joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019a30
Capabilities:
Check for debugger via api

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
cmp dword [0x140027db8], 0xa
mov eax, dword [0x140027dbc]
setl cl
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
or al, cl
mov byte [rbp + 7], al
xor al, 1
mov byte [rbp + 6], al
mov r12d, 0x1e27
mov r14d, dword [rbp - 0x20]
xor r14d, r12d
mov dword [rbp - 0x20], r14d
mov r15d, dword [rbp - 0x18]
xor r15d, r12d
mov dword [rbp - 0x18], r15d
mov ebx, dword [rbp - 0x14]
xor ebx, r12d
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x10], 0x1e27
mov eax, 0x2e15
mov r13b, 1
mov dword [rbp], 0
mov edi, r12d
xor edi, 0x601c
nop word cs:[rax + rax]
cmp eax, 0x7793
jg 0x140019ae0
cmp eax, 0x28d2
je 0x140019bdf
cmp eax, 0x2e15
jne 0x140019ac0
jmp 0x140019ba0
cmp eax, 0x7794
je 0x140019b64
cmp eax, 0x7e1d
jne 0x140019ac0
mov eax, 0x10
call fcn.14001cf30
sub rsp, rax
mov rsi, rsp
mov dword [rsi], 0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
add rsp, 0x20
mov eax, dword [rsi]
mov dword [rbp - 4], eax
mov eax, dword [0x140027dc0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ebx
xor eax, 0x52f6
cmp byte [rbp], 0
cmove ebx, eax
test cl, 1
mov eax, 0x6995
mov ecx, 0x36d3
cmove eax, ecx
cmp dword [0x140027dc4], 0xa
cmovl eax, ecx
xor eax, r15d
mov cl, 1
mov dword [rbp], ecx
jmp 0x140019ac0
mov eax, 0x10
call fcn.14001cf30
sub rsp, rax
mov rsi, rsp
mov dword [rsi], 0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
add rsp, 0x20
mov eax, dword [rsi]
mov dword [rbp - 4], eax
mov eax, edi
jmp 0x140019ac0
mov eax, r15d
xor eax, 0x26
mov ecx, ebx
xor ecx, 0x26
mov edx, r12d
xor edx, 0x26
test r13b, 1
cmovne ebx, ecx
cmovne r15d, eax
cmovne r12d, edx
mov al, byte [rbp + 6]
cmp byte [rbp + 7], 0
mov eax, 0x69b3
mov ecx, 0x603a
cmovne eax, ecx
xor eax, r14d
xor r13d, r13d
jmp 0x140019aad
mov dword [rbp - 0x10], r12d
mov dword [rbp - 0x18], r15d
mov dword [rbp - 0x14], ebx
mov eax, dword [rbp - 4]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14001b360
Capabilities:
Check for debugger via api

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov eax, dword [0x140027e88]
cmp dword [0x140027e8c], 0xa
setl cl
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
or al, cl
mov byte [rbp + 6], al
mov byte [rbp + 7], al
mov al, byte [rbp + 7]
mov r12d, 0x1e27
mov r14d, dword [rbp - 0x20]
xor r14d, r12d
mov dword [rbp - 0x20], r14d
mov r15d, dword [rbp - 0x18]
xor r15d, r12d
mov dword [rbp - 0x18], r15d
mov ebx, dword [rbp - 0x14]
xor ebx, r12d
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x10], 0x1e27
mov eax, 0x2e15
mov cl, 1
mov dword [rbp], ecx
xor r13d, r13d
mov edi, r12d
xor edi, 0x601c
nop word cs:[rax + rax]
nop
cmp eax, 0x7793
jg 0x14001b410
cmp eax, 0x28d2
je 0x14001b533
cmp eax, 0x2e15
jne 0x14001b3f0
jmp 0x14001b4f0
cmp eax, 0x7794
je 0x14001b4b3
cmp eax, 0x7e1d
jne 0x14001b3f0
mov eax, 0x10
call fcn.14001cf30
sub rsp, rax
mov rsi, rsp
mov dword [rsi], 0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
add rsp, 0x20
mov eax, dword [rsi]
mov dword [rbp - 4], eax
mov eax, dword [0x140027e90]
mov ecx, dword [0x140027e94]
cmp ecx, 9
setg dl
cmp ecx, 0xa
setl cl
lea esi, [rax - 1]
imul esi, eax
test sil, 1
sete al
or dl, al
xor dl, cl
xor cl, al
mov eax, ebx
xor eax, 0x52f6
test r13b, r13b
cmove ebx, eax
test dl, dl
mov eax, 0x36d3
mov edx, 0x6995
cmovne eax, edx
test cl, cl
mov ecx, 0x36d3
cmovne eax, ecx
xor eax, r15d
mov r13b, 1
jmp 0x14001b3f0
mov eax, 0x10
call fcn.14001cf30
sub rsp, rax
mov rsi, rsp
mov dword [rsi], 0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
add rsp, 0x20
mov eax, dword [rsi]
mov dword [rbp - 4], eax
mov eax, edi
jmp 0x14001b3f0
mov eax, r15d
xor eax, 0x26
mov ecx, ebx
xor ecx, 0x26
mov edx, r12d
xor edx, 0x26
test byte [rbp], 1
cmovne ebx, ecx
cmovne r15d, eax
cmovne r12d, edx
mov al, byte [rbp + 7]
cmp byte [rbp + 6], 0
mov eax, 0x69b3
mov ecx, 0x603a
cmovne eax, ecx
xor eax, r14d
mov dword [rbp], 0
jmp 0x14001b3dc
mov dword [rbp - 0x10], r12d
mov dword [rbp - 0x18], r15d
mov dword [rbp - 0x14], ebx
mov eax, dword [rbp - 4]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14001bca0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x100
mov r10d, edx
movaps xmm0, xmmword [0x140023ba0]
movaps xmmword [rsp], xmm0
movaps xmm0, xmmword [0x140023bb0]
movaps xmmword [rsp + 0x10], xmm0
movaps xmm0, xmmword [str._________._0123456789:_____ABCDEFGHIJKLMNOPQRSTUVWXYZ____abcdefghijklmnopqrstuvwxyz]
movaps xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x140023bd0]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [0x140023be0]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [0x140023bf0]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x140023c00]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x140023c10]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x140023c20]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x140023c30]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x140023c40]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [0x140023c50]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmm0, xmmword [0x140023c60]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmm0, xmmword [0x140023c70]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmm0, xmmword [0x140023c80]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmm0, xmmword [0x140023c90]
movaps xmmword [rsp + 0xf0], xmm0
xor r11d, r11d
xor esi, esi
nop word [rax + rax]
mov eax, r11d
cdq
idiv r9d
movzx eax, byte [r8 + rdx]
add eax, esi
movzx edx, byte [rsp + r11]
mov esi, edx
add esi, eax
movzx esi, sil
movzx eax, byte [rsp + rsi]
mov byte [rsp + r11], al
mov byte [rsp + rsi], dl
add r11, 1
cmp r11, 0x100
jne 0x14001bd90
test r10d, r10d
jle 0x14001be18
mov r8d, r10d
xor r9d, r9d
xor esi, esi
xor edx, edx
nop word cs:[rax + rax]
nop dword [rax]
add edx, 1
movzx edx, dl
movzx r10d, byte [rsp + rdx]
add esi, r10d
movzx esi, sil
movzx eax, byte [rsp + rsi]
mov byte [rsp + rdx], al
mov byte [rsp + rsi], r10b
movzx eax, byte [rsp + rdx]
add eax, r10d
movzx eax, al
movzx eax, byte [rsp + rax]
xor byte [rcx + r9], al
add r9, 1
cmp r8, r9
jne 0x14001bde0
add rsp, 0x100
pop rsi
ret
Function at 0x14001c620
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400284c4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x14001c7a8
mov rax, qword [0x1400284c8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x14001c66c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x14001c6f5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x14001c650
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x14001c7dd
mov rax, qword [0x1400284c8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400284c8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14001c7c0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14001c6ee
sub eax, 0x40
and eax, 0xffffffbf
jne 0x14001c750
add dword [0x1400284c4], 1
cmp edi, 8
jae 0x14001c723
test dil, 4
jne 0x14001c794
test edi, edi
je 0x14001c718
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x14001c7af
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x14001c718
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x14001c73c
jmp 0x14001c718
add rsi, qword [0x1400284c8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001c6ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x14001c718
xor esi, esi
jmp 0x14001c677
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x14001c718
mov rax, qword [0x1400284c8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]
Function at 0x14001d070
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rdi
push rbx
mov al, byte [rdx]
mov byte [rcx], al
mov al, byte [rdx + 1]
mov byte [rcx + 1], al
mov al, byte [rdx + 2]
mov byte [rcx + 2], al
mov al, byte [rdx + 3]
mov byte [rcx + 3], al
mov al, byte [rdx + 4]
mov byte [rcx + 4], al
mov al, byte [rdx + 5]
mov byte [rcx + 5], al
mov al, byte [rdx + 6]
mov byte [rcx + 6], al
mov al, byte [rdx + 7]
mov byte [rcx + 7], al
mov al, byte [rdx + 8]
mov byte [rcx + 8], al
mov al, byte [rdx + 9]
mov byte [rcx + 9], al
mov al, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
mov al, byte [rdx + 0xb]
mov byte [rcx + 0xb], al
mov al, byte [rdx + 0xc]
mov byte [rcx + 0xc], al
mov al, byte [rdx + 0xd]
mov byte [rcx + 0xd], al
mov al, byte [rdx + 0xe]
mov byte [rcx + 0xe], al
mov al, byte [rdx + 0xf]
mov byte [rcx + 0xf], al
mov eax, 4
lea r9, str.cw
lea r8, [0x1400240d0]
jmp 0x14001d11d
xor bl, byte [rcx + rax*4 - 0x10]
mov byte [rcx + rax*4], bl
xor dl, byte [rcx + rax*4 - 0xf]
mov byte [rcx + rax*4 + 1], dl
xor r11b, byte [rcx + rax*4 - 0xe]
mov byte [rcx + rax*4 + 2], r11b
xor r10b, byte [rcx + rax*4 - 0xd]
mov byte [rcx + rax*4 + 3], r10b
add rax, 1
cmp rax, 0x2c
je 0x14001d164
movzx ebx, byte [rcx + rax*4 - 4]
movzx edx, byte [rcx + rax*4 - 3]
movzx r11d, byte [rcx + rax*4 - 2]
movzx r10d, byte [rcx + rax*4 - 1]
test al, 3
jne 0x14001d0f0
movzx esi, bl
movzx edi, dl
movzx edx, r11b
movzx ebx, r10b
movzx edx, byte [rdx + r9]
movzx r11d, byte [rbx + r9]
movzx r10d, byte [rsi + r9]
mov esi, eax
shr esi, 2
movzx ebx, byte [rsi + r8]
xor bl, byte [rdi + r9]
jmp 0x14001d0f0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001dd60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea r14, [rcx + 0xb0]
mov rax, r14
test r8, r8
je 0x14001de46
mov r15, r8
mov rsi, rdx
mov r12, rcx
xor edi, edi
mov rax, r14
mov rbx, rdx
nop word cs:[rax + rax]
nop dword [rax + rax]
lea rcx, [rsi + rdi]
movzx edx, byte [rax]
xor byte [rsi + rdi], dl
movzx edx, byte [rax + 1]
xor byte [rsi + rdi + 1], dl
movzx edx, byte [rax + 2]
xor byte [rsi + rdi + 2], dl
movzx edx, byte [rax + 3]
xor byte [rsi + rdi + 3], dl
movzx edx, byte [rax + 4]
xor byte [rsi + rdi + 4], dl
movzx edx, byte [rax + 5]
xor byte [rsi + rdi + 5], dl
movzx edx, byte [rax + 6]
xor byte [rsi + rdi + 6], dl
movzx edx, byte [rax + 7]
xor byte [rsi + rdi + 7], dl
movzx edx, byte [rax + 8]
xor byte [rsi + rdi + 8], dl
movzx edx, byte [rax + 9]
xor byte [rsi + rdi + 9], dl
movzx edx, byte [rax + 0xa]
xor byte [rsi + rdi + 0xa], dl
movzx edx, byte [rax + 0xb]
xor byte [rsi + rdi + 0xb], dl
movzx edx, byte [rax + 0xc]
xor byte [rsi + rdi + 0xc], dl
movzx edx, byte [rax + 0xd]
xor byte [rsi + rdi + 0xd], dl
movzx edx, byte [rax + 0xe]
xor byte [rsi + rdi + 0xe], dl
movzx eax, byte [rax + 0xf]
xor byte [rsi + rdi + 0xf], al
mov rdx, r12
call sym.Cipher
mov rax, rbx
add rbx, 0x10
add rdi, 0x10
cmp rdi, r15
jb 0x14001dda0
lea rax, [rsi + rdi]
add rax, 0xfffffffffffffff0
movups xmm0, xmmword [rax]
movups xmmword [r14], xmm0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14001de60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
test r8, r8
je 0x14001df6a
mov r14, r8
mov rdi, rdx
mov rbx, rcx
lea r15, [rcx + 0xb0]
xor esi, esi
nop word cs:[rax + rax]
lea rcx, [rdi + rsi]
movups xmm0, xmmword [rdi + rsi]
movaps xmmword [rsp + 0x20], xmm0
mov rdx, rbx
call sym.InvCipher
movzx eax, byte [rbx + 0xb0]
xor byte [rdi + rsi], al
movzx eax, byte [rbx + 0xb1]
xor byte [rdi + rsi + 1], al
movzx eax, byte [rbx + 0xb2]
xor byte [rdi + rsi + 2], al
movzx eax, byte [rbx + 0xb3]
xor byte [rdi + rsi + 3], al
movzx eax, byte [rbx + 0xb4]
xor byte [rdi + rsi + 4], al
movzx eax, byte [rbx + 0xb5]
xor byte [rdi + rsi + 5], al
movzx eax, byte [rbx + 0xb6]
xor byte [rdi + rsi + 6], al
movzx eax, byte [rbx + 0xb7]
xor byte [rdi + rsi + 7], al
movzx eax, byte [rbx + 0xb8]
xor byte [rdi + rsi + 8], al
movzx eax, byte [rbx + 0xb9]
xor byte [rdi + rsi + 9], al
movzx eax, byte [rbx + 0xba]
xor byte [rdi + rsi + 0xa], al
movzx eax, byte [rbx + 0xbb]
xor byte [rdi + rsi + 0xb], al
movzx eax, byte [rbx + 0xbc]
xor byte [rdi + rsi + 0xc], al
movzx eax, byte [rbx + 0xbd]
xor byte [rdi + rsi + 0xd], al
movzx eax, byte [rbx + 0xbe]
xor byte [rdi + rsi + 0xe], al
movzx eax, byte [rbx + 0xbf]
xor byte [rdi + rsi + 0xf], al
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [r15], xmm0
add rsi, 0x10
cmp rsi, r14
jb 0x14001de90
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001e2a0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400287e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400287c0]
test rbx, rbx
je 0x14001e2f4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14001e2eb
test rsi, rsi
je 0x14001e2eb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14001e2d0
lea rcx, [0x1400287e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x14001e550
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x14001e560
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x14001e570
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x14001e5b1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x14001e5a8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x14001e5b3
add rax, 0x28
cmp rax, r9
jne 0x14001e594
xor eax, eax
ret

Function at 0x14001e650
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x14001f040]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x14001e6bd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14001e6bd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x14001e6bd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x14001e6b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14001e6bf
add rax, 0x28
cmp rax, r9
jne 0x14001e6a0
xor eax, eax
add rsp, 0x28
ret

Function at 0x14001e7c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x14001f040]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x14001e7e0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14001e7d8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x14001e83d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x14001e834
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14001e844
add rax, 0x28
cmp rax, r9
jne 0x14001e820
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x14001e860
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x14001f040]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x14001e8ce
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14001e8ce
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x14001e8ce
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x14001e8ce
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x14001e8c5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x14001e8d5
add rcx, 0x28
cmp rcx, rax
jne 0x14001e8b0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x14001e8e8
jmp 0x14001e8ce
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x14001e8f6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x14001e8ce
test r9d, r9d
jg 0x14001e8e0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret

Function at 0x14001e980
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
int3
Function at 0x1407b9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407b91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407b9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b906f
add dl, dl
jne 0x1407b9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b90f6
xor eax, eax
add dl, dl
jne 0x1407b90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407b91ad
add dl, dl
jne 0x1407b90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407b90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407b907e
mov eax, 1
add dl, dl
jne 0x1407b9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407b9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b90fb
sub eax, ebx
mov ebx, 1
jne 0x1407b914c
mov ecx, 1
add dl, dl
jne 0x1407b912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407b913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407b9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407b9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407b915d
cmp eax, 0x7d00
jae 0x1407b919b
cmp eax, 0x500
jb 0x1407b9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b907e
cmp eax, 0x7f
ja 0x1407b919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407b907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407b91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407b907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001010
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x170], 0xfffffffffffffffe
mov ebx, edx
mov rsi, rcx
mov eax, 1
lock xadd dword [0x140164a98], eax
test eax, eax
je 0x14000104d
test bl, bl
jne 0x140001069
jmp 0x14000110c
lea rdx, [rbp - 0x58]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x140164a9c], eax
test bl, bl
je 0x14000110c
mfence
mov edi, dword [0x140164a9c]
test edi, edi
je 0x14000110c
mov qword [rbp + 0x158], 0
mov rax, qword [0x14015f250]
shr rax, 1
movabs rcx, 0x595588bd12bf6fe8
cmp rax, rcx
je 0x1400010ba
mov rax, qword [0x14015f248]
lea rcx, [0x14015f248]
mov edx, edi
call qword [rax + 0x30]
mov ecx, 2
test al, al
je 0x1400010bf
mov ecx, 3
mov qword [rbp + 0x168], rcx
mov dword [rbp + 0x158], edi
lea rax, [0x14015f248]
mov qword [rbp + 0x160], rax
lea rax, str.C:CodeCodingdependencies_boost_1_84_0_boost_asio_detail_impl_winsock_init.ipp
mov qword [rbp + 0x140], rax
lea rax, str.static_void___cdecl_boost::asio::detail::winsock_init_base::throw_on_error_data__
mov qword [rbp + 0x148], rax
movabs rax, 0x500000048
mov qword [rbp + 0x150], rax
test cl, 1
jne 0x14000111b
mov rax, rsi
add rsp, 0x1f8
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea r8, str.winsock
lea rsi, [rbp - 0x58]
lea rdx, [rbp + 0x158]
mov rcx, rsi
call fcn.14000c080
lea rdx, [rbp + 0x140]
mov rcx, rsi
call fcn.14000c440
int3
Function at 0x140005b90
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov qword [rbp + 0x58], rdx
mov rsi, rcx
cmp qword [rcx + 0x18], 8
mov r9, rcx
jb 0x140005bbe
mov r9, qword [rsi]
lea r8, str.Starting:__ls
lea rcx, [rbp + 0x67]
mov edx, 0xffff00
call fcn.140055720
mov qword [rbp - 0x30], 3
lea rdi, [rbp - 0x30]
mov rcx, rdi
call fcn.140005d60
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 0
movaps xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 0
mov dword [rbp - 0x30], 0x68
mov rax, qword [rbp + 0x58]
cmp qword [rax + 0x18], 8
mov rdx, rax
jb 0x140005c2e
mov rdx, qword [rax]
cmp qword [rsi + 0x18], 8
jb 0x140005c38
mov rsi, qword [rsi]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test eax, eax
je 0x140005c85
mov rcx, qword [rbp + 0x40]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rbp + 0x48]
call rdi
jmp 0x140005cb5
lea rcx, [0x140164d90]
lea rdx, str.Error_creating_process:
call fcn.140001cc0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov edx, eax
call fcn.140005da0
mov rcx, rax
mov dl, 0xa
call fcn.1400018f0
mov rdi, qword [rbp + 0x58]
mov rax, qword [rdi + 0x18]
cmp rax, 8
jb 0x140005cfa
mov rcx, qword [rdi]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140005cf5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140005d1f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140055204
test esi, esi
setne al
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 7
mov word [rdi], 0
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
call fcn.1400d5e54
int3