rax + rcx*2], 0
jne 0x1400103c8
mov rax, qword [rsp + 0x38]
test rax, rax
jbe 0x14001042c
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400111d0]
mov r8d, 0x104
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x68]
call fcn.140002700
mov rdx, qword [rsp + 0x3b0]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jmp 0x1400104b3
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x50]
mov rdx, qword [rsp + 0x3b8]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlComputeCrc32]
mov dword [rsp + 0x48], eax
mov r8d, dword [rsp + 0x48]
mov edx, 0x80
lea rcx, [rsp + 0x80]
call fcn.1400101c0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x1400111d0]
mov r8d, 0x104
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x68]
call fcn.140002700
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x28]
add rax, qword [rsp + 0x3b8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x3b8]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000f900
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.140010a90
add rsp, 0x3a0
pop rdi
ret

Function at 0x140010510
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x84], 3
jbe 0x14001058b
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x10], rax
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x20]
mov eax, dword [rdx + rax + 0x8c]
mov dword [rcx + 0x18], eax
add rsp, 0x38
ret
Function at 0x140010590
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x20], 0xc000000d
mov qword [rsp + 0x38], 0
cmp qword [rsp + 0x60], 0
je 0x1400105f3
cmp qword [rsp + 0x70], 0
je 0x1400105f3
cmp qword [rsp + 0x68], 0
je 0x1400105f3
cmp dword [rsp + 0x78], 0
jne 0x1400105fd
mov eax, 0xc000000d
jmp 0x14001073f
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rax, 0x10
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 4]
mov ecx, dword [rsp + 0x78]
sub rcx, 0x10
cmp rax, rcx
je 0x140010634
mov eax, 0xc0000206
jmp 0x14001073f
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax + 4]
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlComputeCrc32]
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + 0xc], eax
je 0x14001065e
mov eax, 0xc0000470
jmp 0x14001073f
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
mov ecx, eax
call fcn.1400107b0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140010683
mov eax, 0xc000009a
jmp 0x14001073f
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx]
mov r9d, eax
mov r8, qword [rsp + 0x40]
mov edx, ecx
mov rcx, qword [rsp + 0x30]
call fcn.140007120
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140007100
test eax, eax
je 0x1400106c5
mov dword [rsp + 0x20], 0xc0000206
jmp 0x14001072a
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
cmp rax, qword [rsp + 0x38]
je 0x1400106df
mov dword [rsp + 0x20], 0xc0000206
jmp 0x14001072a
mov rax, qword [rsp + 0x28]
mov r8d, dword [rax]
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlComputeCrc32]
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + 8], eax
je 0x14001070a
mov dword [rsp + 0x20], 0xc0000470
jmp 0x14001072a
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jge 0x14001073b
mov rcx, qword [rsp + 0x30]
call fcn.1400107f0
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret
Function at 0x140f7b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f7b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f7b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f7b06f
add dl, dl
jne 0x140f7b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f7b0f6
xor eax, eax
add dl, dl
jne 0x140f7b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f7b1ad
add dl, dl
jne 0x140f7b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f7b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f7b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f7b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f7b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f7b07e
mov eax, 1
add dl, dl
jne 0x140f7b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f7b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f7b0fb
sub eax, ebx
mov ebx, 1
jne 0x140f7b14c
mov ecx, 1
add dl, dl
jne 0x140f7b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f7b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f7b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f7b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f7b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f7b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f7b15d
cmp eax, 0x7d00
jae 0x140f7b19b
cmp eax, 0x500
jb 0x140f7b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f7b07e
cmp eax, 0x7f
ja 0x140f7b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f7b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f7b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f7b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0xc1ce8c
Capabilities:
Encode data using base64

Disassembly:
jl 0xc1ef78
mov qword [rsp + 0x28], rsi
nop
bt ebx, 0x9f
cmp r9, r13
jmp 0x1893ec3
inc r9
cmp ecx, 5
jmp 0xc1ce8c
add rbx, 0xc
jmp 0x1895da9
je 0xc1cc0d
movzx eax, byte [r9]
shl edi, 8
jmp 0x1895dae
call fcn.01805306
inc ecx
test spl, dil
or edi, eax
jmp 0x17f6ffc

Function at 0x17e6c31
Capabilities:
Encode data using base64

Disassembly:
mov qword [rdi], rax
jb 0x187a385
call fcn.00c1eef4
rol dword [rsp + 0x4c], 0x24
lea rdi, [rsp + rdi + 0x68]
push 0xffffffffed0f7728
jae 0x17ef7e2
invalid
jae 0xc1eee6
insb byte [rdi], dx
cmp al, 0x79
rcr dword [rbx + 0x13], 0x76
invalid
call fcn.0186fa3a
mul byte [rsi + 0x31791ba3]
push rsp
in al, dx
outsb dx, byte [rsi]
sbb dword [r9 - 0x1d], r10d
sahf
or al, 0x44
test eax, 0x4eeba311
invalid
mov r11d, 0x4d8f7422
call fcn.017ffcb0
add rax, rax
add rdx, rsp
sal rax, 0x55
mov eax, dword [rdx + riz]
jbe 0x1805f61
jmp 0x186d0ce

Function at 0x17f0b0a
Capabilities:
Encode data using base64

Disassembly:
mov rbp, qword [rbp + riz - 8]
mov ebx, 0x19bcec91
pop r8
mov qword [rbx + rbp - 0x19bcec91], rax
not ebx
mov rbx, rbp
mov r10d, 0xdc87d726
push r10
call fcn.017e280d
Function at 0x17ffa00
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffab371933
push 0xffffffffe19fd9a0
lea rsp, [rsp + 0x30]
jmp fcn.017fc4e4
call fcn.017e858a
call fcn.0187b158
call fcn.01884313
je 0xc21797
int1
js 0xc21773
scasd eax, dword [rdi]
int3
iretd
stosb byte [rdi], al
push rcx
cld
lodsb al, byte [rsi]
in al, 0x21
loopne 0xc217f0
jge 0xc217b5
push rcx
sbb dword [rsp + rdx*4], ebp
mov es, esi
push rbx
jmp 0xc217ac
xor al, 0x8c
push rsi
invalid
mov dl, 0x41
cmp al, 0xc4
out dx, eax
out dx, al
invalid
movsd dword [rdi], dword [rsi]
pop rsi
rol r11, 0x8b
inc byte [rsi - 0x7c]
int3
not byte [rsp + 0x12]
lea rsp, [rsp + 0x18]
jae fcn.017fc4e4
push 0x7536cc8c
not qword [rsp]
mov ax, word [rbx + 2]
jmp 0x186dfe8
and rbp, rcx
not dword [rsp + 3]
push 0xffffffff9b82dc82
push 0xfffffffffe9539b5
not rbp
push 0xfffffffff3039f12
mov qword [rbx], rbp
jmp 0xc1e5a7
xor r10w, dx
mov qword [rsp], 0x7fa8ea2f
inc qword [rsp + 0x10]
shr word [rsp + 0x12], 1
lea rdx, [rsp + rdx + 0x18]
jg 0x187d8b8
mov cl, byte [rbx + 4]
inc word [rsp + 5]
add rbx, 4
rol dword [rsp + 1], 0x71
shld r9w, ax, cl
jmp 0xc2086a
neg word [rsp + 3]
jb 0x17e78fc
mov edx, 0xaa80388d
movzx dx, byte [rbx + riz]
mov eax, 0xebb9001a
sub al, 0x28
mov al, byte [rbx + riz + 2]
jb 0xc21756
invalid
jae 0x18955cd
mov r11d, 0xf910a519
and r11w, r11w
movzx r11w, byte [rbx + riz]
mov ecx, 0x328985b8
push rcx
mov cl, byte [rcx + rbx - 0x328985b6]
adc rbx, 2
push 0xffffffffaa1a9f9b
call fcn.0186cb5a
xor r9b, r10b
call 0x188ccc7
mov r11d, 0x521bc187
lea rax, [r11 + r11 - 0x2a70c45c]
or ax, 0x161f
mov r11d, dword [rbx + r11 - 0x521bc187]
adc al, ah
mov eax, dword [rbx + rax - 0x79c6be79]
imul r11d
call fcn.017fbd5d
sub r8, 2
call fcn.01800b5a
pop rbp
or eax, 0xfcee2190
movabs dword [0x8ad860a5eda72def], eax
ret 0xc77f
jns 0x187f698
push 0x187223
mov r11d, 0xa4157887
mov r11, qword [rbx + riz]
jmp 0x189321a
mov byte [rdx], bpl
jns 0xc21928
test dword [rcx - 0x47], 0xa9bb0583
mov ebp, 0xbf98bda8
mov ebp, dword [rbx + riz]
add rbx, 4
sub r8, 1
push r9
and r9, 0xfffffffff7b53e82
sal dword [rsp + 4], 0x82
movzx r9d, byte [r8 + riz]
jp 0x1878057
mov rcx, qword [rbx + 8]
push 0x1d8ae1a0
add rbx, 8
jmp 0x1876f1a
call fcn.00c1e541
je 0x187a80d
mov r9w, word [rbx]
jmp 0x17e451f

Function at 0x187f6ec
Capabilities:
Encode data using base64

Disassembly:
push 0x1f9bf1a4
shl qword [rsp], 0x2d
cmp ebx, 4
lea rsp, [rsp + 8]
jne 0x17ec60b
mov r9d, 0x863b3c04
bswap r9d
push r9
mov r9, rax
jmp 0x17e9e03
call 0x1892c72
mov eax, 0x2c1d46b8
xor ax, 0x950a
mov rax, qword [rbp + rbx*8 + 0x20]
push rax
lea rsp, [rsp + 8]
jne 0x17e1bbd
mov r8d, 0xf89ea63d
lea r8, [r8 + r8*2 - 0x3ec571ca]
jmp 0x188a7a8
dec ebx
jmp 0x189d226
cmp ebx, 3
jmp 0x17eca8b
jne 0x17f107e
Function at 0x1415aa058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1415aa1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1415aa089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415aa06f
add dl, dl
jne 0x1415aa096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415aa0f6
xor eax, eax
add dl, dl
jne 0x1415aa0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415aa1ad
add dl, dl
jne 0x1415aa0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415aa0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415aa0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415aa0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1415aa0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1415aa07e
mov eax, 1
add dl, dl
jne 0x1415aa106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415aa113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415aa0fb
sub eax, ebx
mov ebx, 1
jne 0x1415aa14c
mov ecx, 1
add dl, dl
jne 0x1415aa12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415aa13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415aa123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415aa07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1415aa168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415aa175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415aa15d
cmp eax, 0x7d00
jae 0x1415aa19b
cmp eax, 0x500
jb 0x1415aa196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415aa07e
cmp eax, 0x7f
ja 0x1415aa19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415aa07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1415aa1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1415aa07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400053ac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000519c
Function at 0x140007db4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140007e3b
mov rsi, rbx
cmp word [rax], bp
je 0x140007dfa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140007de4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140007de0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400087ac
mov rdi, rax
test rax, rax
je 0x140007e28
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140002b40
mov rbp, rdi
xor ecx, ecx
call fcn.140006adc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1805ec058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1805ec1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1805ec089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805ec06f
add dl, dl
jne 0x1805ec096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805ec0f6
xor eax, eax
add dl, dl
jne 0x1805ec0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1805ec1ad
add dl, dl
jne 0x1805ec0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805ec0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805ec0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805ec0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1805ec0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1805ec07e
mov eax, 1
add dl, dl
jne 0x1805ec106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1805ec113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805ec0fb
sub eax, ebx
mov ebx, 1
jne 0x1805ec14c
mov ecx, 1
add dl, dl
jne 0x1805ec12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805ec13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805ec123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805ec07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1805ec168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1805ec175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1805ec15d
cmp eax, 0x7d00
jae 0x1805ec19b
cmp eax, 0x500
jb 0x1805ec196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805ec07e
cmp eax, 0x7f
ja 0x1805ec19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1805ec07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1805ec1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1805ec07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180729bbd
Capabilities:
Encode data using xor

Disassembly:
push 0x3c2548ab
mov dword [r10], r9d
lea rsp, [rsp + 0x10]
jmp fcn.18070ba37
movzx r11d, byte [rdi + r9 - 0x438c970a]
mov qword [rsp + r9 - 0x438c970a], r9
sal r9, 0xa0
xchg qword [rsp], r9
xor r11b, bpl
sub r9b, r9b
jbe 0x180736504
mov r8d, 0x6abdbd1b
mov r10, qword [r8 + r11 - 0x6abdbd1b]
mov r8, qword [r11 + r8 - 0x6abdbd13]
add r11, 0xc
push 0xffffffffa6141f2a
jmp 0x18071cb4e
not r11b
neg r11b
inc qword [rsp + r9 - 0x438c9700]
ror r11b, 1
and byte [rsp + r9 - 0x438c96fd], 0x92
sar qword [rsp + r9 - 0x438c9700], 0x99
dec r11b
rol r11b, 1
dec r11b
xor bpl, r11b
lea r11, [rsp + r11 + 8]
mov r9d, dword [r9 + r11 - 0x438c9700]
jmp 0x180741811
sub r10, 4
jmp 0x18070f443
Function at 0x140005210
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400052aa
cmp byte [rcx + 0x71], 0
je 0x1400052aa
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000526c
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140005270
sub eax, 1
je 0x140005274
sub eax, 2
je 0x1400052aa
xor al, al
jmp 0x1400052ac
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1400052a1
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.1400a11e4
cmp rdi, rax
jne 0x14000526c
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400052ac
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret