joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001570
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rbp, qword [0x1400087d8]
add rbp, 2
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
movzx r10d, r8b
movzx eax, al
add r10b, r10b
imul eax, eax, 0x1b
add bl, bl
movzx ecx, byte [rbp + 1]
mov byte [rsp + 0x98], dl
add dl, dl
mov byte [rsp + 0x88], r9b
mov byte [rsp + 0x90], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
shr al, 7
movzx eax, al
imul r14d, eax, 0x1b
xor bl, r14b
movzx eax, bl
movzx r9d, bl
shr al, 7
add r9b, r9b
movzx eax, al
imul eax, eax, 0x1b
xor r9b, al
mov dword [rsp + 0xc], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r10b, r12b
movzx eax, r10b
movzx r8d, r10b
shr al, 7
xor r10b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul r13d, eax, 0x1b
xor r8b, bpl
xor cl, r13b
mov dword [rsp + 0x10], r13d
movzx eax, cl
shr al, 7
movzx eax, al
imul r15d, eax, 0x1b
movzx eax, cl
add al, al
xor al, r15b
xor r10b, al
mov byte [rsp + 0x80], al
shr al, 7
xor r10b, r8b
movzx eax, al
xor r10b, r9b
imul edi, eax, 0x1b
xor r10b, sil
movzx eax, r8b
mov byte [rsp], r10b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r9b
shr al, 7
movzx eax, al
imul r10d, eax, 0x1b
movzx eax, sil
xor byte [rsp + 0x80], cl
shr al, 7
movzx eax, al
imul edx, eax, 0x1b
mov r13, qword [rsp + 0x18]
movzx eax, byte [rsp]
xor al, byte [rsp + 0x88]
xor al, byte [rsp + 0x98]
add al, al
movzx ecx, byte [rsp + 0x80]
xor al, dl
xor cl, r8b
xor al, r10b
mov r8d, dword [rsp + 0xc]
xor al, r11b
xor cl, r9b
xor al, dil
movzx r9d, byte [r13 + 1]
xor al, bpl
xor cl, bl
xor al, r14b
movzx ebx, byte [rsp + 0x90]
xor al, byte [rsp + 4]
xor cl, sil
xor al, byte [rsp + 8]
xor al, byte [r13 + 1]
xor al, byte [rsp + 0x90]
xor al, byte [rsp + 0x88]
movzx esi, byte [rsp + 0x88]
mov byte [r13 - 2], al
movzx eax, cl
xor al, bl
xor cl, r9b
xor al, sil
add al, al
xor al, dl
xor al, r10b
xor al, r11b
xor al, dil
xor al, r15b
xor al, r12b
xor al, r8b
xor al, r14b
mov r14, r13
movzx r14d, byte [rsp + 0x98]
xor al, r9b
xor al, bl
xor cl, r14b
xor al, r14b
add cl, cl
mov byte [r13 - 1], al
xor cl, dl
mov r13d, dword [rsp + 0x10]
xor cl, r10b
movzx eax, byte [rsp]
xor cl, r11b
xor al, r9b
xor cl, dil
xor al, bl
xor cl, r15b
add al, al
xor cl, r13b
xor al, dl
xor cl, r8b
xor cl, byte [rsp + 8]
xor al, r10b
xor al, r11b
xor al, dil
xor al, r13b
xor al, bpl
mov rbp, qword [rsp + 0x18]
xor al, r12b
xor al, byte [rsp + 4]
xor al, r9b
xor al, sil
xor al, r14b
mov byte [rbp], al
xor cl, bl
xor cl, sil
xor cl, r14b
mov byte [rbp + 1], cl
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x1400015a0
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001810
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1400087d8]
lea r8, [0x140008880]
sub r8, rbx
mov rcx, rbx
mov r9d, 4
nop
mov edx, 4
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140001850
sub r9, 1
jne 0x140001840
lea rdi, [0x140008870]
mov sil, 9
sub rdi, rbx
lea rbp, [0x1400058a0]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + rbp]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400018f0
inc r8
sub r9, 1
jne 0x1400018e0
mov rax, rbx
lea r8d, [rdx + 4]
nop dword [rax]
nop dword [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140001930
sub r8, 1
jne 0x140001920
call fcn.140001570
sub rdi, 0x10
add sil, 0xff
jne 0x140001880
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop word [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + rbp]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400019d0
inc r8
sub r9, 1
jne 0x1400019c0
lea rdx, [0x1400087e0]
sub rdx, rbx
lea r8d, [r9 + 4]
nop dword [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rdx + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140001a10
sub r8, 1
jne 0x140001a00
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140001c80
Capabilities:
Inspect section memory permissions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, r8
mov r15, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebp, ebp
mov rcx, rsi
mov dword [rsp + 0x20], ebp
call fcn.140002850
mov ebx, eax
lea edi, [rbp + 2]
test eax, eax
je 0x140001cfe
lea r9, [rsp + 0x20]
mov edx, ebx
lea r8d, [rbp + 4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001d19
mov r8d, ebx
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x20]
mov r8d, edi
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001d19
lea r9, [rsp + 0x20]
mov r8d, 4
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001d20
xor al, al
jmp 0x140001e3f
mov qword [rsp + 0x88], r12
mov r8, r14
mov rdx, r15
mov qword [rsp + 0x30], r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x24]
mov dword [rsp + 0x24], ebp
mov r8d, edi
mov edx, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, r14
mov rcx, r15
mov r12b, 1
call fcn.140002a98
mov r13, rax
test rax, rax
je 0x140001e2c
nop
mov r8, rbp
mov rdx, r14
mov rcx, r15
call fcn.1400029f4
mov rdi, rax
test rax, rax
je 0x140001e2c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.AAAAAAAAAAAAAAA_
mov ebx, dword [rax + 0x24]
call fcn.140001a40
mov ecx, ebx
and ecx, 0xe0000000
cmp ecx, 0xe0000000
jne 0x140001db8
mov r8d, 0x40
jmp 0x140001dfd
mov eax, ebx
and eax, 0x60000000
cmp eax, 0x60000000
jne 0x140001dce
mov r8d, 0x20
jmp 0x140001dfd
bt ebx, 0x1d
jae 0x140001ddc
mov r8d, 0x20
jmp 0x140001dfd
mov eax, ebx
mov r8d, 4
and eax, 0xc0000000
cmp eax, 0xc0000000
je 0x140001dfd
bt ebx, 0x1e
mov eax, 2
cmovb r8d, eax
mov ecx, dword [rdi + 0xc]
lea r9, [rsp + 0x24]
mov edx, dword [rdi + 8]
add rcx, rsi
inc rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
movzx ecx, r12b
test eax, eax
cmovne edx, ecx
movzx r12d, dl
cmp rbp, r13
jb 0x140001d70
mov r13, qword [rsp + 0x30]
test r12b, r12b
mov r12, qword [rsp + 0x88]
setne al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140003e00
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001f00
Capabilities:
Enumerate files on windows
Get common file path
Read file on windows

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x938
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x920], rax
mov r15, rcx
mov edx, 0x208
lea rcx, [rsp + 0x510]
mov r14, r8
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str..dll
mov edx, 0x208
lea rcx, [rsp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14000213f
mov qword [rsp + 0x930], r12
mov r12d, 0x20b
mov qword [rsp + 0x968], rbx
mov qword [rsp + 0x970], rdi
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140002101
mov edx, 0x208
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140005ac0]
mov edx, 0x208
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [rsp + 0x9c]
mov edx, 0x208
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x40], esi
mov rcx, r15
mov dword [rsp + 0x20], 3
mov rdi, rsi
lea r8d, [r9 + 1]
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
lea rcx, [rsp + 0x2c0]
mov r8d, 0x248
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x48]
mov r8d, 0x248
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x2c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jns 0x140002079
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rax, dword [rsp + 0x2fc]
cmp eax, 0x100
jg 0x140002097
lea rax, [rsp + rax + 0x2c0]
test rax, rax
je 0x1400020f3
jmp 0x1400020e9
mov dword [rsp + 0x58], eax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x48]
mov r8d, 0x248
lea rdx, [rsp + 0x2c0]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jns 0x1400020e1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Git.exe
call fcn.140001a40
lea rax, [rsp + 0x2c0]
cmp word [rax + 0x18], r12w
jne 0x1400020f3
mov edi, dword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14, rdi
jb 0x140002119
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140001fa0
jmp 0x14000211e
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r12, qword [rsp + 0x930]
mov rdi, qword [rsp + 0x970]
mov rbx, qword [rsp + 0x968]
mov eax, esi
mov rcx, qword [rsp + 0x920]
xor rcx, rsp
call fcn.140003e00
add rsp, 0x938
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x140002450
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov eax, 0x20
lea rcx, str.hagrid
xor edi, edi
mov word [rsp + 0x38], ax
mov ebp, edi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14000252c
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov rbx, rax
test rax, rax
je 0x14000252c
mov qword [rsp + 0x270], rsi
lea rsi, [rsp + 0x20]
mov qword [rsp + 0x278], r14
mov r14, 0xffffffffffffffff
nop
mov rcx, r14
inc rcx
cmp byte [rbx + rcx], dil
jne 0x1400024d3
add rcx, 1
cmovb rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsi], rax
nop dword [rax]
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1400024f0
lea rdx, [rsp + 0x38]
xor ecx, ecx
inc ebp
add rsi, 8
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov rbx, rax
test rax, rax
jne 0x1400024d0
mov r14, qword [rsp + 0x278]
mov rsi, qword [rsp + 0x270]
mov rdx, qword [rsp + 0x20]
lea r9, str.cdll
mov rax, rdi
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r9 + rax - 1]
jne 0x140002559
cmp rax, 5
jne 0x140002540
cmp cl, byte [r9 + rax - 1]
sete bl
lea r8, str.mdll
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140002590
cmp rcx, 5
jne 0x140002570
jmp 0x1400025a4
movzx eax, byte [rdx + rdi]
inc rdi
cmp al, byte [r9 + rdi - 1]
jne 0x1400025e8
cmp rdi, 5
jne 0x140002590
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
cmp ebp, 3
jge 0x1400025c0
xor r8d, r8d
jmp 0x1400025db
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
movzx edx, bl
call fcn.140002160
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140003e00
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000294c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14000297d
test rdx, rdx
je 0x14000298f
mov r9d, 0x40
mov r8, rcx
call fcn.1400038fc
test al, al
jne 0x14000299d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x40
call fcn.140003920
test al, al
jne 0x14000297d
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14000297d
cmp dword [rbx + 0x3c], 0x400
jg 0x14000297d
movsxd rdi, dword [rbx + 0x3c]
add rdi, rbx
test rsi, rsi
je 0x1400029d6
mov r9d, 0xf8
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1400038fc
test al, al
jne 0x1400029e7
jmp 0x14000297d
mov edx, 0xf8
mov rcx, rdi
call fcn.140003920
test al, al
jne 0x14000297d
cmp dword [rdi], 0x4550
jne 0x14000297d
mov rax, rdi
jmp 0x14000297f
Function at 0x1400034f4
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r12, rdx
mov qword [rax - 0x28], rbx
xor r9d, r9d
mov dword [rax - 0x30], 0x80
mov edx, 0x80000000
mov r14, rcx
mov dword [rax - 0x38], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000354d
xor eax, eax
jmp 0x140003658
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rax, rax
jne 0x14000357b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003546
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
jne 0x1400035a6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003570
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp qword [r12], rbx
je 0x1400035c2
cmp qword [r12], rdi
cmovbe rdi, qword [r12]
mov rdx, rdi
mov rcx, r15
call fcn.140003920
test al, al
je 0x140003610
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.____Mapping_of
call fcn.140001a40
mov rcx, rax
mov rdx, r14
call fcn.140001a40
mov rcx, rax
lea rdx, str._is_invalid_
call fcn.140001a40
mov rcx, rax
lea rdx, [0x1400034b4]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000363a
mov rcx, rdi
call fcn.1400038b4
mov r14, rax
test rax, rax
je 0x140003630
mov r8, rdi
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140003633
mov rdi, rbx
mov qword [r12], rdi
mov rbx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret

Function at 0x140004778
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400047c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400047c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400047c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400047c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400047c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400047c4
xor al, al
add rsp, 0x28
ret
Function at 0x14000c5e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c62a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c62a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c62a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c62a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c62a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c62c
xor al, al
add rsp, 0x28
ret
Function at 0x1400026a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400026ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400026ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400026ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400026ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400026ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400026ec
xor al, al
add rsp, 0x28
ret
Function at 0x1407d9bb0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407d9d37
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407d9be1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407d9bc7
add dl, dl
jne 0x1407d9bee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407d9c4e
xor eax, eax
add dl, dl
jne 0x1407d9bfd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407d9d05
add dl, dl
jne 0x1407d9c0e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407d9c1b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407d9c28
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407d9c35
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407d9c42
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407d9bd6
mov eax, 1
add dl, dl
jne 0x1407d9c5e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407d9c6b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407d9c53
sub eax, ebx
mov ebx, 1
jne 0x1407d9ca4
mov ecx, 1
add dl, dl
jne 0x1407d9c86
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407d9c93
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407d9c7b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407d9bd6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407d9cc0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407d9ccd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407d9cb5
cmp eax, 0x7d00
jae 0x1407d9cf3
cmp eax, 0x500
jb 0x1407d9cee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407d9bd6
cmp eax, 0x7f
ja 0x1407d9cf6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407d9bd6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407d9d2a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407d9bd6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400023d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov rcx, qword [rdi + 0x288]
movabs rax, 0x20c49ba5e353f7cf
imul rcx, rbx
imul rcx
mov rbx, rdx
sar rbx, 7
mov rax, rbx
shr rax, 0x3f
add rbx, rax
add rbx, qword [rsp + 0x30]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
cmp qword [rsp + 0x40], rbx
jle 0x140002420
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140005a20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov edi, 0x80004005
lea rcx, [rsp + 0x30]
call fcn.140002a40
nop
xor esi, esi
mov ebx, esi
cmp qword [rsp + 0x30], rbx
je 0x140005aae
mov ecx, 0xd0
call fcn.14001bb90
mov qword [rsp + 0x290], rax
test rax, rax
je 0x140005a71
mov rcx, rax
call fcn.140004f40
mov rbx, rax
jmp 0x140005a74
mov rbx, rsi
test rbx, rbx
je 0x140005aae
mov rcx, rbx
call fcn.140005580
mov edi, eax
test eax, eax
js 0x140005aae
lfence
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140005c30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov qword [rbx + 0xb8], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140005ac5
lock inc dword [rax + 8]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002bb0
test edi, edi
jns 0x140005bcd
test rbx, rbx
je 0x140005bcd
mov dword [rbx], 1
cmp qword [rbx + 8], 0
je 0x140005b05
lfence
mov rcx, qword [rbx + 8]
call qword [sym.imp.kernel32.dll_SetEvent]
cmp qword [rbx + 0x28], 0
je 0x140005baf
lfence
xor eax, eax
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x6c], eax
xor edx, edx
mov r8d, 0x1fb
lea rcx, [rsp + 0x84]
call fcn.14003adb0
mov dword [rsp + 0x50], 7
mov dword [rsp + 0x5c], esi
mov rax, qword [rbx + 8]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x3000
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x70], rax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], 0x1000
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayAccessData
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, 0x22f
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 0x28]
call fcn.140003140
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x40], rsi
cmp qword [rbx + 0x20], 0
je 0x140005baf
lfence
mov rcx, qword [rbx + 0x20]
call fcn.14003fccc
mov qword [rbx + 0x20], rsi
lfence
mov rcx, rbx
call fcn.140005140
lfence
mov edx, 0xd0
mov rcx, rbx
call fcn.14001bbcc
mov rbx, rsi
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140005c11
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140005c11
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x14002508a.0]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x140005c11
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14002508a.0]
mov rax, rbx
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret