joyce8/EMBER2024-capa huggingface dataset:
Function at 0x530d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x530e1d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x2a48465e2043f744
mov qword [rsp + 0x44], rdx
movabs rdx, 0x3a2f515020736832
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xf727642f3a2f5150
mov qword [rsp + 0x50], rdx
movabs rdx, 0x3a655473346ed566
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1507100e13011513
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x11705150e191507
mov qword [rsp + 0x24], rdx
movabs rdx, 0x817020c10020f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10002121b040606
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc070d0d0c040917
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x530dc0
movzx r9d, byte [rsp + rsi + 0x44]
sub r9d, edx
lea edx, [r9 + 0x3d]
mov byte [rsp + rdi + 0x44], dl
lea edx, [r8 + 0x3d]
mov byte [rsp + rsi + 0x44], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x530ded
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x530e10
movzx r8d, byte [rsp + rdi + 0x44]
sub r8d, edx
cmp rsi, 0x1c
jb 0x530d9d
jmp 0x530e04
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x1c
call fcn.00444ae0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00456860
mov eax, edi
mov ecx, 0x1c
call fcn.00456860
nop
nop dword [rax]
call fcn.00454580
jmp fcn.00530d00

Function at 0x531200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5312cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x64740db2b651642f
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x770f4d64
movabs rdx, 0x5080304030a0205
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x309080a08050508
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x531265
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x53129c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x5312bf
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 0xb
jb 0x53124b
jmp 0x5312b3
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444ae0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456860
mov eax, edi
mov ecx, 0xb
call fcn.00456860
nop
call fcn.00454580
jmp fcn.00531200
Function at 0x5336c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5337e7
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x659b786101a87908
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xdb8fd2b659b7861
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc9c9656e61fa0120
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2f6c0ab96f9d02a8
mov qword [rsp + 0x50], rdx
movabs rdx, 0x116562c7756eefb7
mov qword [rsp + 0x58], rdx
movabs rdx, 0x913081511232013
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa15180e09130815
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2191d141c062312
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa0d1b200309160d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x300191c230e120b
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x533789
movzx r9d, byte [rsp + rsi + 0x3c]
sub r9d, edx
lea edx, [r9 - 0x6f]
mov byte [rsp + rdi + 0x3c], dl
lea edx, [r8 - 0x6f]
mov byte [rsp + rsi + 0x3c], dl
add rax, 2
cmp rax, 0x24
jge 0x5337b7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x24
jae 0x5337da
movzx r8d, byte [rsp + rdi + 0x3c]
sub r8d, edx
cmp rsi, 0x24
jb 0x53376c
jmp 0x5337ce
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x24
call fcn.00444ae0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00456860
mov eax, edi
mov ecx, 0x24
call fcn.00456860
nop
call fcn.00454580
jmp fcn.005336c0

Function at 0x53d7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53d87d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x527e5d6437622163
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x2957
movabs rdx, 0x603030005040006
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x8080203
xor eax, eax
jmp 0x53d820
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x53d84d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x53d870
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x53d803
jmp 0x53d864
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444ae0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456860
mov eax, edi
mov ecx, 0xa
call fcn.00456860
nop
nop dword [rax]
call fcn.00454580
jmp fcn.0053d7c0
Function at 0x53f240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53f32a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x373611a4336370a2
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x69373611a4336370
mov qword [rsp + 0x30], rdx
movabs rdx, 0x78dc6595a462a06e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x409020f040c0502
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8010409020f040c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa0a0f0c020d0d
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x53f2cd
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x27]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x27]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x53f2fa
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x53f31d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x53f2b0
jmp 0x53f311
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444ae0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456860
mov eax, edi
mov ecx, 0x11
call fcn.00456860
nop
call fcn.00454580
jmp fcn.0053f240

Function at 0x53f640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53f72a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x373635fb2d32b9c2
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x83373635fb2d32b9
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0e7b48e63df0584
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80a09030f010408
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1009080a09030f01
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x109080d0e000e0b
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x53f6cd
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x43]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x43]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x53f6fa
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x53f71d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x53f6b0
jmp 0x53f711
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444ae0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456860
mov eax, edi
mov ecx, 0x11
call fcn.00456860
nop
call fcn.00454580
jmp fcn.0053f640
Function at 0x53f740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53f82a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x93885bdd8ccf4dd9
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x3893885bdd8ccf4d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x78665a856363725f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd07010401000e03
mov qword [rsp + 0x19], rdx
movabs rdx, 0x109070706050d07
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa050d0405020b09
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x53f7cd
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x1a]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x1a]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jge 0x53f7fa
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x53f81d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x53f7b0
jmp 0x53f811
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444ae0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456860
mov eax, edi
mov ecx, 0x11
call fcn.00456860
nop
call fcn.00454580
jmp fcn.0053f740

Function at 0x5462c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x546386
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x303af36cfe406f02
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x35
movabs rdx, 0x5030007020608
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x300
xor eax, eax
nop
jmp 0x546320
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2c]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x546352
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x546377
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2c]
cmp rsi, 9
jb 0x546302
jmp 0x54636b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00444ae0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456860
mov eax, edi
mov ecx, 9
nop
call fcn.00456860
nop
call fcn.00454580
jmp fcn.005462c0
Function at 0x140011221
Capabilities:
Terminate process

Disassembly:
jmp 0x140013320
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112b7
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400146b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400146d0
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400146e3
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001470d
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014721
xor al, al
jmp 0x140014751
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014733
xor al, al
jmp 0x140014751
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001474f
xor al, al
jmp 0x140014751
mov al, 1
add rsp, 0x38
ret
Function at 0x140012560
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113ed
movzx eax, al
test eax, eax
jne 0x140012580
mov ecx, 7
call fcn.140011357
nop
mov byte [rsp + 0x20], 0
call fcn.140011370
mov byte [rsp + 0x21], al
cmp dword [0x14001e868], 1
jne 0x1400125a4
mov ecx, 7
call fcn.140011357
nop
jmp 0x1400125fc
cmp dword [0x14001e868], 0
jne 0x1400125f7
mov dword [0x14001e868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111ae
test eax, eax
je 0x1400125d8
mov eax, 0xff
jmp 0x140012701
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011366
mov dword [0x14001e868], 2
jmp 0x1400125fc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011343
call fcn.1400112da
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012659
mov rcx, qword [rsp + 0x30]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x140012659
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.140011311
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001268d
mov rcx, qword [rsp + 0x38]
call fcn.14001116d
movzx eax, al
test eax, eax
je 0x14001268d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113ac
nop
call fcn.1400127b0
mov dword [rsp + 0x28], eax
call fcn.1400112b7
movzx eax, al
test eax, eax
jne 0x1400126ac
mov ecx, dword [rsp + 0x28]
call fcn.140011064
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400126bb
call fcn.1400113b6
nop
xor edx, edx
mov cl, 1
call fcn.14001115e
mov eax, dword [rsp + 0x28]
jmp 0x140012701
add rsp, 0x68
ret
Function at 0x140008f43
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140e11c30]
jne 0x1400061fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400061f6
repz ret
ror rcx, 0x10
jmp 0x140008e9c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140e15310]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140e15408]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140008f21
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140e15310]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140008f43
mov rax, qword [rsp + 0x88]
mov qword [0x140e15408], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140e153a8], rax
mov rax, qword [0x140e15408]
mov qword [0x140e15280], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140e15390], rax
mov dword [0x140e15270], 0xc0000409
mov dword [0x140e15274], 1
mov rax, qword [0x140e11c30]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140e11c38]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140e15308], eax
mov ecx, 1
call fcn.14000d794
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400126f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140e15308], 0
jne 0x140008fca
mov ecx, 1
call fcn.14000d794
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14000ba58
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000b8c8
Function at 0x14000fe50
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140e11c30]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000b31c
xor ebx, ebx
cmp qword [0x140e16248], rbx
mov rdi, rax
jne 0x14000ff63
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14001003a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001003a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140e16248], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140e16250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140e16258], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140e16268], rax
test rax, rax
je 0x14000ff5a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140e16260], rax
jmp 0x14000ff6a
mov rax, qword [0x140e16260]
jmp 0x14000ff71
mov rax, qword [0x140e16260]
mov r11, qword [0x140e16268]
cmp rax, rdi
je 0x14000ffd8
cmp r11, rdi
je 0x14000ffd8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140e16268]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000ffd8
test rax, rax
je 0x14000ffd8
call rsi
test rax, rax
je 0x14000ffd2
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000ffd2
test byte [rsp + 0x40], 1
jne 0x14000ffd8
bts ebp, 0x15
jmp 0x140010018
mov rcx, qword [0x140e16250]
cmp rcx, rdi
je 0x140010018
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140010018
call rax
mov rbx, rax
test rax, rax
je 0x140010018
mov rcx, qword [0x140e16258]
cmp rcx, rdi
je 0x140010018
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140010018
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140e16248]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14001003a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14001003c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400061e0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14143a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14143a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14143a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14143a06f
add dl, dl
jne 0x14143a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14143a0f6
xor eax, eax
add dl, dl
jne 0x14143a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14143a1ad
add dl, dl
jne 0x14143a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14143a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14143a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14143a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14143a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14143a07e
mov eax, 1
add dl, dl
jne 0x14143a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14143a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14143a0fb
sub eax, ebx
mov ebx, 1
jne 0x14143a14c
mov ecx, 1
add dl, dl
jne 0x14143a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14143a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14143a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14143a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14143a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14143a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14143a15d
cmp eax, 0x7d00
jae 0x14143a19b
cmp eax, 0x500
jb 0x14143a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14143a07e
cmp eax, 0x7f
ja 0x14143a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14143a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14143a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14143a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140028974
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c284
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c284
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028ac4
cmp rax, 0xffffffffffffffff
je 0x140028ac4
xor edi, edi
test rbp, rbp
jle 0x140028a6f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001eb98
mov rbx, rax
test rax, rax
jne 0x1400289fc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028a65
mov edx, 0x8000
mov ecx, r14d
call fcn.140019be8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cf60
cmp eax, 0xffffffff
je 0x140028a45
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028a0c
mov edx, r15d
mov ecx, r14d
call fcn.140019be8
jmp 0x140028a65
cmp byte [rsi + 0x38], dil
je 0x140028a5c
cmp dword [rsi + 0x34], 5
jne 0x140028a5c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028a65
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a948
jmp 0x140028ad8
jns 0x140028ad8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c284
cmp rax, 0xffffffffffffffff
jne 0x140028a90
cmp byte [rsi + 0x30], dil
je 0x140028ad8
mov edi, dword [rsi + 0x2c]
jmp 0x140028ad8
mov ecx, r14d
call fcn.14001871c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028ad8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028ad8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028ad1
mov eax, dword [rsi + 0x2c]
jmp 0x140028ad6
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c284
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029bd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029bf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029bf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x6c5bea60
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x6ccfc080]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x6c5bead9
mov rcx, r10
call fcn.6c5be930
test eax, eax
je 0x6c5bead9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x6c5bead6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x6c5beacd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x6c5bead9
add r8, 0x28
cmp r8, r9
jne 0x6c5beab8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140132465
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140132840
jmp 0x140132620
dec r9d
mov r8d, 0x5113dfaa
lea rdx, [r10 + r9*4]
mov ecx, dword [rdx + r11]
add rcx, r10
je 0x1401324a3
jne 0x1401324a3
pop r10
invalid
invalid
ret 0xd638
invalid