joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d3b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
test eax, eax
je 0x1400d3b71
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.1400d3150
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jle 0x1400d3bcc
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
shr eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
sub eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x10], eax
jmp 0x1400d3b79
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jge 0x1400d3be8
lea rcx, [0x140132470]
call fcn.1400c64b0
jmp 0x1400d3d2c
cmp dword [rsp + 0x20], 4
jge 0x1400d3c0e
mov rcx, qword [rsp + 0x50]
call fcn.1400d3040
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x1400d3be8
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 0
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 1
imul rax, rax, 3
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
xor eax, 0xffff
cmp dword [rsp + 0x2c], eax
je 0x1400d3c7e
lea rcx, str.zlib_corrupt
call fcn.1400c64b0
jmp 0x1400d3d2c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 8]
jbe 0x1400d3ca7
lea rcx, str.read_past_buffer
call fcn.1400c64b0
jmp 0x1400d3d2c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x28]
jbe 0x1400d3ce0
mov r8d, dword [rsp + 0x24]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
call fcn.1400d33e0
test eax, eax
jne 0x1400d3ce0
xor eax, eax
jmp 0x1400d3d2c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rdx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140119848
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rax
call 0x14024a551
test rax, rax
je 0x140119892
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140119892
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140119892
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140119892
cmp dword [rcx + 0x84], 0xe
jbe 0x140119892
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140119894
xor al, al
add rsp, 0x28
ret

Function at 0x14018a5a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14018a5cd
xor al, al
jmp 0x14018a72f
mov rax, qword [0x1401aa6b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401aa6b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401aa6c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401aa6c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401aa6d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401aa6d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401aa6e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401aa6e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1401aa6f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14018a721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14018a679
mov r11d, 2
jmp 0x14018a69d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14018a693
mov r11d, 1
jmp 0x14018a69d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14018a745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14018a6e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14018a6fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14018a70a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14018a718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14018a660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14018a72a
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14004d160]
mov dword [rax], 1
mov rax, qword [0x14004d170]
mov dword [rax], 1
mov rax, qword [0x14004d180]
mov dword [rax], 1
mov rax, qword [0x14004d110]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140018f70
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x10078
push rbx
call fcn.140030620
sub rsp, rax
xor eax, eax
mov rdx, rcx
lea rbx, [rsp + 0x20]
xor ecx, ecx
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], cx
lea rsi, [rsp + 0x70]
mov rcx, rbx
call fcn.14002a110
mov rdx, rsi
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140018fc9
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add rsp, 0x10078
pop rbx
pop rsi
ret
Function at 0x14002f300
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140040a80
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140040a80
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x14002ffd2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400552a8]
test eax, eax
je 0x14003006a
lea rax, [0x140055280]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400552b0]
mov qword [rbp - 8], rax
jmp 0x14003004e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140030042
cmp qword [rbp - 0x10], 0
je 0x140030042
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140030008
lea rax, [0x140055280]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14003006b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140030170
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140030198
mov eax, 0
jmp 0x1400301e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400301c1
mov eax, 0
jmp 0x1400301e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400301e1
mov eax, 0
jmp 0x1400301e6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400301ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14003026a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140030261
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140030261
mov rax, qword [rbp - 8]
jmp 0x14003027f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140030234
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002f40
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002f68
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140002f8e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002f90
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002fe9
test ecx, ecx
jle 0x140002fc9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002fe9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002fe9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140003010
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003032
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140003048
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003064
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003066
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400030a2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000313e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400030dd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000311e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000313e
cmp rbx, rax
ja 0x1400030f0
test rbx, rbx
je 0x14000313e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400035a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400035cd
xor eax, eax
jmp 0x140003739
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003607
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003607
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003739
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000372c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000364a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003675
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003731
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400036e4
sub eax, 1
je 0x1400036e4
cmp eax, 2
jne 0x14000372c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003731
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003712
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000372c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003731
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004db0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003b30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003c03
cmp byte [rcx + 0x71], 0
je 0x140003c03
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140003bff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003bc4
sub eax, 1
je 0x140003bc8
cmp eax, 2
jne 0x140003bff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004db0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003bf6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003bff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140003bac
xor al, al
jmp 0x140003bac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004db0
add rsp, 0x60
pop rbx
ret

Function at 0x140005728
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005772
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005772
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005772
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005772
cmp dword [rcx + 0x84], 0xe
jbe 0x140005772
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005774
xor al, al
add rsp, 0x28
ret
Function at 0x1400113c0
Capabilities:
Terminate process

Disassembly:
jmp 0x140018880
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400114b0
Capabilities:
Parse pe header

Disassembly:
jmp 0x140019bd0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140019bf0
xor al, al
jmp 0x140019c71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019c03
xor al, al
jmp 0x140019c71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140019c2d
xor al, al
jmp 0x140019c71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019c41
xor al, al
jmp 0x140019c71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140019c53
xor al, al
jmp 0x140019c71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140019c6f
xor al, al
jmp 0x140019c71
mov al, 1
add rsp, 0x38
ret
Function at 0x140d07058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d071df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d07089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d0706f
add dl, dl
jne 0x140d07096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d070f6
xor eax, eax
add dl, dl
jne 0x140d070a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d071ad
add dl, dl
jne 0x140d070b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d070c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d070d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d070dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d070ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d0707e
mov eax, 1
add dl, dl
jne 0x140d07106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d07113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d070fb
sub eax, ebx
mov ebx, 1
jne 0x140d0714c
mov ecx, 1
add dl, dl
jne 0x140d0712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d0713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d07123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d0707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d07168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d07175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d0715d
cmp eax, 0x7d00
jae 0x140d0719b
cmp eax, 0x500
jb 0x140d07196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d0707e
cmp eax, 0x7f
ja 0x140d0719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d0707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d071d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d0707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140edbec4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140edbece
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140edbef7
pop rbp
sub rbp, 0x33
sub rbp, 0xedbec4
sub ebp, 0xedbec4
sub rsp, 0x20
jmp 0x140edbf16
mov rax, 0xedbec4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x611feb3b
xor byte [rax], dl
inc rax
dec rcx
dec ecx
jne 0x140edbf35
jmp 0x140edbf4c
jae 0x140edbf00
sal byte [rax + 0x3b3b07b2], cl
cmp esi, dword [rbx - 0x46]
cli
xor edi, dword [rdx]
cmp edi, dword [rbx]
jae 0x140edbf98
sal byte [rbx - 4], cl
sti
xor bh, byte [rbx]
cmp edi, dword [rbx]
jae 0x140edbf64
stc
adc edi, dword [rbx]
cmp edi, dword [rbx]
jae 0x140edbf3b
cmp edi, dword [rbx]
cmp esi, dword [rbx - 0x34]
fnstenv [rbx + 0x3a]
cli
mov al, 0xba
invalid
js 0x140edbfd2
movsb byte [rdi], byte [rsi]
cmp edi, dword [rbx]
cmp edi, dword [rbx]
sar dword [rsi], cl
cmp edi, dword [rbx]
cmp edx, edx
sub eax, 0xfa3b3b3b
sar dword [rcx], cl
or ch, byte [rdx]
jae 0x140edbf6a
cli
invalid
cmp edi, dword [rbx]
cmp edi, dword [rbx]
cmp esi, dword [rbx + 0x3a]
rcl bl, cl
cmp edi, dword ds:[rbx]
cmp edx, edx
mov dh, 0x39
cmp edi, dword [rbx]
imul edx, ebx, 0x3b3b3b46
invalid