joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012eb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov rsi, rcx
movups xmm0, xmmword [rdx + 0x38]
movups xmm1, xmmword [rdx + 0x48]
movaps xmmword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rax, qword [rdx + 0x28]
movzx ebx, byte [rdx + 0x30]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], bl
movzx eax, byte [0x14005a181]
mov ecx, 0x5f0
mov edx, 8
call fcn.140003aa0
test rax, rax
mov qword [rbp - 8], r14
je 0x140013120
mov rdi, rax
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [r14 + 0x60]
mov qword [rbp - 0x18], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
movabs r11, 0x800000000000000
mov r12d, 1
lock xadd qword [0x14005a1a8], r12
mov r14, r12
xor r14, rcx
lea r15, [r14 + rdx]
mov rax, r14
rol rax, 0x10
xor rax, r15
lea r15, [rax + r8]
rol rax, 0x15
add r14, r9
mov r13, r14
xor r13, r10
rol r14, 0x20
xor r12, r15
add r12, r13
rol r13, 0xd
xor r15, r11
xor r13, r12
rol r12, 0x20
xor r15, rax
add r14, r15
rol r15, 0x10
xor r15, r14
add r12, r15
rol r15, 0x15
add r14, r13
rol r13, 0x11
xor r15, r12
xor r13, r14
rol r14, 0x20
xor r12, r11
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
xor r14, 0xff
add r14, r15
rol r15, 0x10
xor r15, r14
add r12, r15
rol r15, 0x15
add r14, r13
rol r13, 0x11
xor r13, r14
rol r14, 0x20
xor r15, r12
add r12, r13
rol r13, 0xd
xor r13, r12
rol r12, 0x20
add r14, r15
rol r15, 0x10
xor r15, r14
add r12, r15
rol r15, 0x15
add r14, r13
rol r13, 0x11
xor r13, r14
rol r14, 0x20
xor r15, r12
add r12, r13
rol r13, 0xd
add r14, r15
rol r15, 0x10
xor r15, r14
rol r15, 0x15
xor r13, r12
add r14, r13
rol r13, 0x11
mov r12, r14
rol r12, 0x20
xor r12, r13
xor r12, r15
xor r12, r14
je 0x140012f70
mov rcx, qword [rbp - 8]
mov rax, qword [rcx + 0x58]
movaps xmm0, xmmword [rbp - 0x40]
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x128], xmm1
movups xmmword [rsi + 0x118], xmm0
mov rdx, qword [rbp - 0x10]
mov qword [rsi + 0x138], rdx
mov byte [rsi + 0x140], bl
mov qword [rsi], 0
mov qword [rsi + 8], rdi
mov qword [rsi + 0x80], 0
mov qword [rsi + 0x88], rdi
mov rdx, qword [rbp - 0x18]
mov qword [rsi + 0x100], rdx
mov qword [rsi + 0x108], r12
mov qword [rsi + 0x110], rax
mov rdx, qword [rcx + 0x10]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x14001310c
test rdx, rdx
je 0x14001310c
mov rcx, qword [rcx + 0x18]
mov r8d, 1
call fcn.140003ab0
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x5f0
call fcn.140040550
ud2
Function at 0x14001a440
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rcx
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x14001a4b5
cmp rax, 1
jne 0x14001a4f2
test rsi, rsi
je 0x14001a537
js 0x14001a63f
mov r14, rdx
movzx ebp, byte [r9]
movzx eax, byte [0x14005a181]
mov ebx, 1
mov edx, 1
mov rcx, rsi
call fcn.140003aa0
test rax, rax
je 0x14001a641
cmp rsi, 8
mov rcx, r14
jae 0x14001a55d
xor edx, edx
jmp 0x14001a610
test rsi, rsi
je 0x14001a541
js 0x14001a64c
mov r15, rdx
movzx eax, byte [0x14005a181]
mov r14d, 1
mov edx, 1
mov rcx, rsi
call fcn.140003aa0
test rax, rax
je 0x14001a64f
mov rbx, rax
mov rdx, r15
jmp 0x14001a546
add rsi, rdx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14001a8b0
jmp 0x14001a62f
mov eax, 1
jmp 0x14001a624
mov ebx, 1
mov rcx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
jmp 0x14001a62b
movzx r8d, bpl
cmp rsi, 0x20
jae 0x14001a56b
xor edx, edx
jmp 0x14001a5c6
movabs rdx, 0x7fffffffffffffe0
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r9d, r9d
nop
movdqu xmm1, xmmword [rcx + r9]
movdqu xmm2, xmmword [rcx + r9 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rax + r9], xmm1
movdqu xmmword [rax + r9 + 0x10], xmm2
add r9, 0x20
cmp rdx, r9
jne 0x14001a590
cmp rdx, rsi
je 0x14001a624
test sil, 0x18
je 0x14001a610
mov r9, rdx
movabs rdx, 0x7ffffffffffffff8
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rcx + r9]
pxor xmm1, xmm0
movq qword [rax + r9], xmm1
add r9, 8
cmp rdx, r9
jne 0x14001a5f0
cmp rdx, rsi
je 0x14001a624
nop
movzx r8d, byte [rcx + rdx]
xor r8b, bpl
mov byte [rax + rdx], r8b
inc rdx
cmp rsi, rdx
jne 0x14001a610
mov qword [rdi], rsi
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rsi
mov rax, rdi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebx, ebx
mov rcx, rbx
mov rdx, rsi
call fcn.140040530
xor r14d, r14d
mov rcx, r14
mov rdx, rsi
call fcn.140040530
int3
Function at 0x14001af60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rcx
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x14001afd5
cmp rax, 1
jne 0x14001b012
test rsi, rsi
je 0x14001b057
js 0x14001b15f
mov r14, rdx
movzx ebp, byte [r9]
movzx eax, byte [0x14005a181]
mov ebx, 1
mov edx, 1
mov rcx, rsi
call fcn.140003aa0
test rax, rax
je 0x14001b161
cmp rsi, 8
mov rcx, r14
jae 0x14001b07d
xor edx, edx
jmp 0x14001b130
test rsi, rsi
je 0x14001b061
js 0x14001b16c
mov r15, rdx
movzx eax, byte [0x14005a181]
mov r14d, 1
mov edx, 1
mov rcx, rsi
call fcn.140003aa0
test rax, rax
je 0x14001b16f
mov rbx, rax
mov rdx, r15
jmp 0x14001b066
add rsi, rdx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14001b430
jmp 0x14001b14f
mov eax, 1
jmp 0x14001b144
mov ebx, 1
mov rcx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
jmp 0x14001b14b
movzx r8d, bpl
cmp rsi, 0x20
jae 0x14001b08b
xor edx, edx
jmp 0x14001b0e6
movabs rdx, 0x7fffffffffffffe0
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r9d, r9d
nop
movdqu xmm1, xmmword [rcx + r9]
movdqu xmm2, xmmword [rcx + r9 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rax + r9], xmm1
movdqu xmmword [rax + r9 + 0x10], xmm2
add r9, 0x20
cmp rdx, r9
jne 0x14001b0b0
cmp rdx, rsi
je 0x14001b144
test sil, 0x18
je 0x14001b130
mov r9, rdx
movabs rdx, 0x7ffffffffffffff8
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rcx + r9]
pxor xmm1, xmm0
movq qword [rax + r9], xmm1
add r9, 8
cmp rdx, r9
jne 0x14001b110
cmp rdx, rsi
je 0x14001b144
nop
movzx r8d, byte [rcx + rdx]
xor r8b, bpl
mov byte [rax + rdx], r8b
inc rdx
cmp rsi, rdx
jne 0x14001b130
mov qword [rdi], rsi
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rsi
mov rax, rdi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebx, ebx
mov rcx, rbx
mov rdx, rsi
call fcn.140040530
xor r14d, r14d
mov rcx, r14
mov rdx, rsi
call fcn.140040530
int3
Function at 0x140020790
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rcx
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x140020805
cmp rax, 1
jne 0x140020842
test rsi, rsi
je 0x140020887
js 0x14002098f
mov r14, rdx
movzx ebp, byte [r9]
movzx eax, byte [0x14005a181]
mov ebx, 1
mov edx, 1
mov rcx, rsi
call fcn.140003aa0
test rax, rax
je 0x140020991
cmp rsi, 8
mov rcx, r14
jae 0x1400208ad
xor edx, edx
jmp 0x140020960
test rsi, rsi
je 0x140020891
js 0x14002099c
mov r15, rdx
movzx eax, byte [0x14005a181]
mov r14d, 1
mov edx, 1
mov rcx, rsi
call fcn.140003aa0
test rax, rax
je 0x14002099f
mov rbx, rax
mov rdx, r15
jmp 0x140020896
add rsi, rdx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14001fd60
jmp 0x14002097f
mov eax, 1
jmp 0x140020974
mov ebx, 1
mov rcx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
jmp 0x14002097b
movzx r8d, bpl
cmp rsi, 0x20
jae 0x1400208bb
xor edx, edx
jmp 0x140020916
movabs rdx, 0x7fffffffffffffe0
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r9d, r9d
nop
movdqu xmm1, xmmword [rcx + r9]
movdqu xmm2, xmmword [rcx + r9 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rax + r9], xmm1
movdqu xmmword [rax + r9 + 0x10], xmm2
add r9, 0x20
cmp rdx, r9
jne 0x1400208e0
cmp rdx, rsi
je 0x140020974
test sil, 0x18
je 0x140020960
mov r9, rdx
movabs rdx, 0x7ffffffffffffff8
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rcx + r9]
pxor xmm1, xmm0
movq qword [rax + r9], xmm1
add r9, 8
cmp rdx, r9
jne 0x140020940
cmp rdx, rsi
je 0x140020974
nop
movzx r8d, byte [rcx + rdx]
xor r8b, bpl
mov byte [rax + rdx], r8b
inc rdx
cmp rsi, rdx
jne 0x140020960
mov qword [rdi], rsi
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rsi
mov rax, rdi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebx, ebx
mov rcx, rbx
mov rdx, rsi
call fcn.140040530
xor r14d, r14d
mov rcx, r14
mov rdx, rsi
call fcn.140040530
int3
Function at 0x140021840
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
mov edx, 8
call sub.advapi32.dll_SystemFunction036
mov rax, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x1400240a0
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x1400240e0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140024180
jmp 0x14002416f
jae 0x14002423f
cmp r8, 0x201
jae 0x140024180
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x1400241d7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1400241af
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14003f7b0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140024200
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400242ab
mov r8d, r13d
cmp r12, r8
jne 0x140024160
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400242df
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14002416f
jmp 0x140024180
cmp r14, r8
jb 0x1400242f9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140026850
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140024294
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140003ab0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14002427f
jmp 0x140024294
lea rcx, str.internal_error:_entered_unreachable_code_rustc_051478957371ee0084a7c0913941d2a8c4757bb9library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140040790
jmp 0x14002430e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140040b40
ud2
Function at 0x14002b7c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140047318]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14002b7f8
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14002b856
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14002b883
test eax, eax
js 0x14002b862
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14002b879
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.1400264f0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140022620
mov ecx, 7
int 0x29
ud2

Function at 0x14002c2c0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x14005a181]
mov ecx, 0x10
mov edx, 8
call fcn.140003aa0
test rax, rax
je 0x14002c3ab
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14002c460]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov edx, esi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14002c39d
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], rbx
mov dword [rbp - 0x20], ebx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rax]
test rax, rax
je 0x14002c35a
mov rcx, qword [rbp - 0x18]
call rax
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14002c374
mov r8, qword [rax + 0x10]
call fcn.140003ab0
mov edx, 0x10
mov r8d, 8
mov rcx, qword [rbp - 0x20]
loopne 0x14002c36c
sub byte [rdi - 3], dh
invalid
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
or edx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
jge 0x14002c39b
mov ecx, 8
mov edx, 0x10
add byte [rax], al
add al, ch
mov es, word [rcx + 1]
add byte [rdi], cl
invalid
Function at 0x140039ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x140039b4a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140039b40
cmp r11, r10
ja 0x140039bc6
cmp r10, rdx
ja 0x140039bd8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x140039b42
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140039b20
jmp 0x140039ba7
ja 0x140039b4a
mov r11, r10
cmp rax, r8
jne 0x140039ae7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x140039bab
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140039b80
mov r8, r10
sub ecx, r9d
jns 0x140039b9e
jmp 0x140039bad
cmp r10, rdx
je 0x140039bba
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140039bad
xor al, 1
cmp r8, rdx
jne 0x140039b60
jmp 0x140039bad
xor eax, eax
jmp 0x140039bad
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140040650
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140040bb0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140040b40
int3

Function at 0x14003bc98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14003bce2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003bce2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003bce2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003bce2
cmp dword [rcx + 0x84], 0xe
jbe 0x14003bce2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003bce4
xor al, al
add rsp, 0x28
ret
Function at 0x1414de058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1414de1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1414de089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414de06f
add dl, dl
jne 0x1414de096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414de0f6
xor eax, eax
add dl, dl
jne 0x1414de0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414de1ad
add dl, dl
jne 0x1414de0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414de0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414de0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414de0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1414de0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1414de07e
mov eax, 1
add dl, dl
jne 0x1414de106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414de113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414de0fb
sub eax, ebx
mov ebx, 1
jne 0x1414de14c
mov ecx, 1
add dl, dl
jne 0x1414de12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1414de13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414de123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414de07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1414de168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1414de175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414de15d
cmp eax, 0x7d00
jae 0x1414de19b
cmp eax, 0x500
jb 0x1414de196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414de07e
cmp eax, 0x7f
ja 0x1414de19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414de07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1414de1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1414de07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180343058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1803431df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180343089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18034306f
add dl, dl
jne 0x180343096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1803430f6
xor eax, eax
add dl, dl
jne 0x1803430a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1803431ad
add dl, dl
jne 0x1803430b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1803430c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1803430d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1803430dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1803430ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18034307e
mov eax, 1
add dl, dl
jne 0x180343106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180343113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1803430fb
sub eax, ebx
mov ebx, 1
jne 0x18034314c
mov ecx, 1
add dl, dl
jne 0x18034312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18034313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180343123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18034307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180343168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180343175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18034315d
cmp eax, 0x7d00
jae 0x18034319b
cmp eax, 0x500
jb 0x180343196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18034307e
cmp eax, 0x7f
ja 0x18034319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18034307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1803431d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18034307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011118
Capabilities:
Terminate process

Disassembly:
jmp 0x140011aa0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400430ab]
call fcn.14001149c
nop
cmp qword [rbp + 0xe8], 0
je 0x140011af2
cmp qword [rbp + 0xe8], 0xffffffffffffffff
je 0x140011af2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xe8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax + 8], 0
je 0x140011b12
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0xe0]
cmp qword [rax], 0
je 0x140011b46
mov edx, 0xffffffff
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret