joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55f250
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
nop
lea rcx, [rbp + 0x38]
xor edx, edx
call fcn.00409b40
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x38]
mov r8b, 1
call fcn.0055ec10
lea rcx, [rbp + 0x30]
xor edx, edx
call fcn.00409b40
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x30]
mov r8b, 2
call fcn.0055ec10
lea rcx, [rbp + 0x28]
xor edx, edx
call fcn.00409b40
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x28]
mov r8b, 3
call fcn.0055ec10
lea rcx, [rbp + 0x20]
xor edx, edx
call fcn.00409b40
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x20]
call fcn.0042b760
xor eax, eax
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x55f311
mov eax, dword [rcx - 4]
test eax, eax
jle 0x55f332
mov rdx, qword [rbp + 0x40]
mov r8d, 1
call fcn.00410080
test eax, eax
jle 0x55f332
mov ecx, 0x32a
call sub.kernel32.dll_ExitProcess
xor eax, eax
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x55f340
mov eax, dword [rcx - 4]
test eax, eax
jle 0x55f361
mov rdx, qword [rbp + 0x40]
mov r8d, 1
call fcn.00410080
test eax, eax
jle 0x55f361
mov ecx, 0x32b
call sub.kernel32.dll_ExitProcess
xor eax, eax
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x55f36f
mov eax, dword [rcx - 4]
test eax, eax
jle 0x55f390
mov rdx, qword [rbp + 0x40]
mov r8d, 1
call fcn.00410080
test eax, eax
jle 0x55f390
mov ecx, 0x32c
call sub.kernel32.dll_ExitProcess
call fcn.0055e9c0
test al, al
je 0x55f3a3
mov ecx, 0x2cc
call sub.kernel32.dll_ExitProcess
lea rcx, [rbp + 0x68]
mov edx, 8
xor r8, r8
call fcn.0040ab10
lea rcx, [rbp + 0x60]
mov edx, 8
xor r8, r8
call fcn.0040ab10
lea rcx, [rbp + 0x68]
call sub.user32.dll_GetCursorPos
lea rcx, [rbp + 0x60]
call sub.user32.dll_GetCursorPos
mov eax, dword [rbp + 0x68]
cmp eax, dword [rbp + 0x60]
jne 0x55f3e7
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x64]
je 0x55f3f1
mov ecx, 0x2cd
call sub.kernel32.dll_ExitProcess
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov ebx, ebx
mov ecx, 0xbb8
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
mov eax, eax
sub rax, rbx
sub rax, 0xbb8
cmp rax, 0x96
jle 0x55f426
mov ecx, 0x2cf
call sub.kernel32.dll_ExitProcess
call fcn.0055f030
test al, al
je 0x55f439
mov ecx, 0x2d0
call sub.kernel32.dll_ExitProcess
nop
lea rcx, [rbp + 0x20]
mov edx, 8
call fcn.0040e8d0
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x561770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
xor r13, r13
lea rcx, [rbp + 0x48]
xor edx, edx
xor r8, r8
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
mov rax, qword [0x00670500]
call qword [rax]
test eax, eax
je 0x56188a
mov rcx, qword [rbp + 0x48]
mov edx, edi
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov rax, qword [0x00670298]
call qword [rax]
test eax, eax
je 0x56188a
mov rcx, qword [rbp + 0x40]
mov rdx, rbx
mov r8d, dword [rsi]
xor r9, r9
mov rax, qword [0x00670830]
call qword [rax]
test eax, eax
je 0x56188a
mov dword [rbp + 0x38], 4
mov rcx, qword [rbp + 0x40]
mov edx, 4
lea r8, [rbp + 0x3c]
lea r9, [rbp + 0x38]
mov dword [rsp + 0x20], 0
mov rax, qword [0x006709d8]
call qword [rax]
test eax, eax
je 0x56188a
xor ecx, ecx
mov edx, dword [rbp + 0x3c]
add edx, 0x40
mov edx, edx
mov r8d, 0x3000
mov r9d, 4
call sub.kernel32.dll_VirtualAlloc
mov rbx, rax
test rbx, rbx
je 0x56188a
mov rcx, qword [rbp + 0x40]
mov edx, 2
mov r8, rbx
lea r9, [rbp + 0x3c]
mov dword [rsp + 0x20], 0
mov rax, qword [0x006709d8]
call qword [rax]
test eax, eax
je 0x561874
mov eax, dword [rbp + 0x3c]
mov dword [rsi], eax
mov r13, rbx
jmp 0x56188a
mov dword [rsi], 0
mov rcx, rbx
xor edx, edx
mov r8d, 0x8000
call sub.kernel32.dll_VirtualFree
mov rax, r13
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x5618d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov dword [rbp + 0x34], edx
mov qword [rbp + 0x38], r8
mov ebx, r9d
lea rcx, [rbp + 0x46]
mov edx, 0x101
xor r8, r8
call fcn.0040ab10
lea rcx, [rbp + 0x147]
mov edx, 0x101
xor r8, r8
call fcn.0040ab10
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x561929
test ebx, ebx
jbe 0x561929
mov edi, dword [rbp + 0x34]
add edi, ebx
jmp 0x56192c
mov edi, dword [rbp + 0x34]
xor ecx, ecx
mov edx, edi
add edx, 0x40
mov edx, edx
mov r8d, 0x3000
mov r9d, 4
call sub.kernel32.dll_VirtualAlloc
mov rsi, rax
test rsi, rsi
je 0x561ace
mov dword [rbp + 0x24c], 0
mov r13, rsi
mov rcx, rsi
mov edx, edi
xor r8, r8
call fcn.0040ab10
mov rcx, qword [rbp + 0x28]
mov rdx, r13
mov r8d, dword [rbp + 0x34]
mov r8d, r8d
call fcn.004097e0
mov eax, dword [rbp + 0x34]
mov dword [rbp + 0x24c], eax
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x5619b2
test ebx, ebx
jbe 0x5619b2
mov eax, dword [rbp + 0x34]
mov eax, eax
add r13, rax
mov rcx, qword [rbp + 0x38]
mov rdx, r13
mov r8d, ebx
call fcn.004097e0
add dword [rbp + 0x24c], ebx
mov rcx, rsi
lea rdx, [rbp + 0x24c]
mov r8d, 0x800c
call fcn.00561770
test rax, rax
je 0x561ace
mov r14, rax
mov rcx, r14
lea rdx, [rbp + 0x46]
mov r8d, dword [rbp + 0x24c]
call fcn.004097e0
mov rcx, rsi
mov edx, edi
xor r8, r8
call fcn.0040ab10
mov r13, rsi
mov dword [rbp + 0x248], 0
mov rcx, r14
mov rdx, r13
mov r8d, dword [rbp + 0x24c]
call fcn.004097e0
mov eax, dword [rbp + 0x24c]
add r13, rax
mov eax, dword [rbp + 0x24c]
add dword [rbp + 0x248], eax
mov rcx, qword [rbp + 0x28]
mov rdx, r13
mov r8d, dword [rbp + 0x34]
mov r8d, r8d
call fcn.004097e0
mov eax, dword [rbp + 0x34]
add dword [rbp + 0x248], eax
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x561a6d
test ebx, ebx
jbe 0x561a6d
mov eax, dword [rbp + 0x34]
mov eax, eax
add r13, rax
mov rcx, qword [rbp + 0x38]
mov rdx, r13
mov r8d, ebx
call fcn.004097e0
add dword [rbp + 0x248], ebx
mov rcx, rsi
lea rdx, [rbp + 0x248]
mov r8d, 0x800c
call fcn.00561770
mov rbx, rax
test rbx, rbx
je 0x561ace
lea rcx, [rbp + 0x46]
mov rdx, qword [rbp + 0x2b0]
mov r8d, dword [rbp + 0x24c]
call fcn.004097e0
mov rcx, rbx
mov rdx, qword [rbp + 0x2b8]
mov r8d, dword [rbp + 0x248]
shr r8d, 1
mov r8d, r8d
call fcn.004097e0
mov rcx, rbx
xor edx, edx
mov r8d, 0x8000
call sub.kernel32.dll_VirtualFree
lea rsp, [rbp + 0x258]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x570ca0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
mov r8d, r8d
pop rbp
jmp fcn.00570530

Function at 0x57dfe0
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x40
mov rbp, rsp
mov rsi, rcx
mov eax, dword [rsi + 8]
mov dword [rbp + 0x38], eax
lea rax, [rsi + 0xc]
add dword [rax], 1
mov rax, qword [rsi]
mov rcx, rax
lea rdx, [rbp + 0x38]
call fcn.0057df90
test rax, rax
je 0x57e062
mov rcx, rax
mov edx, dword [rbp + 0x38]
lea r8, [rbp + 0x38]
mov r9d, dword [rsi + 0x10]
call fcn.0057dd50
mov rbx, rax
test rbx, rbx
je 0x57e062
mov rcx, rbx
mov edx, dword [rbp + 0x38]
mov r8d, 0x40
call fcn.005611d0
xor ecx, ecx
xor edx, edx
mov r8, rbx
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov rcx, rax
call sub.kernel32.dll_CloseHandle
mov rcx, rsi
call fcn.005611b0
xor eax, eax
lea rsp, [rbp + 0x40]
pop rbx
pop rsi
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [str.dd_v_]
mov dword [rax], 1
mov rax, qword [str.hd_v_]
mov dword [rax], 1
mov rax, qword [str.ld_v_]
mov dword [rax], 1
mov rax, qword [0x1400a5020]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140002020
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x10078
push rbx
call fcn.140085a30
sub rsp, rax
xor eax, eax
mov r8d, 0x28
mov rdx, rcx
lea rbx, [rsp + 0x20]
xor ecx, ecx
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], cx
lea rsi, [rsp + 0x70]
mov rcx, rbx
call fcn.140026160
mov rdx, rsi
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x14000207f
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add rsp, 0x10078
pop rbx
pop rsi
ret

Function at 0x140002090
Capabilities:
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x78
xor eax, eax
mov r8d, 0x28
lea rsi, [rsp + 0x20]
mov rbx, rdx
mov rdx, rcx
mov word [rsp + 0x20], ax
mov rcx, rsi
call fcn.140026160
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x78
pop rbx
pop rsi
ret
Function at 0x140002150
Capabilities:
Set environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbp, rdx
mov rdi, r8
mov r12, rcx
call fcn.14001ff90
lea rdx, str.environ
mov rcx, rax
call qword [sym.imp.python38.dll_PyObject_GetAttrString]
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.python38.dll_PyUnicode_FromString]
mov rsi, rax
test rdi, rdi
je 0x1400021ff
mov rdx, rdi
mov rcx, rbp
call fcn.140002090
mov rcx, rdi
mov rdx, 0xffffffffffffffff
call sub.python38.dll_PyUnicode_FromWideChar
mov rdx, rsi
mov rcx, rbx
mov rdi, rax
mov r8, rax
call qword [sym.imp.python38.dll_PyObject_SetItem]
test eax, eax
jne 0x140002241
sub qword [rdi], 1
jne 0x1400021ce
mov rcx, rdi
call fcn.1400020d0
sub qword [rsi], 1
jne 0x1400021dc
mov rcx, rsi
call fcn.1400020d0
sub qword [rbx], 1
jne 0x1400021f4
mov rcx, rbx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400020d0
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdi, [rsp + 0x20]
mov r8d, 0x28
mov rdx, rbp
mov word [rsp + 0x20], 0
mov rcx, rdi
call fcn.140026160
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.python38.dll_PyObject_DelItem]
test eax, eax
je 0x1400021ce
mov rcx, r12
call fcn.1400020e0
jmp 0x1400021ce
mov ecx, 1
call qword [sym.imp.python38.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python38.dll_Py_Exit]
nop
nop dword [rax + rax]
Function at 0x14007ad20
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with crc32

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [0x1400b5779], 0
mov rbp, rcx
mov r12, rdx
mov rdi, r8
je 0x14007ada8
lea rdx, [0x1400a3592]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14007aec0
mov rsi, qword [0x1400b5638]
jmp 0x14007ad65
lea rsi, [rdx + rax + 4]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rsi
mov ebx, eax
call sub.msvcrt.dll_strlen
lea rdx, [rsi + rax + 1]
mov eax, dword [rdx]
test ebx, ebx
jne 0x14007ad60
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, rbp
mov rdx, r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.14006a450
mov r8d, 0xa
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1400b5638], rax
mov rdx, rax
mov r9d, dword [rax]
lea rax, [rax + 4]
mov qword [0x1400b5638], rax
mov eax, dword [rdx + 4]
lea rcx, [rdx + 8]
mov qword [0x1400b5638], rcx
test eax, eax
je 0x14007aea8
lea r8, [rcx + rax]
mov eax, 0xffffffff
nop word cs:[rax + rax]
movzx edx, byte [rcx]
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
shr eax, 1
and edx, 1
add rcx, 1
neg edx
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
cmp rcx, r8
jne 0x14007ae10
not eax
cmp r9d, eax
jne 0x14007af5a
mov byte [0x1400b5779], 1
jmp 0x14007ad3e
cmp byte [0x1400b5778], 0
jne 0x14007ad55
mov rbx, qword [sym.imp.python38.dll_PyDict_New]
lea rsi, [0x1400b4e28]
call rbx
mov qword [0x1400b60a8], rax
call rbx
mov qword [0x1400b60a0], rax
call rbx
mov qword [0x1400b6098], rax
call rbx
mov qword [0x1400b6090], rax
call rbx
mov qword [0x1400b6088], rax
call rbx
mov qword [0x1400b6080], rax
call rbx
mov qword [0x1400b6078], rax
call rbx
mov r13, qword [sym.imp.python38.dll_PyLong_FromLong]
mov rbx, 0xfffffffffffffffb
mov qword [0x1400b6070], rax
nop dword [rax]
mov ecx, ebx
call r13
mov qword [rsi + rbx*8], rax
add rbx, 1
cmp rbx, 0x101
jne 0x14007af38
mov byte [0x1400b5778], 1
jmp 0x14007ad55
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x140084710
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140095df0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140095df0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x1400853e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400b6508]
test eax, eax
je 0x14008547a
lea rax, [0x1400b64e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400b6510]
mov qword [rbp - 8], rax
jmp 0x14008545e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140085452
cmp qword [rbp - 0x10], 0
je 0x140085452
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140085418
lea rax, [0x1400b64e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14008547b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140085580
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400855a8
mov eax, 0
jmp 0x1400855f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400855d1
mov eax, 0
jmp 0x1400855f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400855f1
mov eax, 0
jmp 0x1400855f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400855fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14008567a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140085671
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140085671
mov rax, qword [rbp - 8]
jmp 0x14008568f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140085644
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1419d80b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1419d8237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1419d80e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419d80c7
add dl, dl
jne 0x1419d80ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419d814e
xor eax, eax
add dl, dl
jne 0x1419d80fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419d8205
add dl, dl
jne 0x1419d810e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419d811b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419d8128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419d8135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1419d8142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1419d80d6
mov eax, 1
add dl, dl
jne 0x1419d815e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419d816b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1419d8153
sub eax, ebx
mov ebx, 1
jne 0x1419d81a4
mov ecx, 1
add dl, dl
jne 0x1419d8186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1419d8193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1419d817b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1419d80d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1419d81c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1419d81cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1419d81b5
cmp eax, 0x7d00
jae 0x1419d81f3
cmp eax, 0x500
jb 0x1419d81ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1419d80d6
cmp eax, 0x7f
ja 0x1419d81f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1419d80d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1419d822a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1419d80d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x10000a340
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x100049710], ecx
xor eax, eax
add eax, 1
lea rdx, [0x100049710]
movsxd rcx, eax
mov r8d, dword [rdx + rcx*4 - 4]
mov ecx, r8d
shr ecx, 0x1e
xor ecx, r8d
imul ecx, ecx, 0x6c078965
mov r8d, eax
add r8d, ecx
mov ecx, eax
mov dword [rdx + rcx*4], r8d
cmp eax, 0x26f
jl 0x10000a348
mov dword [0x10002e790], 0x270
ret

Function at 0x10000a390
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0xffffffff
nop dword [rax]
add eax, 1
movsxd rdx, eax
lea rcx, [0x100049710]
mov ecx, dword [rcx + rdx*4 + 4]
mov edx, eax
lea r8, [0x100049710]
mov r8d, dword [r8 + rdx*4]
mov edx, ecx
and edx, 1
neg rdx
and edx, 0x9908b0df
and r8d, 0x80000000
and ecx, 0x7fffffff
or r8d, ecx
shr r8d, 1
xor edx, r8d
movsxd rcx, eax
lea r8, [0x100049710]
xor edx, dword [r8 + rcx*4 + 0x634]
mov ecx, eax
lea r8, [0x100049710]
mov dword [r8 + rcx*4], edx
cmp eax, 0xe2
jl 0x10000a398
mov eax, 0xe2
nop dword [rax]
add eax, 1
movsxd rdx, eax
lea rcx, [0x100049710]
mov ecx, dword [rcx + rdx*4 + 4]
mov edx, eax
lea r8, [0x100049710]
mov r8d, dword [r8 + rdx*4]
mov edx, ecx
and edx, 1
neg rdx
and edx, 0x9908b0df
and r8d, 0x80000000
and ecx, 0x7fffffff
or r8d, ecx
shr r8d, 1
xor edx, r8d
movsxd rcx, eax
lea r8, [0x100049710]
xor edx, dword [r8 + rcx*4 - 0x38c]
mov ecx, eax
lea r8, [0x100049710]
mov dword [r8 + rcx*4], edx
cmp eax, 0x26e
jl 0x10000a408
mov edx, dword [0x100049710]
mov ecx, dword [0x10004a0cc]
mov eax, edx
and eax, 1
neg rax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100049d40]
mov dword [0x10004a0cc], eax
mov dword [0x10002e790], 0
ret

Function at 0x10000a4c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
lea rsp, [rsp - 0x20]
mov ebx, dword [0x10002e790]
add dword [0x10002e790], 1
mov eax, dword [0x100048090]
cmp eax, dword [0x10002e550]
jne 0x10000a4e9
cmp ebx, 0x271
jb 0x10000a50c
mov ecx, dword [0x100048090]
call fcn.10000a340
not dword [0x100048090]
mov eax, dword [0x100048090]
mov dword [0x10002e550], eax
mov ebx, 0x270
nop
cmp ebx, 0x270
jne 0x10000a528
call fcn.10000a390
xor ebx, ebx
mov dword [0x10002e790], 1
nop dword [rax]
and ebx, ebx
lea rax, [0x100049710]
mov edx, dword [rax + rbx*4]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
nop
lea rsp, [rsp + 0x20]
pop rbx
ret
Function at 0x10000c590
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x10002e2e0]
cmp ax, 0xcb
je 0x10000c6cc
cmp ax, 0xcc
je 0x10000c6cc
nop
mov rax, qword [0x10004a410]
test rax, rax
je 0x10000c5cd
mov ecx, dword [0x10004a200]
call rax
mov rbx, rax
jmp 0x10000c5d4
lea rbx, [0x10004a208]
cmp word [0x10004a1f0], 0
jle 0x10000c5fc
lea rcx, [0x10004a1c0]
call fcn.10000c8b0
mov rcx, rbx
call fcn.10000c050
mov rcx, rbx
call fcn.10000c0e0
nop
mov rsi, qword [rbx]
jmp 0x10000c629
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
jne 0x10000c622
mov rdx, rsi
mov rcx, rbx
call fcn.10000b2d0
jmp 0x10000c626
and qword [rsi], 0xfffffffffffffffe
mov rsi, rdi
test rsi, rsi
jne 0x10000c608
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x10004a1f0], 0
jle 0x10000c6cc
lea rdx, [0x10004a0d0]
mov rcx, rbx
call fcn.10000b450
mov rsi, rax
test rax, rax
je 0x10000c698
mov rax, qword [0x10004a170]
mov qword [rsi + 0x18], rax
cmp qword [0x10004a170], 0
je 0x10000c688
mov rax, qword [0x10004a170]
mov qword [rax + 0x10], rsi
nop dword [rax]
mov rax, qword [rbx + 0xa0]
mov qword [0x10004a170], rax
nop
sub word [0x10004a1f0], 1
cmp word [0x10004a1f0], 0
sete bl
lea rcx, [0x10004a1c0]
call fcn.10000c8f0
test bl, bl
je 0x10000c6cc
lea rcx, [0x10004a1c0]
call fcn.10000c890
nop dword [rax]
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret