joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2546a9740
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
cmp edx, 1
je 0x2546a9758
mov eax, 1
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov ecx, 2
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenThread]
lea r8, [0x2546a9460]
xor edx, edx
xor ecx, ecx
mov r9, rax
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, 0xf
mov rcx, rax
call rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xfffffff1
mov rcx, rax
call rbx
mov eax, 1
add rsp, 0x40
pop rbx
ret

Function at 0x2546a9db0
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rcx
test dl, dl
je 0x2546a9dc0
ret
jmp fcn.2546aa3a0

Function at 0x2546a9dd0
Capabilities:
Log keystrokes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov ebx, ecx
mov edi, edx
mov rsi, r8
xor edx, edx
mov ebp, r9d
movzx ecx, cl
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp ebx, 0x5d
jg 0x2546a9ea0
cmp ebx, 0x20
jg 0x2546a9e38
cmp ebx, 0x13
je 0x2546a9e4b
test rsi, rsi
je 0x2546a9e55
mov rcx, rsi
test bpl, bpl
je 0x2546a9ec0
cmp edi, 1
mov edx, 0x100
movsxd r8, ebx
sbb edx, 0xffffffff
xor r9d, r9d
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.USER32.dll_PostMessageW]
movabs rcx, 0x1c000000000038ff
lea edx, [rbx - 0x21]
bt rcx, rdx
jae 0x2546a9e00
or edi, 1
nop
test rsi, rsi
jne 0x2546a9e05
mov word [rsp + 0x28], bx
lea rdx, [rsp + 0x20]
mov r8d, 0x28
mov ecx, 1
mov dword [rsp + 0x20], 1
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.USER32.dll_SendInput]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp ebx, 0xa3
je 0x2546a9e4b
lea edx, [rbx - 0xa5]
cmp edx, 0xf
ja 0x2546a9e00
or edi, 1
jmp 0x2546a9e50
call fcn.2546aa3a0
mov rcx, rax
jmp 0x2546a9e11

Function at 0x2546aa3a0
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], ecx
lea rcx, [0x2546aa320]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x2546ab5b0
Capabilities:
Get graphical window text

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov rbx, rcx
call fcn.2546ab1a0
lea r8, str.is_valid_failed.
test al, al
jne 0x2546ab5d8
mov rax, r8
add rsp, 0x28
pop rbx
pop r12
ret
lea r12, [rbx + 8]
mov r8d, 0x200
mov rcx, qword [rbx]
mov rdx, r12
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea r8, [0x254898204]
test eax, eax
jle 0x2546ab5ca
mov edx, 8
mov ecx, 0x64
call sub.msvcrt.dll_calloc
mov r8, rax
test rax, rax
je 0x2546ab5ca
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov r8, rax
mov rax, r8
add rsp, 0x28
pop rbx
pop r12
ret
Function at 0x2546b1490
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.2546b2a00
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.2546b2a00
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x2546b1500
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x254931774]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x2546b16b0
mov rax, qword [0x254931778]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x2546b154c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x2546b15d7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x2546b1530
mov rcx, r12
call fcn.2546b1da0
mov rbp, rax
test rax, rax
je 0x2546b170d
mov rax, qword [0x254931778]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.2546b1ed0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x254931778]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x2546b16f2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x2546b15d0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x2546b1660
add dword [0x254931774], 1
cmp ebx, 8
jae 0x2546b1608
test bl, 4
jne 0x2546b16c0
test ebx, ebx
je 0x2546b15f9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x2546b16e0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x2546b15f9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x2546b163a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x254931778]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x2546b15d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.2546b1490
xor edi, edi
jmp 0x2546b1557
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x2546b15f9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x2546b15f9
mov rax, qword [0x254931778]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.2546b1490
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.2546b1490
nop
nop dword [rax]
Function at 0x2546b1a10
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x2549317a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x254931780]
test rbx, rbx
je 0x2546b1a64
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x2546b1a5b
test r12, r12
je 0x2546b1a5b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x2546b1a40
lea rcx, [0x2549317a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x2546b1da0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x2548987b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x2546b1e19
mov rcx, r10
call fcn.2546b1c70
test eax, eax
je 0x2546b1e19
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x2546b1e16
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x2546b1e0d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x2546b1e19
add r8, 0x28
cmp r8, r9
jne 0x2546b1df8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140003780
Capabilities:
Hash data using fnv

Disassembly:
movzx eax, byte [rcx]
test al, al
jne 0x14000378a
mov eax, edx
ret
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
jmp fcn.140003780
Function at 0x140003a60
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x14003b008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 + 0x10], rbx
mov rbx, rcx
mov qword [r11 - 0x20], rsi
mov ecx, 0x40
mov qword [r11 - 0x28], rdi
mov rdi, rdx
movsxd r15, r8d
mov rdx, r15
mov esi, r8d
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov rdx, r15
mov ecx, 0x40
mov rbp, rax
call qword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov r8, r15
xor edx, edx
mov rcx, rbp
mov r14, rax
call fcn.14000ab70
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.14000ab70
mov r8, r15
mov rdx, rbx
mov rcx, r14
call fcn.14000ad30
xor eax, eax
lea rcx, [rsp + 0x20]
mov rdx, rdi
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rax
call fcn.140001070
mov rbx, r14
cmp esi, 0x10
jl 0x140003bc8
movaps xmmword [rsp + 0x260], xmm6
lea rdi, [rsp + 0x230]
movdqa xmm6, xmmword [rsp + 0x230]
sub rdi, r14
shr rsi, 4
movaps xmmword [rsp + 0x250], xmm7
nop word [rax + rax]
movups xmm7, xmmword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140001bb0
lea rax, [rsp + 0x23f]
cmp rbx, rax
ja 0x140003b92
lea rax, [rbx + 0xf]
lea rcx, [rsp + 0x230]
cmp rax, rcx
jb 0x140003b92
mov rax, rbx
mov edx, 0x10
nop dword [rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140003b80
jmp 0x140003b9e
movdqu xmm0, xmmword [rbx]
pxor xmm0, xmm6
movdqu xmmword [rbx], xmm0
add rbx, 0x10
movdqa xmmword [rsp + 0x230], xmm7
sub rdi, 0x10
movaps xmm6, xmm7
sub rsi, 1
jne 0x140003b40
movaps xmm7, xmmword [rsp + 0x250]
movaps xmm6, xmmword [rsp + 0x260]
mov rdi, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x278]
mov rbx, qword [rsp + 0x2a8]
test r15, r15
je 0x140003bfa
test rbp, rbp
jne 0x140003c28
call fcn.14000e0d4
mov dword [rax], 0x16
call fcn.14000daa0
test r14, r14
je 0x140003c08
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_LocalFree]
mov rax, rbp
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400079f0
add rsp, 0x280
pop r15
pop r14
pop rbp
ret
mov r8, r15
mov rcx, rbp
test r14, r14
je 0x140003c3d
mov rdx, r14
call fcn.14000ad30
jmp 0x140003bfa
xor edx, edx
call fcn.14000ab70
call fcn.14000e0d4
mov dword [rax], 0x16
call fcn.14000daa0
jmp 0x140003c08
Function at 0x1400053e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003b008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000540d
xor eax, eax
jmp 0x140005553
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005447
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140005447
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140005553
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140005546
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000548a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140005499
movsx ecx, dil
jmp 0x1400054ed
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140005546
cmp eax, 1
jle 0x140005507
cmp eax, 3
jne 0x140005546
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14000cf98
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000554b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005534
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14000df98
cmp rsi, rax
jne 0x140005546
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000554b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400079f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140006df0
Capabilities:
Allocate or change rwx memory
Resolve function by parsing pe exports

Disassembly:
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14003b008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8, qword [rcx]
movabs rax, 0xffffffff00000000
mov r11d, dword [rcx + 0x50]
mov r15, rcx
neg r11d
movzx ebx, word [r8 + 0x14]
mov r12, qword [r8 + 0x30]
add rbx, r8
and r12, rax
mov r10d, dword [rbx + 0x20]
mov r9d, dword [rbx + 0x28]
or r10, r12
and r11, r10
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], r11
test r9d, r9d
jne 0x140006e65
mov eax, dword [rbx + 0x3c]
test al, 0x40
je 0x140006e5d
mov r9d, dword [r8 + 0x20]
jmp 0x140006e65
test al, al
jns 0x140006e65
mov r9d, dword [r8 + 0x24]
mov edx, dword [rbx + 0x3c]
mov r13d, 1
mov r14d, r13d
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x38], 0
cmp r13w, word [r8 + 6]
jae 0x140006f58
add rbx, 0x64
nop dword [rax]
mov edi, dword [r15 + 0x50]
mov ebp, dword [rbx - 0x1c]
neg edi
mov esi, dword [rbx - 0x14]
or rbp, r12
and rdi, rbp
test esi, esi
jne 0x140006eda
mov eax, dword [rbx]
test al, 0x40
je 0x140006ed2
mov esi, dword [r8 + 0x20]
jmp 0x140006eda
test al, al
jns 0x140006eda
mov esi, dword [r8 + 0x24]
cmp r11, rdi
je 0x140006f1d
mov eax, r9d
add rax, r10
cmp rax, rdi
ja 0x140006f1d
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.140006d00
test eax, eax
je 0x140007005
mov edx, dword [rbx]
mov r10, rbp
mov r8, qword [r15]
mov r11, rdi
mov qword [rsp + 0x20], rbp
mov r9d, esi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], esi
jmp 0x140006f3f
mov ecx, dword [rbx]
mov eax, ecx
and eax, edx
or edx, ecx
bt eax, 0x19
jb 0x140006f2f
btr edx, 0x19
mov r9d, ebp
sub r9d, dword [rsp + 0x20]
add r9d, esi
mov dword [rsp + 0x30], r9d
movzx eax, word [r8 + 6]
inc r14d
add rbx, 0x28
mov dword [rsp + 0x34], edx
cmp r14d, eax
jl 0x140006eb0
test r9d, r9d
je 0x140006f7a
bt edx, 0x19
jae 0x140006fb0
cmp r10, r11
jne 0x140006f7a
mov edx, r9d
mov r8d, 0x4000
mov rcx, r10
call qword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, r13d
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400079f0
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
mov ecx, edx
mov eax, edx
shr rax, 0x1e
and eax, r13d
shr rcx, 0x1d
and ecx, r13d
lea rcx, [rax + rcx*2]
mov eax, edx
shr rax, 0x1f
lea rcx, [rax + rcx*2]
lea rax, [0x140035880]
mov eax, dword [rax + rcx*4]
mov r8d, eax
bts r8d, 9
mov rcx, r10
and edx, 0x4000000
mov edx, r9d
lea r9, [rsp + 0x40]
cmove r8d, eax
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x140006f7a
xor eax, eax
jmp 0x140006f7d
Function at 0x140007740
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
mov dword [rbp - 0x40], 0xc688c695
mov qword [rcx], rsi
mov edx, esi
mov qword [rcx + 8], rsi
mov rbx, rcx
mov qword [rcx + 0x10], rsi
mov r8d, 0x3905
mov dword [rcx + 0x18], esi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x28], rsi
mov dword [rbp - 0x3c], 0xc692c699
mov dword [rbp - 0x38], 0xc72ec693
mov dword [rbp - 0x34], 0xc76ec765
mov dword [rbp - 0x30], 0xc76f
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x40]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 9
jb 0x1400077a0
lea rcx, [rbp - 0x40]
mov word [rbp - 0x2e], si
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x140007896
movdqa xmm0, xmmword [0x140035b70]
mov edx, esi
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x7c5d6264
mov dword [rbp - 0x14], 0x61747360
mov word [rbp - 0x10], 0x60
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x28]
add rcx, rax
lea eax, [rdx - 5]
inc edx
xor byte [rcx], al
cmp edx, 0x19
jb 0x140007800
lea rdx, [rbp - 0x28]
mov byte [rbp - 0xf], sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
movdqa xmm0, xmmword [0x140035b80]
mov edx, esi
mov qword [rbx + 0x20], rax
xor eax, eax
mov byte [rbp - 0x10], al
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x6f607e64
mov dword [rbp - 0x14], 0x7c7e797b
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x28]
add rcx, rax
lea eax, [rdx - 5]
inc edx
xor byte [rcx], al
cmp edx, 0x18
jb 0x140007850
lea rdx, [rbp - 0x28]
mov byte [rbp - 0x10], sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [rbx + 0x28], rax
cmp qword [rbx + 0x20], rsi
je 0x140007896
test rax, rax
mov rax, rbx
je 0x140007899
mov dword [rbx + 0x18], 0x10000
mov qword [rbx + 8], rsi
jmp 0x140007899
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret

Function at 0x14000ff1c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000fd48
Function at 0x1510015b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x47
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x6c
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x38], 0x6f
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x38], 0x62
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x61
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x38], 0x6c
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x38], 0x5c
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x38], 0x55
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x4e
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x38], 0
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x38], 0
mov qword [rsp + 0x28], 0xffffffffffffffff
jmp fcn.1511dc37e
Function at 0x151001cb0
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub rsp, 0x58
lea rcx, [0x151009090]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x151001cd4
lea rax, str.._service.ini
mov qword [rsp + 0x30], rax
jmp 0x151001ce0
lea rax, str..._service.ini
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [0x15100c410], rax
call fcn.1510039c0
call fcn.151003460
lea rcx, [0x1510090c0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x151001d85
lea rdx, [0x15100892c]
lea rcx, str..._resource.ini
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x151001d85
lea rax, str._SERVICE__r_nRES_EN__r_n
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], 0xffffffffffffffff
inc qword [rsp + 0x20]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
cmp byte [rax + rcx], 0
jne 0x151001d48
mov rax, qword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
add rsp, 0x58
ret
Function at 0x151004a30
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x28
ret
Function at 0xc6a160
Capabilities:
Decompress data using aplib

Disassembly:
call 0xc6a2e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xc6a191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xc6a177
add dl, dl
jne 0xc6a19e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xc6a1fe
xor eax, eax
add dl, dl
jne 0xc6a1ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xc6a2b5
add dl, dl
jne 0xc6a1be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc6a1cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc6a1d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc6a1e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xc6a1f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xc6a186
mov eax, 1
add dl, dl
jne 0xc6a20e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc6a21b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xc6a203
sub eax, ebx
mov ebx, 1
jne 0xc6a254
mov ecx, 1
add dl, dl
jne 0xc6a236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc6a243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xc6a22b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xc6a186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc6a270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc6a27d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xc6a265
cmp eax, 0x7d00
jae 0xc6a2a3
cmp eax, 0x500
jb 0xc6a29e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xc6a186
cmp eax, 0x7f
ja 0xc6a2a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xc6a186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xc6a2da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xc6a186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20