joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4722e0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x00400000], 0x5a4d
je 0x47231d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x4723ab
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x472341
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x472388
cmp ecx, 0x20b
je 0x472360
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
cmp dword [rax + 0x84], 0xe
ja 0x472374
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
cmp dword [rax + 0x74], 0xe
ja 0x472399
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x4723ab
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x0049f328], 0xffffffffffffffff
mov qword [0x0049f330], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x0049cd84]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x0049cd80]
mov dword [rcx], eax
call fcn.00472590
cmp dword [0x0049c720], 0
jne 0x472405
lea rcx, [fcn.00472590]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x00474700]
lea rcx, [0x004746f8]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x0049cd7c]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x0049cd78]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x004746f0]
lea rcx, [0x00474698]
call sub.msvcrt.dll__initterm
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x4724a6
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x472496
cmp al, 0x22
je 0x472496
jmp 0x472480
cmp byte [r8], 0x22
jne 0x4724b6
inc r8
mov qword [rsp + 0x30], r8
jmp 0x4724b6
cmp byte [r8], 0x20
jbe 0x4724b6
inc r8
mov qword [rsp + 0x30], r8
jmp 0x4724a6
movzx eax, byte [r8]
test al, al
je 0x4724cc
cmp al, 0x20
ja 0x4724cc
inc r8
mov qword [rsp + 0x30], r8
jmp 0x4724b6
test byte [rsp + 0x8c], 1
je 0x4724e1
movzx r9d, word [rsp + 0x90]
jmp 0x4724e7
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.0053f000
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x472503
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x472527
mov eax, edi
jmp 0x472530
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x14001be3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x14001be89
cmp rcx, 0xffffffffffffffff
je 0x14001be89
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001be81
cmp dword [rcx + 0x3c], edx
jl 0x14001be81
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14001be81
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14001be89
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x1400022c8]
lea r9, str._J_ms8m
mov r8d, 5
mov qword [rsp + 0x38], rax
lea rax, [0x1400022b8]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140ee7058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140ee71df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ee7089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ee706f
add dl, dl
jne 0x140ee7096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ee70f6
xor eax, eax
add dl, dl
jne 0x140ee70a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ee71ad
add dl, dl
jne 0x140ee70b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ee70c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ee70d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ee70dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ee70ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ee707e
mov eax, 1
add dl, dl
jne 0x140ee7106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ee7113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ee70fb
sub eax, ebx
mov ebx, 1
jne 0x140ee714c
mov ecx, 1
add dl, dl
jne 0x140ee712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ee713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ee7123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ee707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ee7168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ee7175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ee715d
cmp eax, 0x7d00
jae 0x140ee719b
cmp eax, 0x500
jb 0x140ee7196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ee707e
cmp eax, 0x7f
ja 0x140ee719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ee707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ee71d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ee707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180004c30
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
xor eax, eax
test eax, eax
je 0x180004c4f
movsx eax, byte [rsp + 0x28]
or eax, 0x20
mov dword [rsp], eax
jmp 0x180004c57
movsx eax, byte [rsp + 0x28]
mov dword [rsp], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
imul eax, eax, 0x1000193
add rsp, 0x18
ret
Function at 0x1400066c0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14000f960], rbx
je 0x140006727
cmp rax, rbx
jne 0x14000671a
mov ebx, 1
mov esi, ebx
jmp 0x14000672c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400066ff
mov ebx, 1
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x140006744
mov edi, 0x1f
mov ecx, edi
call fcn.14015f000
jmp 0x1400067b0
mov eax, dword [0x14000f968]
test eax, eax
jne 0x1400067a5
mov dword [0x14000f968], ebx
lea r15, [0x1400089b8]
lea rdi, [0x1400089a0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140006797
test eax, eax
jne 0x14000679b
cmp qword [rdi], r14
je 0x14000678c
mov rax, qword [rdi]
mov rcx, qword [0x140008920]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000676e
test eax, eax
je 0x1400067ab
mov eax, 0xff
jmp 0x140006906
mov dword [0x14000d3e4], ebx
mov edi, 0x1f
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x1400067d7
lea rdx, [0x140008998]
lea rcx, [0x140008928]
call sub.msvcrt.dll__initterm
mov dword [0x14000f968], 2
test esi, esi
jne 0x1400067e5
mov rax, r14
xchg qword [0x14000f960], rax
cmp qword [0x14000f970], r14
je 0x140006818
lea rcx, [0x14000f970]
call fcn.140006b30
test eax, eax
je 0x140006818
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000f970]
mov r9, qword [0x140008920]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140006831
mov eax, 0xff
jmp 0x140006906
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400068b7
test ax, ax
je 0x14000684c
test edx, edx
jne 0x1400068b7
sub ax, bx
cmp ax, di
ja 0x140006862
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000684c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400013dc
mov dword [0x14000d3e0], eax
cmp dword [0x14000d400], r14d
jne 0x1400068a0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000d3e4], r14d
jne 0x1400068b5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000d3e0]
jmp 0x140006906
cmp ax, 0x22
jne 0x1400068cb
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000683a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140006bc4
add rsp, 0x28
jmp 0x1400066c0
Function at 0x4015d0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x48], rcx
call sub.KERNEL32.dll_GetCurrentProcessId
mov r8d, eax
mov ecx, 0x1fffff
xor edx, edx
mov dword [rbp - 0x3c], edx
call sub.KERNEL32.dll_OpenProcess
mov r8, qword [rbp - 0x30]
mov rcx, rax
mov eax, dword [rbp - 0x3c]
mov rdx, rcx
mov qword [rbp - 0x38], rdx
mov rdx, rsp
mov dword [rdx + 0x20], 0x40
mov edx, eax
mov r9d, 0x1000
call sub.KERNEL32.dll_VirtualAllocEx
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp], rdx
mov qword [rbp - 8], rcx
mov rax, qword [rbp - 8]
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp]
mov qword [rbp - 0x10], rcx
xor eax, eax
cmp rax, rcx
jbe 0x401667
jmp 0x401669
mov rax, qword [rbp - 0x10]
cmp rax, rax
jbe 0x40168a
jmp 0x40168c
jmp 0x40165c
mov rdx, qword [rbp - 0x10]
xor eax, eax
mov ecx, eax
call fcn.00401bf0
mov rcx, qword [rbp - 0x10]
xor eax, eax
cmp rax, rcx
jbe 0x401722
jmp 0x401727
jmp 0x401676
mov rdx, qword [rbp - 0x10]
mov rcx, rdx
call fcn.00401c20
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
lea r8, str.DrLuKmkSWHRzincorrect_alignment
mov r9d, 0xc
call fcn.00401c50
lea rcx, [rbp + 8]
mov edx, 0xaa
mov r8d, 8
call fcn.00407750
mov rcx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x48]
mov r9, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x20]
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
call sub.KERNEL32.dll_WriteProcessMemory
mov r8, qword [rbp - 0x20]
xor eax, eax
mov r9d, eax
xor eax, eax
mov rcx, r9
mov rdx, r9
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call sub.KERNEL32.dll_CreateThread
mov rcx, rax
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
nop
add rsp, 0x90
pop rbp
ret
jmp 0x401698
mov rdx, qword [rbp - 0x10]
xor eax, eax
mov ecx, eax
call fcn.00401c20
int3
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140020140]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001f588]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x14001f588]
call fcn.140011838
lea rcx, [0x140020140]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xchg esp, eax
out 0x8b, eax
js 0x14003d5f9
ja 0x14003d5b3
scasb al, byte [rdi]
invalid
loop 0x14003d5d9
xchg edi, eax
mov ds, word [rdi + 0x3f6fb5e4]
int 0xf1
invalid
jmp 0x14003d593
push 0xffffffffffffffa5
out dx, eax
inc dword [rdi + 0x543f3e38]
cmp byte [rsi], bh
invalid
push rsp
add al, dh
fld qword [rbx + 0x76eefc1]
outsb dx, byte [rsi]
invalid
invalid
invalid
cmp bh, byte [rsi]
mov ebp, 0xcccda552
jo str.H_E
push 0x5ede8198
outsb dx, byte [rsi]
sbb esi, 0xffb86e5e
invalid
ficomp word [rsi + 0x6e]
mov eax, 0x30820eff
movabs al, byte [0xc223082421893638]
and dword [rax + rcx], esp
and eax, edx
and byte [rax + rsi*8], ah
add esp, dword [rsi - 0x35]
retf
and eax, 0xfbc47a8a
jle 0x14003d605
retf
cmpsd dword [rsi], dword [rdi]
enter 0xffffffffffffb2e6, 0xfffffffffffffffc
in eax, 0x6f
jmp [rsi]
xchg edi, eax
scasb al, byte [rdi]
push rax
push rdx
add eax, 0xc08d4113
int1
mov al, 0x64
mov dword [rbp - 0x53f9f127], esi
invalid
lodsb al, byte [rsi]
sub al, 0x22
movabs eax, dword [0x924cac49f1ffd0f0]
int1
lodsb al, byte [rsi]
xchg rdx, rax
invalid
int1
lodsb al, byte [rsi]
xchg rdx, rax
push rdi
invalid
sal dword [rbp + 0x423538b9], cl
ffreep st(1)
insd dword [rdi], dx
fdiv st(3), st(0)
sti
xchg ecx, eax
xchg dword [rax - 0x72], ebp
xchg ebp, eax
cmp ebp, edi
xchg ebp, eax
invalid
fcomp dword [rsi + 0x455d82cb]
invalid
Function at 0x140011bbc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov rcx, qword gs:[0x60]
mov r8, qword [rbx + 0x28]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
and qword [rbx + 0x28], 0
cmp dword [r8], 2
jne 0x140011c13
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
and qword [rbx + 8], 0
mov r8, qword [rbx + 0x18]
cmp dword [r8], 2
jne case.default.0x140011c54
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
and qword [rbx + 0x18], 0
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.ntdll.dll_RtlFreeHeap]
pop rbx
invalid
cli
or eax, 0x686fa08c
push rsi
nop
mov esp, 0x53a171f8
shr byte [rdi - 0x17], 1
fisubr word [rbp + 0x43]
xor qword [r9 + rsi*8 + 0x13], 0xffffffffc3dfaf4b
xor eax, esi
mov ebx, 0x28c97427
invalid
xor bh, cl
clc
mov bh, dl
invalid
Function at 0x1400166f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140026878], rbx
je 0x14001673c
cmp rax, rbx
jne 0x14001672f
mov ebx, 1
mov esi, ebx
jmp 0x140016741
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140016714
mov ebx, 1
mov eax, dword [0x140026880]
cmp eax, ebx
jne 0x140016757
mov ecx, 0x1f
call fcn.1400b6000
jmp 0x1400167bc
mov eax, dword [0x140026880]
test eax, eax
jne 0x1400167b6
mov dword [0x140026880], ebx
lea r15, [0x14001a6f0]
lea rdi, [0x14001a6d8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400167a8
test eax, eax
jne 0x1400167ac
cmp qword [rdi], 0
je 0x14001679d
mov rax, qword [rdi]
mov rcx, qword [case.0x140006774.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14001677e
test eax, eax
je 0x1400167bc
mov eax, 0xff
jmp 0x140016898
mov dword [0x140026178], ebx
mov eax, dword [0x140026880]
cmp eax, ebx
jne 0x1400167e3
lea rdx, [0x14001a6d0]
lea rcx, [0x14001a618]
call sub.msvcrt.dll__initterm
mov dword [0x140026880], 2
test esi, esi
jne 0x1400167f0
xor eax, eax
xchg qword [0x140026878], rax
cmp qword [0x140026898], 0
je 0x140016824
lea rcx, [0x140026898]
call fcn.140017310
test eax, eax
je 0x140016824
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140026898]
mov r9, qword [case.0x140006774.0]
call r9
mov r8, qword [0x140026190]
mov rdx, qword [0x140026188]
mov ecx, dword [0x140026180]
call fcn.140002c70
mov dword [0x140026174], eax
cmp dword [0x140026198], 0
jne 0x140016854
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140026178], 0
jne 0x140016869
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140026174]
jmp 0x140016898
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400173a4
add rsp, 0x28
jmp 0x1400166f0

Function at 0x140016e34
Capabilities:
Print debug messages

Disassembly:
jmp 0x140016e40
push rbx
sub rsp, 0x540
mov rax, qword [0x140026110]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140016ebd
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x140016edd
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400168f0
add rsp, 0x540
pop rbx
ret
Function at 0x140005af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140005b80
cmp r11, r10
ja 0x140005bf6
cmp r10, rdx
ja 0x140005c08
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140005b82
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140005b60
jmp 0x140005be4
ja 0x140005b8a
mov r11, r10
cmp rax, r8
jne 0x140005b24
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140005bc0
mov rdi, r8
sub ecx, edx
jns 0x140005bdb
jmp 0x140005be6
cmp r8, rsi
je 0x140005c17
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140005be6
xor al, 1
cmp rdi, rsi
jne 0x140005ba0
jmp 0x140005be6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140003e60
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140003450
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140004950
int3

Function at 0x14000c090
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140002ed0
cmp rax, rcx
je 0x14000c0b5
cmp rdx, 4
jae 0x14000c0b8
xor eax, eax
xor r8d, r8d
jmp 0x14000c150
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x140035490]
movdqa xmm3, xmmword [0x1400354a0]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14000c0e0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x14000c167
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14000c150
ret
Function at 0x14000d380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r8, qword [rcx]
test r8, r8
je 0x14000d3db
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x14000d3db
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x14000d3f6
cmp eax, 0x42
jne 0x14000d3db
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14000d4a6
cmp byte [r8 + r11], 0x5f
jne 0x14000d4a6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x14000d50e
mov rcx, rsi
xor edx, edx
call fcn.140008b00
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.140008b00
test al, al
jne 0x14000d5a1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000d432
lea rdx, [0x1406cb9cc]
mov r8d, 1
call fcn.1400034d0
test al, al
jne 0x14000d5a1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x14000d3ea
xor r14d, r14d
lea rbx, [0x1406cbd39]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x14000d464
cmp byte [rax + rcx], 0x45
je 0x14000d5c3
sub r14, 1
jb 0x14000d489
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000d489
mov r8d, 2
mov rdx, rbx
call fcn.1400034d0
test al, al
jne 0x14000d5a1
mov rcx, rsi
call fcn.14000a320
test al, al
jne 0x14000d5a1
mov rax, qword [rsi]
test rax, rax
jne 0x14000d450
jmp 0x14000d3ea
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r9b, 1
cmp r11, r10
jae 0x14000d568
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x14000d502
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x14000d4ec
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x14000d4db
add dl, 0xa9
jmp 0x14000d4ea
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14000d568
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14000d568
movzx edx, bl
add rax, rdx
jae 0x14000d4b0
jmp 0x14000d568
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14000d568
cmp rax, rcx
jae 0x14000d565
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x14000d5bb
cmp qword [rsi + 0x20], 0
je 0x14000d5b4
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.14000d380
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x14000d3ec
mov r9b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000d5a9
mov eax, r9d
xor al, 1
movzx eax, al
lea r8, [rax + rax*8]
add r8, 0x10
lea rax, str.invalid_syntaxrecursion_limit_reached_for_______::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x1406cbd18]
test r9b, r9b
cmovne rdx, rax
call fcn.1400034d0
test al, al
je 0x14000d5a9
mov dil, 2
jmp 0x14000d3ea
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x14000d3ea
mov dil, 1
xor r9d, r9d
jmp 0x14000d56a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x14000d3ea