joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800064e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x670
mov r9d, edx
mov rdi, rcx
test rcx, rcx
je 0x180006743
cmp r9d, 0x40
jbe 0x180006743
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180006743
movsxd rcx, dword [rcx + 0x3c]
lea r8, [rcx + 0x108]
cmp r9, r8
jbe 0x180006743
cmp dword [rcx + rdi], 0x4550
lea rbx, [rcx + rdi]
jne 0x180006743
mov eax, 0x2002
test word [rbx + 0x16], ax
je 0x180006743
mov eax, 0x8664
cmp word [rbx + 4], ax
jne 0x180006743
mov eax, 0xf0
cmp word [rbx + 0x14], ax
jne 0x180006743
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x180006743
movzx ecx, word [rbx + 0x14]
xor ebp, ebp
movzx r8d, word [rbx + 6]
add rcx, 0x28
test r8, r8
je 0x1800065ba
mov edx, ebp
add rcx, rbx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx + 4]
add eax, dword [rcx]
cmp eax, r9d
ja 0x180006743
inc rdx
add rcx, 0x28
cmp rdx, r8
jl 0x1800065a0
xor edx, edx
mov qword [rsp + 0x680], rbp
mov r8d, 0x208
lea rcx, [rsp + 0x250]
call fcn.18000c580
xor edx, edx
lea rcx, [rsp + 0x460]
mov r8d, 0x208
call fcn.18000c580
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.18000c580
mov rcx, rdi
call fcn.180003a50
test eax, eax
je 0x180006729
movzx eax, word [rbx + 0x14]
lea rdx, [rsp + 0x460]
mov r9d, dword [rbx + 0x50]
lea rcx, [rsp + 0x250]
mov r8d, dword [rax + rbx + 0x4c]
sub r9d, r8d
call fcn.180003cb0
test eax, eax
je 0x180006729
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call fcn.180004730
test eax, eax
je 0x180006729
mov edx, 0x120089
mov dword [rsp + 0x20], 3
mov r8d, 7
lea rcx, [rsp + 0x460]
call fcn.180008d00
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180006729
mov edx, 0x12019f
mov qword [rsp + 0x688], rsi
mov r8d, 7
mov dword [rsp + 0x20], 2
lea rcx, [rsp + 0x40]
call fcn.180008d00
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800066dc
lea rax, [rsp + 0x680]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x250]
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.180005930
mov ebp, eax
test rbx, rbx
je 0x1800066fa
mov rcx, qword [0x18002ba00]
xor edx, edx
mov r9, rbx
mov rcx, qword [rcx + 0x60]
lea r8d, [rdx + 1]
call fcn.180002ff0
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18000671d
mov rcx, qword [0x18002ba00]
xor edx, edx
mov r9, rsi
mov rcx, qword [rcx + 0x60]
lea r8d, [rdx + 1]
call fcn.180002ff0
mov rsi, qword [rsp + 0x688]
test ebp, ebp
jne 0x180006739
lea r8, [rsp + 0x680]
mov rcx, rdi
call fcn.180006170
mov rax, qword [rsp + 0x680]
jmp 0x180006745
xor eax, eax
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800078e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword gs:[0x30]
mov r15d, r8d
mov ebp, edx
mov r14, rcx
mov r9, qword [rax + 0x60]
mov rsi, qword [r9 + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x180007a4e
xor r13d, r13d
lea r12, [0x180027d7c]
mov r8, qword [rdi + 0x50]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r8 + rbx*2], r13w
jne 0x180007940
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x90], rax
movups xmmword [rsp + 0x30], xmm0
lea edx, [rax + 0x3c]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call fcn.18000eb40
mov rdx, r13
test rbx, rbx
je 0x1800079bf
movzx eax, word [rsp + rdx*2 + 0x20]
lea ecx, [rax - 0x41]
cmp cx, 0x19
ja 0x1800079a9
add ax, 0x20
mov word [rsp + rdx*2 + 0x20], ax
cmp ax, 0x2e
je 0x1800079b9
inc rdx
cmp rdx, rbx
jb 0x180007992
jmp 0x1800079bf
mov word [rsp + rdx*2 + 0x20], r13w
mov edx, 0x811c9dc5
lea rcx, [rsp + 0x20]
lea r8, [rsp + 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], r13w
jne 0x1800079d5
add eax, eax
lea r8, [rsp + 0x20]
add r8, rax
lea rax, [rsp + 0x20]
cmp rax, r8
jae 0x180007a13
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jb 0x180007a00
lea rcx, [0x180027d78]
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r12
jb 0x180007a20
cmp edx, ebp
je 0x180007a45
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x180007932
jmp 0x180007a4e
mov rax, qword [rdi + 0x20]
test rax, rax
jne 0x180007a5c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x180007a67
mov edx, r15d
mov rcx, rax
call fcn.180007580
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180009950
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x60], 0
xorps xmm0, xmm0
mov dword [rbp - 0x58], 0x67452301
mov r14, r8
mov dword [rbp - 0x54], 0xefcdab89
mov rbx, rdx
mov dword [rbp - 0x50], 0x98badcfe
mov rdi, rcx
mov dword [rbp - 0x4c], 0x10325476
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rdx, rdx
je 0x1800099f8
mov dword [rbp - 0x60], edx
cmp rdx, 0x40
jb 0x1800099e4
nop dword [rax]
mov rdx, rdi
lea rcx, [rbp - 0x60]
call fcn.180008ea0
mov esi, eax
test eax, eax
jne 0x180009b40
add rdi, 0x40
sub rbx, 0x40
cmp rbx, 0x40
jae 0x1800099c0
test rbx, rbx
je 0x1800099f8
mov r8, rbx
lea rcx, [rbp - 0x48]
mov rdx, rdi
call fcn.18000bac0
mov edx, dword [rbp - 0x60]
lea rcx, [rbp - 0x48]
and edx, 0x3f
mov byte [rbp + rdx - 0x48], 0x80
inc edx
mov eax, edx
add rcx, rax
cmp edx, 0x38
ja 0x180009a25
mov r8d, 0x38
sub r8d, edx
xor edx, edx
call fcn.18000c580
jmp 0x180009a61
mov r8d, 0x40
sub r8d, edx
xor edx, edx
call fcn.18000c580
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x60]
call fcn.180008ea0
mov esi, eax
test eax, eax
jne 0x180009b40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x18], rax
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
mov ecx, dword [rbp - 0x60]
mov eax, dword [rbp - 0x5c]
lea edx, [rax*8]
mov eax, ecx
shr eax, 0x1d
lea ecx, [rcx*8]
or edx, eax
mov byte [rbp - 0x10], cl
mov eax, ecx
mov byte [rbp - 0xc], dl
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr edx, 0x18
shr ecx, 0x18
mov byte [rbp - 9], dl
lea rdx, [rbp - 0x48]
mov byte [rbp - 0xd], cl
lea rcx, [rbp - 0x60]
shr eax, 0x10
mov byte [rbp - 0xa], al
call fcn.180008ea0
mov esi, eax
test eax, eax
jne 0x180009b40
movzx eax, byte [rbp - 0x58]
mov byte [r14], al
movzx eax, byte [rbp - 0x57]
mov byte [r14 + 1], al
movzx eax, byte [rbp - 0x56]
mov byte [r14 + 2], al
movzx eax, byte [rbp - 0x55]
mov byte [r14 + 3], al
movzx eax, byte [rbp - 0x54]
mov byte [r14 + 4], al
movzx eax, byte [rbp - 0x53]
mov byte [r14 + 5], al
movzx eax, byte [rbp - 0x52]
mov byte [r14 + 6], al
movzx eax, byte [rbp - 0x51]
mov byte [r14 + 7], al
movzx eax, byte [rbp - 0x50]
mov byte [r14 + 8], al
movzx eax, byte [rbp - 0x4f]
mov byte [r14 + 9], al
movzx eax, byte [rbp - 0x4e]
mov byte [r14 + 0xa], al
movzx eax, byte [rbp - 0x4d]
mov byte [r14 + 0xb], al
movzx eax, byte [rbp - 0x4c]
mov byte [r14 + 0xc], al
movzx eax, byte [rbp - 0x4b]
mov byte [r14 + 0xd], al
movzx eax, byte [rbp - 0x4a]
mov byte [r14 + 0xe], al
movzx eax, byte [rbp - 0x49]
mov byte [r14 + 0xf], al
mov r9, qword [fcn.18000c580]
lea rcx, [rbp - 0x60]
xor edx, edx
lea r8d, [rdx + 0x58]
call r9
lea r11, [rsp + 0x80]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180016904
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180016934
xor eax, eax
jmp 0x1800169f7
mov rbp, rbx
cmp word [rax], si
je 0x180016959
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180016940
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18001693c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180016854
movsxd r14, eax
test eax, eax
jne 0x180016997
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18001692d
mov rcx, r14
call fcn.180012e80
mov rdi, rax
test rax, rax
jne 0x1800169b0
xor ecx, ecx
call fcn.180012e44
jmp 0x18001698c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180016854
test eax, eax
jne 0x1800169e1
mov rcx, rdi
call fcn.180012e44
jmp 0x1800169eb
xor ecx, ecx
call fcn.180012e44
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400ccf10
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x1400f4280]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r14, rcx
mov qword [rsp + 0x78], rcx
xor r15d, r15d
call fcn.1400cf1c0
call fcn.1400cf2b0
lea rcx, [rsp + 0x58]
call fcn.1400cee70
nop
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400cefd0
nop
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.1400cf120
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400cf1a0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.1400cf030
test al, al
jne 0x1400ccfde
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.1400cf050
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.1400cefe0
lea rcx, [rbp - 0x60]
call fcn.1400cf070
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.1400cf030
test al, al
je 0x1400ccfa2
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.1400cf0d0
nop
mov rdx, qword [r14]
add rdx, 8
lea rcx, [rbp - 0x20]
call fcn.1400cd570
nop
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x230]
call fcn.1400e5470
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x20]
call fcn.1400e5470
lea rdx, [rbp + 0x230]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, [0x1400e74a8]
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp qword [r14 + 8], 0
je 0x1400cd45b
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x1400cd45b
mov rcx, qword [r14 + 8]
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
sub r8, rdx
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400cd45b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov rsi, r15
mov qword [rbp - 0x70], r15
mov ecx, 7
mov qword [rbp - 0x68], rcx
mov word [rbp - 0x80], r15w
mov dword [rsp + 0x48], 1
mov rax, qword [r14 + 0x10]
cmp dword [rax], 1
jle 0x1400cd350
mov esi, 8
mov qword [rsp + 0x60], rsi
movzx ebx, byte [rsp + 0x40]
movzx edi, byte [rsp + 0x40]
Function at 0x1400cd570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
xor r8d, r8d
mov dword [rsp + 0x20], r8d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], 7
mov word [rcx], r8w
mov dword [rsp + 0x20], 1
mov r14d, r8d
lea r13d, [r8 - 6]
mov rax, qword [rdx + 8]
mov qword [rsp + 0x80], rax
mov r15, qword [rdx]
cmp r15, rax
je 0x1400cd6f7
movzx ebx, byte [rsp + 0x70]
nop word [rax + rax]
shl r14d, 8
movzx eax, byte [r15]
add r14d, eax
mov dword [rsp + 0x78], r14d
add r13d, 8
js 0x1400cd682
movsxd r12, r14d
movsxd rsi, r13d
lea ecx, [r13 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov ebp, edx
imul eax, edx, 0xfffffffa
add r13d, eax
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ntdll.dll
nop dword [rax]
mov rax, r12
mov rcx, rsi
sar rax, cl
and eax, 0x3f
movzx r9d, word [r14 + rax*2]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1400cd65f
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 7
jbe 0x1400cd652
mov rax, qword [rdi]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r8w
jmp 0x1400cd673
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.1400cc7b0
xor r8d, r8d
sub rsi, 6
sub rbp, 1
jne 0x1400cd620
mov r14d, dword [rsp + 0x78]
inc r15
cmp r15, qword [rsp + 0x80]
jne 0x1400cd5e0
cmp r13d, 0xfffffffa
jle 0x1400cd6f7
lea ecx, [r13 + 8]
shl r14d, 8
movsxd rax, r14d
sar rax, cl
and eax, 0x3f
lea r9, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ntdll.dll
movzx r9d, word [r9 + rax*2]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1400cd6e4
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 7
jbe 0x1400cd6d7
mov rax, qword [rdi]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r8w
jmp 0x1400cd6f7
movzx r8d, byte [rsp + 0x70]
mov edx, 1
mov rcx, rdi
call fcn.1400cc7b0
mov rcx, qword [rdi + 0x10]
test cl, 3
je 0x1400cd74f
mov esi, 0x3d
movzx ebx, byte [rsp + 0x70]
nop word [rax + rax]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1400cd732
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 7
jbe 0x1400cd72d
mov rax, qword [rdi]
mov dword [rax + rcx*2], esi
jmp 0x1400cd746
mov r9d, esi
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.1400cc7b0
mov rcx, qword [rdi + 0x10]
test cl, 3
jne 0x1400cd710
mov rax, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d05a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1400
call fcn.1400d3280
sub rsp, rax
mov rax, qword [0x1400f4280]
xor rax, rsp
mov qword [rsp + 0x13f0], rax
mov qword [0x1400f4f60], rcx
mov qword [0x1400f4f68], rdx
movzx edx, cx
mov dword [rsp + 0x13c4], 0xffffffff
mov dword [rsp + 0x44], edx
mov r8d, 1
mov eax, r8d
nop dword [rax]
nop word [rax + rax]
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [rsp + rax*4 + 0x44], edx
inc rax
cmp rax, 0x270
jb 0x1400d0600
mov dword [rsp + 0x40], 0x270
mov eax, 0xffffffff
nop dword [rax + rax]
inc r8
shr eax, 1
cmp eax, 1
ja 0x1400d0630
lea rax, [r8 + 7]
xor edx, edx
div r8
mov rcx, rax
mov qword [rsp + 0x13d0], rax
xor edx, edx
mov eax, 8
div rcx
mov qword [rsp + 0x13d8], rax
sub rcx, rdx
mov qword [rsp + 0x13c8], rcx
mov qword [rsp + 0x13e0], 0xffffffffffffffff
mov ecx, 0x20
call fcn.1400d2c14
mov rsi, rax
mov qword [rsp + 0x20], rax
lea rdi, [rax + 0x20]
mov qword [rsp + 0x30], rdi
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x28], rdi
mov rbx, rax
cmp rax, rdi
je 0x1400d06c6
nop dword [rax]
lea rcx, [rsp + 0x40]
call fcn.1400d00f0
mov word [rbx], ax
add rbx, 2
cmp rbx, rdi
jne 0x1400d06b0
mov rdx, rsi
lea rcx, [0x1400f4f80]
call fcn.1400d1e30
nop
test rsi, rsi
je 0x1400d0710
sub rdi, rsi
sar rdi, 1
add rdi, rdi
cmp rdi, 0x1000
jb 0x1400d0705
add rdi, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x1400d0735
mov rsi, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.1400d2c50
mov rcx, qword [rsp + 0x13f0]
xor rcx, rsp
call fcn.1400d2cf0
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.1400d98cc
int3
Function at 0x1400d1170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push r12
push r14
sub rsp, 0x30
xor r12d, r12d
mov r14, rdx
mov rsi, rcx
test rcx, rcx
jne 0x1400d1194
xor eax, eax
add rsp, 0x30
pop r14
pop r12
pop rsi
ret
movsxd rax, dword [rcx + 0x3c]
mov qword [rsp + 0x58], rbx
add rax, rsi
mov qword [rsp + 0x68], rdi
mov edi, r12d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov r13d, dword [rax + 0x88]
add r13, rsi
mov qword [rsp + 0x50], rax
mov ebx, dword [r13 + 0x20]
mov r15d, dword [r13 + 0x18]
add rbx, rsi
test r15d, r15d
je 0x1400d1251
mov qword [rsp + 0x60], rbp
mov rbp, qword [rdx + 0x10]
nop
mov edx, dword [rbx]
mov rax, 0xffffffffffffffff
add rdx, rsi
nop dword [rax]
inc rax
cmp byte [rdx + rax], r12b
jne 0x1400d11f0
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x1400d1206
mov rcx, qword [r14]
cmp rbp, rax
jne 0x1400d1217
mov r8, rbp
call fcn.1400e58b0
test eax, eax
je 0x1400d1224
inc edi
add rbx, 4
cmp edi, r15d
jb 0x1400d11e0
jmp 0x1400d124c
mov eax, dword [r13 + 0x24]
mov r8, qword [rsp + 0x50]
add rax, rsi
movsxd rcx, edi
movzx edx, word [rax + rcx*2]
mov ecx, dword [r13 + 0x1c]
add rcx, rsi
mov ecx, dword [rcx + rdx*4]
mov rdx, rsi
call fcn.1400d1a10
mov r12, rax
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov rax, r12
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rsi
ret

Function at 0x1400d1dc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
xor r10d, r10d
mov r9, rdx
mov r11, rcx
mov ebx, r10d
test r8d, r8d
je 0x1400d1e23
mov qword [rsp + 0x10], rdi
mov edi, r8d
nop dword [rax + rax]
lea eax, [r10 + 1]
movzx r10d, al
lea r9, [r9 + 1]
movzx edx, byte [r10 + r11]
lea eax, [rbx + rdx]
movzx ebx, al
movzx eax, byte [rbx + r11]
mov byte [r10 + r11], al
mov byte [rbx + r11], dl
movzx ecx, byte [r10 + r11]
add rcx, rdx
movzx eax, cl
movzx ecx, byte [rax + r11]
xor byte [r9 - 1], cl
sub rdi, 1
jne 0x1400d1de0
mov rdi, qword [rsp + 0x10]
pop rbx
ret

Function at 0x1400d38b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d38fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d38fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d38fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d38fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d38fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d38fc
xor al, al
add rsp, 0x28
ret
Function at 0x1400d9aa8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400d9adf
call fcn.1400dc608
mov dword [rax], 0x16
call fcn.1400d98ac
xor eax, eax
jmp 0x1400d9b6d
mov rdx, r9
mov rcx, r8
call fcn.1400d9a44
mov rbx, rax
test rax, rax
je 0x1400d9b6a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400d9970]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400d9b57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400dc57c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400d9b3e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400d9b4d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400dc6a0
jmp 0x1400d9b6a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400d9b67
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400da430
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400da29b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400da29b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400da29b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400da29b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400da29b
cmp dword [rcx + 0x84], 0xe
jbe 0x1400da29b
cmp dword [rcx + 0xf8], 0
je 0x1400da29b
mov ecx, ebx
call fcn.1400da34c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400da128
nop
cmp dword [rbp + 0x20], 0
je 0x1400da2e9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400da2f4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400da22c
Function at 0x1400deb70
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400deb86
mov al, 1
jmp 0x1400debe6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400deb97
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400debe4
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400e1060
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400debe4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400debe4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400debe4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400debe6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400e06c0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400e06f0
xor eax, eax
jmp 0x1400e07b3
mov rbp, rbx
cmp word [rax], si
je 0x1400e0715
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400e06fc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400e06f8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400e05e0
movsxd r14, eax
test eax, eax
jne 0x1400e0753
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400e06e9
mov rcx, r14
call fcn.1400decb8
mov rdi, rax
test rax, rax
jne 0x1400e076c
xor ecx, ecx
call fcn.1400dc6a0
jmp 0x1400e0748
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400e05e0
test eax, eax
jne 0x1400e079d
mov rcx, rdi
call fcn.1400dc6a0
jmp 0x1400e07a7
xor ecx, ecx
call fcn.1400dc6a0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret