joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015895
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x14002af60]
mov rcx, rax
call sym.unk_256
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.unk_256
lea rax, [sym.unk_302]
mov rdx, rax
lea rax, [0x140033cd0]
mov rcx, rax
call sym.unk_290
mov eax, dword [0x14002af50]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.unk_258
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x1400159aa
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x14002af60]
mov rcx, rax
call sym.unk_258
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x140015978
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x14002af60]
mov rcx, rax
call sym.unk_256
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym.unk_303
jmp 0x1400159b9
lea rax, [0x14002af60]
mov rcx, rax
call sym.unk_256
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.unk_256
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x1400159f5
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140015a63
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.unk_258
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.unk_261
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.unk_280
mov qword [rbp - 8], 0
mov eax, dword [0x14002af50]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x140015aad
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.unk_258
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.unk_261
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x140015aad
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x14002af60]
mov rcx, rax
call sym.unk_258
test eax, eax
je 0x140015a9f
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140001008
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor r9d, r9d
mov rbx, r8
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
nop dword [rax + rax]
lea rax, [rsp + 0x90]
mov edx, 0x105
sub rbx, rax
lea rcx, [rsp + 0x90]
xor edi, edi
lea rax, [rdx + 0x7ffffef9]
test rax, rax
je 0x14000107e
movzx eax, word [rbx + rcx]
test ax, ax
je 0x14000107e
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000105c
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
je 0x140001198
movzx eax, word [rsp + 0x90]
lea rcx, [rsp + 0x90]
jmp 0x1400010b4
lea rbx, [rcx + 2]
cmp ax, 0x3a
je 0x1400010bb
movzx eax, word [rbx]
mov rcx, rbx
test ax, ax
jne 0x1400010a4
jmp 0x1400010e2
mov word [rcx], di
cmp word [rbx], di
je 0x1400010e2
lea rdx, str._ProcessID
lea rcx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400010ea
lea rbx, [rsp + 0x90]
lea rax, [rsp + 0x30]
mov edx, 0x29
sub rbx, rax
lea rcx, [rsp + 0x30]
lea rax, [rdx + 0x7fffffd5]
test rax, rax
je 0x14000111e
movzx eax, word [rbx + rcx]
test ax, ax
je 0x14000111e
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400010fc
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], di
je 0x140001198
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_IIDFromString]
nop dword [rax + rax]
test eax, eax
js 0x140001198
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
test eax, eax
js 0x140001198
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_core_com_private_l1_1_0.dll_CoRegisterSurrogateEx]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140001510
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x2b0
pop rdi
ret

Function at 0x1400014e0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax
Function at 0x180175a6c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180175a9c
xor eax, eax
jmp 0x180175b5f
mov rbp, rbx
cmp word [rax], si
je 0x180175ac1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180175aa8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180175aa4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18017598c
movsxd r14, eax
test eax, eax
jne 0x180175aff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180175a95
mov rcx, r14
call fcn.180173210
mov rdi, rax
test rax, rax
jne 0x180175b18
xor ecx, ecx
call fcn.1801731d4
jmp 0x180175af4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18017598c
test eax, eax
jne 0x180175b49
mov rcx, rdi
call fcn.1801731d4
jmp 0x180175b53
xor ecx, ecx
call fcn.1801731d4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18017b250
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18017b278
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18017b278
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140002a90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002aed
lea rbx, [0x140038880]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002ad4
cmp r10, 2
jb 0x140002ad4
cmp byte [r9], r8b
jne 0x140002ad4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002ab0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002b2f
lea rbx, [0x140038880]
cmp r8b, 0x23
jne 0x140002b13
cmp byte [r9], r8b
jne 0x140002b13
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002b00
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002cf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140002d1f
mov r8d, 0x600
lea rdx, str.C:UsershenryDownloadsExternal_Overlay__Loaderimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140002d2b
mov qword [rdi], 0
lea rdx, [0x140038490]
mov rcx, rbx
call fcn.140002b40
mov rbx, rax
test rax, rax
jne 0x140002d4d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140002e24
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002e24
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140002e24
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002e24
cmp rsi, 0xffffffffffffffff
je 0x140002e24
mov rax, qword [0x14008b100]
test rax, rax
je 0x140002dc1
inc dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140002e24
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140002e11
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14008b100]
test rax, rax
je 0x140002e06
dec dword [rax + 0x3b4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002e2d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140002e1f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140002e2f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005130
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc8], 0
mov rbx, rcx
mov edi, edx
jg 0x140005166
mov r8d, 0x67f
lea rdx, str.C:UsershenryDownloadsExternal_Overlay__Loaderimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc8]
mov rax, qword [rbx + 0xd0]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x140038880]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14008b100]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1b30], edx
jne 0x1400051e0
mov dword [rax + 0x1b34], edx
cmp dword [rax + 0x1b70], edx
jne 0x1400051ef
mov byte [rax + 0x1b74], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x14000f940
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x14008b100]
mov rsi, rcx
mov rbx, qword [rax + 0x1ae0]
add rbx, 0xc8
cmp dword [rbx], 0
jg 0x14000f98b
mov r8d, 0x67f
lea rdx, str.C:UsershenryDownloadsExternal_Overlay__Loaderimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x140038880]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x14000fa6a
lea ecx, [rdx + 1]
test r8d, r8d
je 0x14000fa56
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14000fa5b
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140017dc0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140010890
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14008b100]
mov edi, edx
cmp byte [rbx + 0x1e25], 0
jne 0x1400108e1
cmp byte [rbx + 0x1e26], 0
jne 0x1400108e1
mov r9d, dword [rbx + 0x2ec8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002a10
test dil, 1
je 0x140010a06
jmp 0x140010969
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400700f8]
xor eax, eax
mulss xmm1, dword [0x1400700e8]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1ba0], rax
mov dword [rbx + 0x1b8c], 1
movss dword [rbx + 0x1b98], xmm0
movss dword [rbx + 0x1b9c], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x140070078]
or dword [rbx + 0x1b88], 0x41
movss dword [rbx + 0x1be8], xmm0
mov r9d, dword [rbx + 0x2ec8]
call fcn.140002a10
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400109c0
lea r11, [0x140038880]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400109a3
cmp byte [r8], r9b
jne 0x1400109a3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140010990
not ecx
call fcn.140009d70
test rax, rax
je 0x140010a06
cmp byte [rax + 0x8e], 0
je 0x140010a06
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xac], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ec8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ec8]
call fcn.140002a10
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000c4b0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140033c1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140033c66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140033c66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140033c66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140033c66
cmp dword [rcx + 0x84], 0xe
jbe 0x140033c66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140033c68
xor al, al
add rsp, 0x28
ret
Function at 0x10000ba20
Capabilities:
Create thread
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
test edx, edx
mov ebx, edx
mov eax, 0xfffffffe
cmove ebx, eax
mov rdi, rcx
test ebx, ebx
js 0x10001dbec
mov r8d, dword [rdi + 0x54]
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.100001fc8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x40]
imul r11d, ebx
mov ebx, r11d
neg ebx
jmp 0x10000ba41

Function at 0x10000cad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r11
push rdi
push r13
mov r11d, 0x60
mov rdi, qword gs:[r11]
push rdx
mov r11, rdi
add r11, 0x10
mov rdx, qword [r11]
add rdi, 0x18
mov r13, qword [rdi]
add r13, 0x10
mov rdi, qword [r13]
push r10
mov r13, rdi
add r13, 0x30
mov r11, qword [r13]
cmp r11, 0
je 0x10000cb3b
mov r13, qword [rdi + 0x60]
mov r10, qword [r13]
and r10d, 0xdf00df
mov r13, qword [r13 + 0xc]
shl r13d, 8
add r13d, r10d
shl r13d, 2
sub r13d, 0xc914cd2c
cmp r13, 0
je 0x10000cb43
mov rdi, qword [rdi]
jmp 0x10000cafb
mov edi, dword [r11 + 0x3c]
add rdi, r11
add rdi, 0x10
mov r13d, dword [rdi + 0x78]
add r13, r11
push rcx
mov r10d, dword [r13 + 0x20]
add r10, r11
mov ecx, dword [r10]
add rcx, r11
mov edi, dword [rcx + 0xb]
add edi, 0xff8b9c9b
test edi, edi
jne 0x10000cb72
jmp 0x10000cb80
inc r10
inc r10
inc r10
inc r10
jmp 0x10000cb5d
mov edi, dword [r13 + 0x20]
sub r10, r11
sub r10, rdi
shr r10d, 1
mov edi, dword [r13 + 0x24]
add rdi, r10
add rdi, r11
mov r10d, dword [rdi]
shl r10d, 0x10
shr r10d, 0xe
mov edi, dword [r13 + 0x1c]
add rdi, r10
add rdi, r11
mov r10d, dword [rdi]
add r10, r11
movabs rdi, 0x11b000
add rdi, rdx
push r11
push rdx
push rdi
push rcx
push rcx
push rdi
mov rcx, rdi
mov edx, 0xb9000
mov r9, rsp
sub r8, r8
add r8, 0x40
call r10
pop r13
pop rcx
pop rcx
pop rdi
pop rdx
movabs r11, 0x6c31
mov r13d, 0x3b2c0
push r10
mov r10d, 0x1a
imul r11d, r10d
movabs r10, 0x6b27
add r10, rdx
add r11, r10
call fcn.10000cc33
mov edi, 0x15c000
mov r11d, 0xf2c21
add r11, rdx
add rdi, rdx
mov r13d, 0x3ad0
call fcn.10000cc33
pop r10
jmp 0x10000cc60
mov r11d, 0x8000000
mov r13d, 0xdc
mov edi, 0x11b000
mov r10d, 0x12
imul r13d, r10d
add r13d, 0x88
add rdi, rdx
sub rdi, r13
mov r13, rdi
sub r13, r11
movabs r11, 0xf7821
add r11, rdx
mov r10d, dword [r11]
xor r10d, 0xd6656056
dec r10
test r10d, r10d
je 0x10000ccbf
add r10, rdi
mov rcx, qword [r10]
add rcx, r13
mov qword [r10], rcx
add r11, 4
jmp 0x10000cc9b
push rdi
movabs rdi, 0x1ce3
sub rsp, 0x18
mov r11d, 0x5589
push r13
add r11, rdx
add r11, rdi
add r11, 0x12bec0
push r11
inc r10
lea r13d, [r10d]
jmp 0x10000cc5e
Function at 0x140aa4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140aa41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140aa4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140aa406f
add dl, dl
jne 0x140aa4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140aa40f6
xor eax, eax
add dl, dl
jne 0x140aa40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140aa41ad
add dl, dl
jne 0x140aa40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140aa40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140aa40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140aa40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140aa40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140aa407e
mov eax, 1
add dl, dl
jne 0x140aa4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140aa4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140aa40fb
sub eax, ebx
mov ebx, 1
jne 0x140aa414c
mov ecx, 1
add dl, dl
jne 0x140aa412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140aa413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140aa4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140aa407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140aa4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140aa4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140aa415d
cmp eax, 0x7d00
jae 0x140aa419b
cmp eax, 0x500
jb 0x140aa4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140aa407e
cmp eax, 0x7f
ja 0x140aa419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140aa407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140aa41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140aa407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140003f10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov rsi, rdx
mov qword [rcx], rax
mov rbx, rcx
call fcn.1400015b0
xor ebp, ebp
mov rcx, rax
test rax, rax
je 0x140003ff6
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [0x140018340]
xor r8d, r8d
xor edx, edx
add rax, 0x18
mov rcx, rsi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x140003fce
test eax, eax
js 0x140003feb
mov rcx, qword [rbx]
lea r8d, [rbp + 1]
mov edx, dword [rcx - 0xc]
sub r8d, dword [rcx - 8]
sub edx, eax
or r8d, edx
jge 0x140003f90
lfence
mov edx, eax
mov rcx, rbx
call fcn.1400021fc
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140003fab
mov eax, ebp
jmp 0x140003fb8
movsxd rdx, dword [rcx - 0xc]
call fcn.14000b258
test eax, eax
js 0x140003feb
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x140003feb
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], bp
jmp 0x140003fd3
call fcn.140003e08
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140001350
int3
mov ecx, 0x80004005
call fcn.140001350
int3