joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400060a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.YABbHTGvIdvqqekKNEjaXOhtzDjgVWpaqmeOsMSElfbUKxDbUwmKzEnedkDkgzcnHVjySsRHInvoxEdWSCZmbDBdoTywKQPvhbTURiFHpEQykrUJHanLAnBQMiVjVylUxkWUaESsAKNWsDwUfHUFGgIHPQzwdOUzWSNUstygaNhzfTxwtktIpTCpcBqaWZoxTvvVJuTIIQigCMOGutwzYFRxLULBYtoMintviaqyVjjiCcZHhMFjSFrFCLyTMlrfrGkuJkgaGbIncDZvaQhCwvdJGKMbddlecdPGDsoaaiupeCiaYuNqXnPMJtbVFsdCtqyhUsuEjVdumlJhDBgpTHynJTCLvdSDulvONqgEglYNkWbDgdeNIVHiVVxizsCLbRHtpCJlgxCBvcidRCrlhTnfbbcgmHbXvqMlLLGhTBurtquKanWk
mov r10, rax
sub rbx, rax
movabs rdi, 0x95f7cc72d1b887e9
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1b5
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x1400060f0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000be40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000c06e
mov word [rbp + 0x50], 0x4159
mov word [rbp + 0x58], 0x4159
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000bef4
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000bee0
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000bf25
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000bf10
cmp rdi, rbx
jne 0x14000c042
mov r13, rsi
mov word [rbp - 0x50], 0x4159
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000bf66
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001620
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000bf52
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000c068
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x410038
call fcn.1400031f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000bfd8
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x410023
call fcn.1400031f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000bfd8
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x410038
mov dword [rbp - 0x42], 0x410018
call fcn.1400031f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400031f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x410038
call fcn.1400031f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000c035
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x410023
call fcn.1400031f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000c035
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x410038
mov dword [rbp - 0x32], 0x410018
call fcn.1400031f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400031f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000c042
inc r14
jmp 0x14000bf40
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000c06e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000beb0
mov rax, qword [rbp - 8]
jmp 0x14000c070
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x14000c4e0
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0xf8
call fcn.14000a380
movdqa xmm0, xmmword [0x14000f140]
lea rcx, [rbp - 0x59]
movdqa xmm1, xmmword [str._1661__fe_r7J_]
xor ebx, ebx
movdqu xmmword [rbp - 0x59], xmm0
mov qword [rbp + 0x6f], rbx
movdqa xmm0, xmmword [0x14000f0d0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp + 0x67], ebx
movdqu xmmword [rbp - 0x49], xmm1
mov word [rbp - 0x29], 0x421
mov byte [rbp - 0x27], 0x6d
call fcn.140002230
mov rdx, rax
xor r9d, r9d
lea rax, [rbp + 0x67]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rcx, 0xffffffff80000001
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14000c6e3
mov rcx, qword [rbp + 0x6f]
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xd0], r15
call fcn.14000c6f0
mov eax, 0x6a
mov dword [rbp - 0x59], 0x250018
lea rcx, [rbp - 0x59]
mov word [rbp - 0x35], ax
mov dword [rbp - 0x55], 0x2d
mov dword [rbp - 0x51], 0x74002d
mov dword [rbp - 0x4d], 0x190001
mov dword [rbp - 0x49], 0x100027
mov dword [rbp - 0x45], 0x210056
mov dword [rbp - 0x41], 0x60010
mov dword [rbp - 0x3d], 0x2a0000
mov dword [rbp - 0x39], 0x200029
call fcn.140001b30
lea rcx, [rbp - 0x25]
mov dword [rbp - 0x25], 0x29000d
mov rbx, rax
mov dword [rbp - 0x21], 0x420027
mov dword [rbp - 0x1d], 0x3b002e
mov dword [rbp - 0x19], 0x20029
mov dword [rbp - 0x15], 0x44003a
mov dword [rbp - 0x11], 0x100001
mov dword [rbp - 0xd], 0x450002
mov dword [rbp - 9], 0x3e0018
mov dword [rbp - 5], 0x26002d
mov dword [rbp - 1], 0x12000f
mov dword [rbp + 3], 0x29002b
mov dword [rbp + 7], 0x18001d
mov dword [rbp + 0xb], 0x3d0016
mov dword [rbp + 0xf], 0xe004a
mov dword [rbp + 0x13], 0x240038
mov dword [rbp + 0x17], 4
mov dword [rbp + 0x1b], 0x1001d
mov dword [rbp + 0x1f], 0x2b0000
mov dword [rbp + 0x23], 0x4d005d
call fcn.140001eb0
mov r9d, 0x40
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r15, qword [rsp + 0xd0]
mov al, 1
mov r14, qword [rsp + 0xd8]
mov r13, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x120]
add rsp, 0xf8
pop rbx
pop rbp
ret
xor al, al
add rsp, 0xf8
pop rbx
pop rbp
ret
Function at 0x14000ce60
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x76
mov dword [rbp - 0x20], 0x40012
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2c0010
mov dword [rbp - 0x18], 0x18000d
mov dword [rbp - 0x14], 0x370005
mov dword [rbp - 0x10], 0x21001a
call fcn.1400060a0
mov rcx, rax
call 0x14000ce60
mov qword [0x140025670], rax
lea rcx, [rbp - 0x20]
mov eax, 0x49
mov dword [rbp - 0x20], 0x40012
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2c0010
mov dword [rbp - 0x18], 0x18000d
mov dword [rbp - 0x14], 0x440074
call fcn.140005eb0
mov rcx, rax
call 0x14000ce60
lea rcx, [rbp - 0x20]
mov qword [0x140025660], rax
mov dword [rbp - 0x20], 0x350037
mov dword [rbp - 0x1c], 0xe0026
mov dword [rbp - 0x18], 0x540024
call fcn.140005d40
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x14000ce60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000cec2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000cef0
test al, al
jne 0x14000ced4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000ce90
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x140025678]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x29000a
mov dword [rbp - 0x1c], 0xe0027
mov dword [rbp - 0x18], 0x670024
mov dword [rbp - 0x14], 0x580075
mov dword [rbp - 0x10], 0x8002d
mov dword [rbp - 0xc], 0x71001a
call fcn.140003620
mov rcx, rax
call rbx
mov rbx, qword [0x140025678]
lea rcx, [rbp - 0x20]
mov qword [0x140025658], rax
mov dword [rbp - 0x20], 0x28000e
mov dword [rbp - 0x1c], 0xb002c
mov dword [rbp - 0x18], 0x310026
mov dword [rbp - 0x14], 0x580033
mov dword [rbp - 0x10], 0x8002d
mov dword [rbp - 0xc], 0x71001a
call fcn.140003620
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x14000f1a0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140025648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x140025668], rax
mov word [rbp - 0x10], 0x1238
mov byte [rbp - 0xe], 0x6a
call fcn.140005500
mov rcx, qword [0x140025658]
mov rdx, rax
call rbx
mov rbx, qword [0x140025648]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xe27290a
mov dword [rbp - 0x1c], 0x133f1124
mov dword [rbp - 0x18], 0x1402112a
mov word [rbp - 0x14], 0x6526
call fcn.140003d90
mov rcx, qword [0x140025658]
mov rdx, rax
call rbx
mov rbx, qword [0x140025648]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x7362f10
mov dword [rbp - 0x1c], 0x2223a3a
mov dword [rbp - 0x18], 0x1f131406
mov word [rbp - 0x14], 0x6530
call fcn.140003d90
mov rcx, qword [0x140025668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f0c0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140025648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400255f8], rax
mov byte [rbp - 0x10], 0x4e
call fcn.140005210
mov rcx, qword [0x140025668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f160]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140025648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x140025600], rax
mov dword [rbp - 0x10], 0x610f292a
call fcn.1400032c0
mov rcx, qword [0x140025668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f1c0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140025648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400255f0], rax
mov byte [rbp - 0x10], 0x4e
call fcn.140005210
mov rcx, qword [0x140025668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f220]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140025648]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400255e8], rax
mov dword [rbp - 0x10], 0x20042a27
mov byte [rbp - 0xc], 0x58
call fcn.140004010
mov rcx, qword [0x140025668]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f130]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140025648]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x420
mov byte [rbp - 0xe], 0x6a
call fcn.140005500
mov rcx, qword [0x140025668]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x14000179c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14000d958]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1400017dc
mov eax, 0xff
jmp 0x14000197f
mov r9d, dword [rsp + 0x3c]
and r9d, 0x7fff
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov r8d, dword [rsp + 0x40]
mov dword [0x14000e5c0], r8d
mov dword [0x14000e5c8], ecx
mov dword [0x14000e5cc], edx
mov dword [0x14000e5d0], eax
mov eax, r9d
bts eax, 0xf
cmp r8d, 2
cmove eax, r9d
mov dword [0x14000e5c4], eax
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140001872
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140001872
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x140001872
xor ebx, ebx
cmp dword [rax + 0x84], 0xe
jbe 0x140001874
cmp dword [rax + 0xf8], ebx
setne bl
jmp 0x140001874
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.140002cb8
test eax, eax
jne 0x1400018aa
cmp dword [0x14000e028], 2
je 0x140001896
call fcn.140002aa0
mov ecx, 0x1c
call fcn.140002aec
mov ecx, 0xff
call fcn.1400026d0
call fcn.1400025b0
test eax, eax
jne 0x1400018d6
cmp dword [0x14000e028], 2
je 0x1400018c1
call fcn.140002aa0
mov ecx, 0x10
call fcn.140002aec
mov ecx, 0xff
call fcn.1400026d0
nop
call fcn.140002d2c
test eax, eax
jns 0x1400018e9
mov ecx, 0x1b
call fcn.1400026ec
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x140010130], rax
call fcn.14000352c
mov qword [0x14000e020], rax
call fcn.140002fbc
test eax, eax
jns 0x140001914
mov ecx, 8
call fcn.1400026ec
call fcn.1400032f0
test eax, eax
jns 0x140001927
mov ecx, 9
call fcn.1400026ec
mov ecx, edi
call fcn.140002750
test eax, eax
je 0x140001939
mov ecx, eax
call fcn.1400026ec
mov r8, qword [0x14000e5b0]
mov qword [0x14000e5e0], r8
mov rdx, qword [0x14000e5a8]
mov ecx, dword [0x14000e5a0]
call fcn.1400013e8
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
je 0x1400019a0
call fcn.14000273c
jmp 0x14000197d
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400019f0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov ecx, eax
call fcn.140002a90
nop
mov ecx, eax
call fcn.140002660
nop
int3
sub rsp, 0x28
call fcn.140124000
add rsp, 0x28
jmp 0x14000179c
Function at 0x1407870b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140787237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407870e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407870c7
add dl, dl
jne 0x1407870ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14078714e
xor eax, eax
add dl, dl
jne 0x1407870fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140787205
add dl, dl
jne 0x14078710e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14078711b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140787128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140787135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140787142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407870d6
mov eax, 1
add dl, dl
jne 0x14078715e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14078716b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140787153
sub eax, ebx
mov ebx, 1
jne 0x1407871a4
mov ecx, 1
add dl, dl
jne 0x140787186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140787193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078717b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407870d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407871c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407871cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407871b5
cmp eax, 0x7d00
jae 0x1407871f3
cmp eax, 0x500
jb 0x1407871ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407870d6
cmp eax, 0x7f
ja 0x1407871f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407870d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14078722a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407870d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400119b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rbx, qword [0x140020c10]
mov rdi, qword [0x140020c30]
lea rsi, [0x1400202e0]
movq xmm0, rsi
mov rcx, qword [rbx]
movq xmm6, rdi
punpcklqdq xmm6, xmm0
test rcx, rcx
je 0x140011a06
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140011a30
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140020c20]
cmp byte [rax], 0
jne 0x140011a40
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1400119fd
mov edx, 0x414
lea r12, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [rsp + 0x28], 3
mov rcx, r12
mov ebx, 0x14
mov word [rsp + 0x40], dx
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rsi
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140011af4
test al, 0x10
je 0x140011a12
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x140011a12
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x140011aa0
jmp 0x140011a12

Function at 0x140015a60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14001c960
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14001c960
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x140002120
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x1400055e8], rbx
je 0x140002187
cmp rax, rbx
jne 0x14000217a
mov edi, 1
mov esi, edi
jmp 0x14000218c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000215f
mov edi, 1
mov eax, dword [0x1400055f0]
cmp eax, edi
jne 0x1400021a4
mov ebx, 0x1f
mov ecx, ebx
call fcn.140182000
jmp 0x14000221a
mov eax, dword [0x1400055f0]
test eax, eax
jne 0x14000220f
mov dword [0x1400055f0], edi
lea r15, [0x1400033e0]
lea rbx, [0x1400033c8]
mov qword [rsp + 0x30], rbx
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rbx, r15
jae 0x140002201
test eax, eax
jne 0x140002205
cmp qword [rbx], r14
je 0x1400021f6
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [vtable..0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x1400021ce
test eax, eax
je 0x140002215
mov eax, 0xff
jmp 0x14000237b
mov dword [0x140005024], edi
mov ebx, 0x1f
mov eax, dword [0x1400055f0]
cmp eax, edi
jne 0x140002241
lea rdx, [0x1400033c0]
lea rcx, [0x1400033b0]
call sub.msvcrt.dll__initterm
mov dword [0x1400055f0], 2
test esi, esi
jne 0x14000224f
mov rax, r14
xchg qword [0x1400055e8], rax
cmp qword [0x1400055f8], r14
je 0x14000228c
lea rcx, [0x1400055f8]
call fcn.1400025b0
test eax, eax
je 0x14000228c
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400055f8]
mov r9, qword [vtable..0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400022a5
mov eax, 0xff
jmp 0x14000237b
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000232c
test ax, ax
je 0x1400022c0
test edx, edx
jne 0x14000232c
sub ax, di
cmp ax, bx
ja 0x1400022d6
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400022c0
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400019a0
mov dword [0x140005020], eax
cmp dword [0x140005040], r14d
jne 0x140002315
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140005024], r14d
jne 0x14000232a
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140005020]
jmp 0x14000237b
cmp ax, 0x22
jne 0x140002340
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400022ae
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140002644
add rsp, 0x28
jmp 0x140002120