joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004914
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140004942
xor eax, eax
jmp 0x140004a28
cmp qword [rcx + 0x68], 0
je 0x140004953
call fcn.140004a44
jmp 0x140004a28
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000496a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000496c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000499e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14001d710
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140004a22
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400049d5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400049fe
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14000c6f4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140004a22
cmp rsi, rbx
ja 0x1400049dc
test rsi, rsi
je 0x140004a22
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14000c6f4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140006554
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000659e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000659e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000659e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000659e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000659e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400065a0
xor al, al
add rsp, 0x28
ret
Function at 0x14000ed38
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000eda7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000eda7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000eda7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000eda7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000eda7
cmp dword [rcx + 0x84], 0xe
jbe 0x14000eda7
cmp dword [rcx + 0xf8], 0
je 0x14000eda7
mov ecx, ebx
call fcn.14000ee58
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000ec34
nop
cmp dword [rbp + 0x20], 0
je 0x14000edf5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000ee00
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14000ed38

Function at 0x14000ef3c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000ed38
Function at 0x140014080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140005fa0
sub rsp, rax
mov rax, qword [0x14002e040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140012c60
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400140cf
mov rax, rbp
jmp 0x1400141d7
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x414080]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400151a0
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x414080]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400141d3
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400141d3
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400151a0
test rax, rax
js 0x1400141d3
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400141d3
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400141c5
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400141c5
cmp byte [rcx], 0xd
jne 0x1400141ab
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400141ba
cmp byte [rcx + 1], 0xa
jne 0x1400141ba
inc rcx
jmp 0x1400141ba
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x2e480]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14001418d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400141d7
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140005bb0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400143f8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001440e
mov al, 1
jmp 0x14001446e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001441f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001446c
mov ecx, dword [rcx + 0x18]
nop
call fcn.140018b54
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001446c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001446c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001446c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001446e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140014540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140414080]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140014597
cmp word [rdx], r13w
jne 0x140014597
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14001459c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400146c1
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400146e2
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400145d5
mov rdx, r9
mov word [rbx], cx
jmp 0x1400145fc
cmp r9, r8
jae 0x14001460c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400145b6
jmp 0x1400146c1
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400146b6
cmp dword [rsp + 0x80], esi
je 0x1400146b6
lea r8, [0x140414080]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14001468e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14001465e
mov word [rbx], r13w
jmp 0x1400146be
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14001466b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400146be
cmp word [rsp + 0x70], r13w
jne 0x14001469b
cmp rbx, r14
je 0x140014658
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400151a8
cmp word [rsp + 0x70], r13w
je 0x1400146c1
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140414080]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400146bb
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400146c1
Function at 0x1400187a8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14001882f
mov rsi, rbx
cmp word [rax], bp
je 0x1400187ee
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400187d8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400187d4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001540c
mov rdi, rax
test rax, rax
je 0x14001881c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001d710
mov rbp, rdi
xor ecx, ecx
call fcn.14001184c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001b0a8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140011c00
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14001b149
cmp ebx, dword [rsp + 0x30]
je 0x14001b142
test esi, esi
je 0x14001b142
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14001b11d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14001b12a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14001b107
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14001b12e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14001b14b
mov eax, 1
jmp 0x14001b14b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14001d470
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001d498
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001d498
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140ccc8bb
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test rsi, rsi
jmp 0x140ccca5d
lea rsp, [rsp + 8]
je 0x140cc99e3
mov ecx, 0xf6bb5c88
push r10
lea r10, [0x140c8ed98]
Function at 0x14068d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14068d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14068d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14068d06f
add dl, dl
jne 0x14068d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14068d0f6
xor eax, eax
add dl, dl
jne 0x14068d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14068d1ad
add dl, dl
jne 0x14068d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14068d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14068d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14068d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14068d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14068d07e
mov eax, 1
add dl, dl
jne 0x14068d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14068d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14068d0fb
sub eax, ebx
mov ebx, 1
jne 0x14068d14c
mov ecx, 1
add dl, dl
jne 0x14068d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14068d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14068d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14068d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14068d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14068d15d
cmp eax, 0x7d00
jae 0x14068d19b
cmp eax, 0x500
jb 0x14068d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068d07e
cmp eax, 0x7f
ja 0x14068d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14068d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14068d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14068d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000a370
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140017060]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14000a3b0
mov eax, 0xff
jmp 0x14000a55b
mov r8d, dword [rsp + 0x3c]
and r8d, 0x7fff
mov r9d, dword [rsp + 0x40]
cmp r9d, 2
je 0x14000a3cc
bts r8d, 0xf
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [0x140018cc8], r9d
mov dword [0x140018cd0], ecx
mov dword [0x140018cd4], edx
mov dword [0x140018cd8], eax
mov dword [0x140018ccc], r8d
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000a443
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x14000a443
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x14000a443
xor ebx, ebx
cmp dword [rax + 0x84], 0xe
jbe 0x14000a445
cmp dword [rax + 0xf8], ebx
setne bl
jmp 0x14000a445
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.14000c07c
test eax, eax
jne 0x14000a47b
cmp dword [0x14001871c], 2
je 0x14000a467
call fcn.14000be60
mov ecx, 0x1c
call fcn.14000beac
mov ecx, 0xff
call fcn.14000bab0
call fcn.14000b990
test eax, eax
jne 0x14000a4a7
cmp dword [0x14001871c], 2
je 0x14000a492
call fcn.14000be60
mov ecx, 0x10
call fcn.14000beac
mov ecx, 0xff
call fcn.14000bab0
nop
call fcn.14000c0f0
test eax, eax
jns 0x14000a4ba
mov ecx, 0x1b
call fcn.14000bacc
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x14001a8d0], rax
call fcn.14000c890
mov qword [0x140018720], rax
call fcn.14000c38c
test eax, eax
jns 0x14000a4e5
mov ecx, 8
call fcn.14000bacc
call fcn.14000c66c
test eax, eax
jns 0x14000a4f8
mov ecx, 9
call fcn.14000bacc
mov ecx, edi
call fcn.14000bb2c
test eax, eax
je 0x14000a50a
mov ecx, eax
call fcn.14000bacc
mov r8, qword [0x140018cb8]
mov qword [0x140018ce8], r8
mov rdx, qword [0x140018cb0]
mov ecx, dword [0x140018cac]
call fcn.140006490
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x14000a53b
mov ecx, eax
call fcn.14000be50
call fcn.14000bb18
jmp 0x14000a559
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000a5c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
sub rsp, 0x28
call fcn.14017d000
add rsp, 0x28
jmp 0x14000a370

Function at 0x14000b06c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14000ba44
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000bcc0
Function at 0x140012680
Capabilities:
Parse pe header

Disassembly:
cmp rcx, 0xffffffffffffffff
je 0x1400126ae
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x1400126ae
mov edx, dword [rcx + 0x3c]
xor eax, eax
cmp rdx, 0xfffffff
ja 0x1400126ad
add rdx, rcx
je 0x1400126ad
cmp dword [rdx], 0x4550
cmove rax, rdx
ret
xor eax, eax
ret

Function at 0x1400126c0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.1400126e0
mov rcx, rsi
mov rdx, rax
add rsp, 0x20
pop rsi
jmp 0x140012710

Function at 0x140012dd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rdx, rdx
je 0x140012751
mov eax, 0xffffffff
xor r8d, r8d
lea r9, [0x14008fbd0]
nop word cs:[rax + rax]
movzx r10d, al
shr eax, 8
movzx r11d, byte [rcx + r8]
xor r10d, r11d
xor eax, dword [r9 + r10*4]
inc r8
mov r10d, r8d
cmp r10, rdx
jb 0x140012730
not eax
ret
xor eax, eax
ret
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140012ab0
lea rdx, [rax + rax]
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x140012710

Function at 0x140012e30
Capabilities:
Read .ini file

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140012fe0
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140013040
Function at 0x140013040
Capabilities:
Read .ini file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x488
movaps xmmword [rsp + 0x470], xmm6
mov rax, qword [0x1400a33c0]
xor rax, rsp
mov qword [rsp + 0x468], rax
cmp byte [0x1400b8044], 0
je 0x14001307d
xor esi, esi
jmp 0x14001323f
mov rbx, rcx
lea rcx, str.beep.wav
lea rdi, [rsp + 0x260]
mov r8d, 0x104
mov rdx, rdi
call fcn.140013270
mov ecx, 0x100
call fcn.140044c3c
mov rsi, rax
mov eax, dword [0x1400b8048]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0xe8b
lea r8, str.https:__bigpackets.com_streamer_t.php_a_ib_ic_i
mov edx, 0x80
mov rcx, rsi
mov r9d, 0x1a
call fcn.1400132b0
mov rcx, rdi
mov rdx, rsi
call fcn.140013330
test al, al
jne 0x1400130f3
lea rdx, str.Failed_to_download_translations__may_cause_crashing_n
xor ecx, ecx
call fcn.140013370
mov rcx, rsi
call fcn.140044c08
lea rdi, [rsp + 0x260]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400562d0
test eax, eax
sete sil
jne 0x14001323f
mov dword [rsp + 0x3c], esi
mov ecx, dword [rbx]
call fcn.1400134a0
mov rbx, rax
xor ecx, ecx
call fcn.1400134a0
mov r14, rax
lea r12, [rsp + 0x240]
lea r13, [rsp + 0x40]
lea rbp, [0x14013f950]
mov r15, qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movaps xmm6, xmmword [0x14008edc0]
xor esi, esi
jmp 0x1400131a3
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
mov rcx, rbx
mov rdx, r12
mov r8, rbp
mov r9, r13
call r15
mov rcx, r13
mov rdx, rbp
call fcn.14005e1b4
test eax, eax
je 0x140013200
mov ecx, esi
mov rdx, r13
call fcn.1400134c0
inc esi
cmp esi, 0x400
je 0x140013234
mov edx, 0xc
mov rcx, r12
lea r8, [0x14009561c]
mov r9d, esi
call fcn.1400132b0
mov r8d, 0x200
mov rcx, r13
xor edx, edx
call fcn.14003d790
cmp byte [0x14013f96a], 1
je 0x140013160
mov byte [0x14013f96a], 1
movaps xmmword [0x14013f950], xmm6
movabs rax, 0x44003a0044
mov qword [0x14013f960], rax
mov word [0x14013f968], 0x4221
jmp 0x140013160
cmp r14, rbx
je 0x140013234
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x100
mov rcx, r14
mov rdx, r12
mov r8, rbp
mov r9, r13
call r15
mov rcx, r13
mov rdx, rbp
call fcn.14005e1b4
test eax, eax
jne 0x14001318b
mov byte [0x1400b8044], 1
mov esi, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x468]
xor rcx, rsp
call fcn.140046650
mov eax, esi
movaps xmm6, xmmword [rsp + 0x470]
add rsp, 0x488
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140013de0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r9
mov rbx, rdx
mov r14, rcx
mov ebp, dword [rsp + 0x98]
mov r15, qword [rsp + 0x90]
mov ecx, 0x38
call fcn.140044bc4
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 0x50
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r15
mov dword [rax + 0x28], ebp
mov byte [rax + 0x2c], 0
mov dword [rax + 0x30], 0xffffffff
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140013eb0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [rsi + 0x30]
cmp ebx, 0xffffffff
je 0x140013e7d
mov rcx, rsi
call fcn.140044c00
cmp ebx, 1
sete al
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov edi, 0x320
nop word cs:[rax + rax]
mov ecx, 5
call fcn.140014180
mov ebx, dword [rsi + 0x30]
cmp ebx, 0xffffffff
jne 0x140013e62
dec edi
jne 0x140013e90
xor eax, eax
jmp 0x140013e70
Function at 0x140014b40
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov r9d, edx
xor eax, eax
cmp edx, 3
jl 0x140014ca3
lea eax, [r9 - 2]
dec rax
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 1
lea rax, [rdx + rdx*2]
lea r11, [rcx + rax]
add r11, 2
lea r10, [rdx*4]
cmp r11, r8
jb 0x140014c1c
lea r11, [r8 + rdx*4]
add r11, 3
cmp r11, rcx
jb 0x140014c1c
inc rdx
lea r11, [rcx + 2]
xor esi, esi
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax + rax]
movzx ebx, byte [r11 - 2]
shr ebx, 2
movzx ebx, byte [rbx + rdi]
mov byte [r8 + rsi*4], bl
movzx ebx, byte [r11 - 2]
movzx r14d, byte [r11 - 1]
shl ebx, 4
and ebx, 0x30
shr r14d, 4
or r14d, ebx
movzx ebx, byte [r14 + rdi]
mov byte [r8 + rsi*4 + 1], bl
movzx ebx, byte [r11 - 1]
movzx r14d, byte [r11]
and ebx, 0xf
shr r14d, 6
lea ebx, [r14 + rbx*4]
movzx ebx, byte [rbx + rdi]
mov byte [r8 + rsi*4 + 2], bl
movzx ebx, byte [r11]
and ebx, 0x3f
movzx ebx, byte [rbx + rdi]
mov byte [r8 + rsi*4 + 3], bl
inc rsi
add r11, 3
cmp rdx, rsi
jne 0x140014bb0
jmp 0x140014c99
inc rdx
lea r11, [rcx + 2]
xor esi, esi
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
movzx ebx, byte [r11 - 2]
mov r14d, ebx
shr r14d, 2
movzx ebp, byte [r14 + rdi]
mov byte [r8 + rsi*4], bpl
movzx r14d, byte [r11 - 1]
shl ebx, 4
and ebx, 0x30
mov r15d, r14d
shr r15d, 4
or r15d, ebx
movzx ebx, byte [r15 + rdi]
mov byte [r8 + rsi*4 + 1], bl
movzx ebx, byte [r11]
and r14d, 0xf
mov r15d, ebx
shr r15d, 6
lea r14d, [r15 + r14*4]
movzx ebp, byte [r14 + rdi]
mov byte [r8 + rsi*4 + 2], bpl
and ebx, 0x3f
movzx ebx, byte [rbx + rdi]
mov byte [r8 + rsi*4 + 3], bl
inc rsi
add r11, 3
cmp rdx, rsi
jne 0x140014c30
add r8, r10
add r8, 4
add eax, 3
mov edx, eax
sub r9d, eax
test r9b, 2
jne 0x140014cea
test r9b, 1
je 0x140014d3a
movzx eax, byte [rcx + rdx]
shr eax, 2
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx eax, byte [rax + r9]
mov byte [r8], al
movzx eax, byte [rcx + rdx]
shl eax, 4
and eax, 0x30
movzx eax, byte [rax + r9]
mov byte [r8 + 1], al
mov word [r8 + 2], 0x3d3d
jmp 0x140014d36
movzx eax, byte [rcx + rdx]
shr eax, 2
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx eax, byte [rax + r9]
mov byte [r8], al
movzx eax, byte [rcx + rdx]
shl eax, 4
and eax, 0x30
movzx r10d, byte [rcx + rdx + 1]
shr r10d, 4
or r10d, eax
movzx eax, byte [r10 + r9]
mov byte [r8 + 1], al
movzx eax, byte [rcx + rdx + 1]
and eax, 0xf
movzx eax, byte [r9 + rax*4]
mov byte [r8 + 2], al
mov byte [r8 + 3], 0x3d
add r8, 4
mov byte [r8], 0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140015fd0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x140015ffa
mov r8, rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x38
ret
Function at 0x14002cb90
Capabilities:
Read .ini file

Disassembly:
push rsi
sub rsp, 0x1e0
mov rax, qword [0x1400a33c0]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
movzx eax, byte [rcx]
test al, 0x11
jne 0x14002cc2a
cmp qword [rcx + 0x20], 0
jne 0x14002cc2a
test al, 2
lea r8, [0x1400b06ac]
lea rax, [0x140096402]
cmovne r8, rax
cmove rax, rdx
lea r9, [0x1400b4ec0]
lea r10, [0x1400b4cb0]
cmove r10, r9
test rdx, rdx
cmove rax, r8
mov rdx, qword [rcx + 8]
mov rsi, rcx
mov r8, qword [rcx + 0x10]
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], 0xc8
lea r9, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x14002cc2a
mov byte [rsp + 0x3f], 1
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x3f]
mov rcx, rsi
call fcn.140015e00
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.140046650
nop
add rsp, 0x1e0
pop rsi
ret