joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400438b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14006b010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x1400438f6
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x1400438e6
cmp byte [rax], cl
jne 0x1400438f6
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x1400438d7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140043a5a
cmp byte [r8 + 1], dl
je 0x140043a5a
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x140043932
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14004395a
sub dl, 0x61
cmp dl, 0x19
ja 0x14004394c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14004395a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140043915
jmp 0x14004395d
inc r9
cmp r8, r9
jae 0x14004398f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140043984
bt rdx, rax
jb 0x14004398a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x140043970
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140004d40
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400439c8
nop
inc rcx
cmp byte [rcx], 0x20
je 0x1400439c0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140043a48
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1400439e3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x1400439f9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x140043a36
movss xmm2, dword [0x14006263c]
cmp al, 0x39
ja 0x140043a36
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140043a10
cmp r9b, 0x2d
jne 0x140043a55
xorps xmm1, xmmword [0x140062b60]
movaps xmm0, xmm1
jmp 0x140043a5d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140043a5d
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400595e0
add rsp, 0x90
pop rbx
ret
Function at 0x140043a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14006b010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x140043ac6
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x140043ab6
cmp byte [rax], cl
jne 0x140043ac6
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x140043aa7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140043c24
cmp byte [r8 + 1], dl
je 0x140043c24
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x140043b02
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x140043b2a
sub dl, 0x61
cmp dl, 0x19
ja 0x140043b1c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x140043b2a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140043ae5
jmp 0x140043b2d
inc r9
cmp r8, r9
jae 0x140043b5f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140043b54
bt rdx, rax
jb 0x140043b5a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x140043b40
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140004d40
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140043b98
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140043b90
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140043c16
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x140043bb3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x140043bc9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x140043c04
movsd xmm2, qword [0x140062540]
cmp al, 0x39
ja 0x140043c04
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140043be0
cmp r9b, 0x2d
jne 0x140043c1f
xorps xmm1, xmmword [0x140062b50]
movaps xmm0, xmm1
jmp 0x140043c27
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140043c27
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400595e0
add rsp, 0x90
pop rbx
ret
Function at 0x14005a234
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005a27e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005a27e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005a27e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005a27e
cmp dword [rcx + 0x84], 0xe
jbe 0x14005a27e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005a280
xor al, al
add rsp, 0x28
ret
Function at 0x14000d250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, r8
mov edi, edx
test r8, r8
je 0x14000d420
mov rax, qword [rcx]
call qword [rax]
mov rbp, rax
test edi, edi
je 0x14000d2c0
cmp edi, 3
je 0x14000d2c0
sub edi, 1
je 0x14000d2af
cmp edi, 1
jne 0x14000d420
movzx edx, bx
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadIconW]
jmp 0x14000d422
movzx edx, bx
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadCursorW]
jmp 0x14000d422
movzx edx, bx
mov r8d, 0xa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14000d420
xor ebx, ebx
mov esi, ebx
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x14000d420
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x14000d386
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14000ae20
test rax, rax
je 0x14000d35f
mov rsi, qword [rsp + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000d386
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rsi, rsi
je 0x14000d420
cmp edi, 3
jne 0x14000d41b
lea r8, [rsp + 0x30]
lea edx, [rdi + 0x1d]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x14000d40d
mov edx, dword [rsp + 0x38]
test edx, edx
je 0x14000d40d
lea ecx, [rdx + 1]
and ecx, 0xfffffffe
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [rdi + 0x1e]
call qword [sym.imp.COMCTL32.dll_ImageList_Create]
mov rdi, rax
test rax, rax
je 0x14000d40d
mov r8d, 0xff00ff
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
test eax, eax
jns 0x14000d40a
mov rcx, rdi
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14000d422
mov rbx, rdi
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, rbx
jmp 0x14000d422
mov rax, rsi
jmp 0x14000d422
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000d4e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x14000d512
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x14000d607
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x14000d607
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14000d5fe
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x14000d5dc
cmp rdi, 1
jne 0x14000d59a
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x14000d5f9
cmp rdi, 2
jne 0x14000d5b1
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x14000d5f9
cmp rdi, 4
jne 0x14000d5c6
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x14000d5f9
cmp rdi, 8
jne 0x14000d5dc
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x14000d5f9
test eax, eax
je 0x14000d5f9
mov rdx, rdi
mov rcx, rbx
call fcn.14000eef0
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.140016790
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x14000dc90
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
test rcx, rcx
je 0x14000ddf9
cmp word [rcx], 0
je 0x14000ddf9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 1
mov dword [rbp - 0x24], eax
xor edi, edi
mov word [rbp - 0x20], di
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea rsi, vtable.CVolObject.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, vtable.CVolMem.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.14000efd0
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], rdi
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000dd9b
mov ebx, edi
jmp 0x14000ddc3
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], r14
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14000dde0
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
call qword [r8 + 0x18]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], rsi
mov rax, rbx
jmp 0x14000ddfb
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000de50
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r14
sub rsp, 0x28
mov r14, rcx
call fcn.14000a0c0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x14000de83
nop
cmp dx, 0x20
ja 0x14000de83
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
jne 0x14000de70
movzx r8d, word [rax]
movzx ecx, r8w
cmp r8w, 0x22
jne 0x14000de96
movzx ecx, word [rax + 2]
mov edx, 0x22
lea rdi, [rax + 2]
mov r9d, 0x20
cmovne rdi, rax
cmovne dx, r9w
cmp cx, dx
je 0x14000dec5
test cx, cx
je 0x14000dece
movzx ecx, word [rdi + 2]
add rdi, 2
cmp cx, dx
jne 0x14000deb3
test cx, cx
je 0x14000dece
add rdi, 2
cmp r8w, 0x22
jne 0x14000dedf
cmp word [rdi], r9w
jne 0x14000dedf
add rdi, 2
movzx eax, word [rdi]
test ax, ax
je 0x14000e06e
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
cmp ax, 0x22
jne 0x14000dfb2
movzx eax, word [rdi + 2]
add rdi, 2
mov rsi, rdi
test ax, ax
je 0x14000df33
nop dword [rax]
cmp ax, 0x22
je 0x14000df33
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x14000df20
mov rbx, rsi
sub rbx, rdi
sar rbx, 1
test rbx, rbx
jle 0x14000df68
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call fcn.140016790
mov word [rbx + rbp], r15w
jmp 0x14000df6b
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000df8f
mov rax, qword [rcx + 0x18]
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000df9c
lea rdx, [rbx + 8]
call fcn.14000eef0
mov qword [rax + rbx], rbp
mov rdi, rsi
cmp word [rsi], r15w
je 0x14000e04e
lea rdi, [rsi + 2]
jmp 0x14000e04e
cmp ax, 0x20
jbe 0x14000e04a
mov rsi, rdi
nop
cmp ax, 0x22
je 0x14000dfd9
cmp ax, 0x20
jbe 0x14000dfd9
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x14000dfc0
mov rbx, rsi
sub rbx, rdi
sar rbx, 1
test rbx, rbx
jle 0x14000e00e
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbp, rax
call fcn.140016790
mov word [rbx + rbp], r15w
jmp 0x14000e011
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000e038
mov rax, qword [rcx + 0x18]
mov rdi, rsi
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000e04e
lea rdx, [rbx + 8]
call fcn.14000eef0
mov rdi, rsi
mov qword [rax + rbx], rbp
jmp 0x14000e04e
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x14000df02
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, qword [r14 + 0x30]
shr rax, 3
add rsp, 0x28
pop r14
pop rdi
ret
Function at 0x14001783c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001769b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001769b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001769b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001769b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001769b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001769b
cmp dword [rcx + 0xf8], 0
je 0x14001769b
mov ecx, ebx
call fcn.140017758
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140017528
nop
cmp dword [rbp + 0x20], 0
je 0x1400176e9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400176f4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14001762c
Function at 0x1400207e8
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14003cdb0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x140020846
cmp word [rdx], r12w
jne 0x140020846
or byte [rax + r8*8 + 0x38], cl
jmp 0x14002084c
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1400209a7
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x140020982
lea r9, [rcx + 2]
cmp ax, r13w
je 0x140020885
mov rcx, r9
jmp 0x1400208a8
cmp r9, rdx
jae 0x1400208bf
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x140020869
jmp 0x1400209a7
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002097c
cmp dword [rsp + 0x80], edi
je 0x14002097c
mov rdx, r14
lea r11, [0x14003cdb0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140020955
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x140020928
mov word [rbx], r12w
jmp 0x1400209a3
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140020931
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1400209a3
cmp word [rsp + 0x70], r12w
jne 0x140020962
cmp rbx, rsi
je 0x140020922
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.14001dee0
cmp word [rsp + 0x70], r12w
je 0x1400209a7
mov word [rbx], r13w
jmp 0x1400209a3
lea r11, [0x14003cdb0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14002099f
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1400209a7
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140022844
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400228cb
mov rsi, rbx
cmp word [rax], bp
je 0x14002288a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140022874
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140022870
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001f268
mov rdi, rax
test rax, rax
je 0x1400228b8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140016790
mov rbp, rdi
xor ecx, ecx
call fcn.14001d2c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140027320
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001dee0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001dee0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027470
cmp rax, 0xffffffffffffffff
je 0x140027470
xor edi, edi
test rbp, rbp
jle 0x14002741b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400215f4
mov rbx, rax
test rax, rax
jne 0x1400273a8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027411
mov edx, 0x8000
mov ecx, r14d
call fcn.14001c484
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001ebd4
cmp eax, 0xffffffff
je 0x1400273f1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400273b8
mov edx, r15d
mov ecx, r14d
call fcn.14001c484
jmp 0x140027411
cmp byte [rsi + 0x38], dil
je 0x140027408
cmp dword [rsi + 0x34], 5
jne 0x140027408
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027411
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001d2c8
jmp 0x140027484
jns 0x140027484
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001dee0
cmp rax, 0xffffffffffffffff
jne 0x14002743c
cmp byte [rsi + 0x30], dil
je 0x140027484
mov edi, dword [rsi + 0x2c]
jmp 0x140027484
mov ecx, r14d
call fcn.14002333c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027484
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027484
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14002747d
mov eax, dword [rsi + 0x2c]
jmp 0x140027482
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001dee0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1409dd058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409dd1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409dd089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409dd06f
add dl, dl
jne 0x1409dd096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409dd0f6
xor eax, eax
add dl, dl
jne 0x1409dd0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409dd1ad
add dl, dl
jne 0x1409dd0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409dd0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409dd0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409dd0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409dd0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409dd07e
mov eax, 1
add dl, dl
jne 0x1409dd106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409dd113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409dd0fb
sub eax, ebx
mov ebx, 1
jne 0x1409dd14c
mov ecx, 1
add dl, dl
jne 0x1409dd12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409dd13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409dd123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409dd07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409dd168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409dd175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409dd15d
cmp eax, 0x7d00
jae 0x1409dd19b
cmp eax, 0x500
jb 0x1409dd196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409dd07e
cmp eax, 0x7f
ja 0x1409dd19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409dd07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409dd1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409dd07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20