joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403419e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1404cf248]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1404cf244]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140341a32
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140341a2a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140341b19
inc ebx
add rax, 0x28
jmp 0x140341a0a
mov rcx, r12
call fcn.140342251
mov rbp, rax
test rax, rax
jne 0x140341a51
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140341980
movsxd rbx, ebx
mov rax, qword [0x1404cf248]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.1403422ff
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1404cf248]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140341ab3
mov rax, qword [0x1404cf248]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140341980
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140341b13
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140341b13
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1404cf248]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140341b13
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140341980
inc dword [0x1404cf244]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140341f80
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x1404cf2a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1404cf280]
test rbx, rbx
je 0x140341fcc
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140341fc6
test rsi, rsi
je 0x140341fc6
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140341f9e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140342180
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1403421a3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1403421a3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1403421a4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x1403421de
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x1403421d5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1403421e0
inc r8d
add rax, 0x28
jmp 0x1403421bc
xor eax, eax
ret
Function at 0x140342251
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14048c010]
mov r8, rcx
mov rcx, r9
call fcn.140342180
test eax, eax
je 0x14034227d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1403421a4
xor eax, eax
add rsp, 0x28
ret

Function at 0x140342970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x230
mov rbx, rcx
call sub.msvcrt.dll__errno
xor ecx, ecx
mov dword [rax], ecx
test rbx, rbx
jne 0x14034299b
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x1403429ac
cmp word [rbx], 0
jne 0x1403429b3
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
xor ebx, ebx
jmp 0x140342ac3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1403429ce
call sub.msvcrt.dll__errno
mov dword [rax], 2
jmp 0x1403429ac
test al, 0x10
je 0x1403429a1
lea rdi, [rsp + 0x28]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
lea rbp, [0x14048ab00]
lea r12, [0x14048ab04]
call sub.msvcrt.dll__wfullpath
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov rcx, rbp
mov rbx, rax
call sub.msvcrt.dll_wcslen
mov rcx, r12
add rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 0x229]
add rcx, rcx
call sub.msvcrt.dll_malloc
mov rbx, rax
test rax, rax
jne 0x140342a3c
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x1403429ac
lea rsi, [rax + 0x44c]
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
cmp word [rbx + 0x44c], 0
je 0x140342a89
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp word [rbx + rax*2 + 0x44a], 0x2f
je 0x140342a89
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp word [rbx + rax*2 + 0x44a], 0x5c
je 0x140342a89
mov rdx, rbp
mov rcx, rsi
call sub.msvcrt.dll_wcscat
mov rdx, r12
mov rcx, rsi
call sub.msvcrt.dll_wcscat
xor edx, edx
xor eax, eax
mov ecx, 0x82
mov qword [rbx + 0x230], rdx
lea rdx, [rbx + 0x238]
mov dword [rbx + 0x448], eax
mov rdi, rdx
xor eax, eax
mov qword [rbx + 0x440], 0xffffffffffffffff
rep stosd dword [rdi], eax
mov rax, rbx
add rsp, 0x230
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14034f913
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140361f38], eax
inc eax
jne 0x14034f92d
call sub.msvcrt.dll_abort
nop
add rsp, 0x28
ret
Function at 0x14034faa1
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rbx, rcx
test rcx, rcx
je 0x14034fb3d
call fcn.1403520fa
dec eax
jne 0x14034fb36
xor eax, eax
lea rdi, [rsp + 0x25]
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x4d]
mov ecx, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x4c]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
mov eax, 0x27
lea rcx, [rsp + 0x25]
cmp byte [rcx + rax], 0
je 0x14034fb15
inc rax
cmp rax, 0x6b
jne 0x14034fb04
jmp 0x14034fb2b
cmp eax, 0x6a
je 0x14034fb2b
movsxd rdx, eax
inc eax
cdqe
mov byte [rsp + rdx + 0x25], 0xa
mov byte [rsp + rax + 0x25], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret

Function at 0x14034fbdf
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
call fcn.14034fb48
mov ecx, dword [0x140361f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x14034fcee
call fcn.14034f9f5
cmp qword [0x1404d5048], 0
mov rbx, rax
je 0x14034fcee
test rax, rax
je 0x14034fcee
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.14034faa1
xor edx, edx
xor ecx, ecx
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], edx
mov qword [rbx + 0x28], rcx
call rdi
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rsi, rax
call rdi
xor r8d, r8d
mov dword [rsp + 0x30], 2
mov rdx, rsi
mov dword [rsp + 0x28], r8d
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], r8d
mov r8, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x14034fcb4
call sub.msvcrt.dll_abort
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x140361f38]
mov rdx, rbx
mov dword [rbx + 0xc0], eax
xor eax, eax
mov dword [rbx + 0xbc], eax
mov al, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14034fcaf
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
Function at 0x14035086f
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.14034fbdf
mov qword [rax + 8], rsi
mov rcx, qword [rax + 0x1d8]
mov rbx, rax
call fcn.140350347
test byte [rbx + 0x40], 0x30
jne 0x1403508a8
lea rcx, [rbx + 0xd0]
mov edx, 1
call qword [sym.imp.msvcrt.dll_longjmp]
mov ecx, dword [0x140361f38]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140350934
cmp qword [rax + 0x28], 0
mov rcx, qword [rax + 0x30]
jne 0x1403508e3
mov dword [rax], 0xdeadbeef
test rcx, rcx
je 0x1403508d8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov esi, dword [rbx + 8]
mov qword [rbx + 0x30], rcx
jmp 0x14035091e
mov dword [rax + 0xbc], 1
mov rsi, qword [rax + 8]
test rcx, rcx
je 0x1403508fc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov qword [rbx + 0x30], rdx
test byte [rbx + 0x44], 4
je 0x140350934
mov dword [rbx], 0xdeadbeef
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rbx + 0x28], rax
mov rcx, rbx
call fcn.14034fcf9
mov ecx, dword [0x140361f38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__endthreadex]
nop
Function at 0x140350f80
Capabilities:
Create thread
Resume thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, rcx
mov rsi, rdx
mov rbp, r8
mov r12, r9
call fcn.14034f9f5
mov rbx, rax
test rax, rax
je 0x140351066
test rdi, rdi
je 0x140350fb8
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
xor r11d, r11d
mov qword [rbx + 8], r12
mov r13, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [rbx + 0xbc], r11d
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov qword [rbx + 0x10], rbp
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r13
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140351021
test ebp, ebp
jne 0x140351012
xor ecx, ecx
mov ebp, 1
call r12
jmp 0x140350fe9
inc ebp
mov ecx, 0x14
call r12
cmp ebp, 5
jne 0x140350fe9
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call fcn.14034faa1
xor r10d, r10d
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], r10d
mov dword [rbx + 0xb8], r10d
jne 0x140351070
test rdi, rdi
je 0x14035105e
xor r9d, r9d
mov qword [rdi], r9
mov rcx, rbx
call fcn.14034fcf9
mov eax, 0xb
jmp 0x140351173
xor ebp, ebp
test rsi, rsi
je 0x14035109c
mov eax, dword [rsi]
mov rbp, qword [rsi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
je 0x140351097
call fcn.14034fbdf
mov eax, dword [rax + 0xc0]
mov dword [rbx + 0xc0], eax
jmp 0x14035109c
mov eax, dword [rsi + 0x18]
jmp 0x14035108f
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov r9, rbx
mov edx, ebp
mov qword [rsp + 0x28], r8
xor ecx, ecx
lea r8, [0x14035059b]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x1403510fc
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1403510dc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.14034f560
mov rcx, r12
call fcn.14034faa1
xor ecx, ecx
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x28], rcx
jmp 0x140351053
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x14035112a
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x14035112a
mov edx, 0xf
cmp eax, 0xe
jg 0x14035112a
mov edx, 2
cmp eax, edx
cmovle edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
je 0x140351160
xor edx, edx
mov rcx, rsi
mov qword [rbx + 0x28], rdx
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140351169
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x100401000
Capabilities:
Packed with generic packer

Disassembly:
sub rsp, 0x28
lea rcx, [0x100412270]
call fcn.100411cb0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.100411cd0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.100411ce0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.100411cf0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
add rsp, 0x28
jmp 0x100411d00
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add dword [rax], eax
add byte [rax + rax], al

Function at 0x100411cb0
Capabilities:
Packed with generic packer

Disassembly:
add byte [rax], al
add byte [rax], al
push rax
add byte [r8], r8b
xchg byte fs:[rdx], cl
add byte [rax], al
add byte [rax], al
add byte [rax], al
invalid

Function at 0x100411cd0
Capabilities:
Packed with generic packer

Disassembly:
add byte [rax + rax], al
add byte [rax + rax], bh
add byte [rdx], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
Function at 0x100411ce0
Capabilities:
Packed with generic packer

Disassembly:
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add al, 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add eax, 0x200
add byte [rax], al
add byte [rax], al
adc byte [rcx], al
add byte [rax], al
add al, 0
add byte [rbp + 0x30000f1], ch
add byte [rax], al
add byte [rax], 0
and byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, dl
add byte [rax], al
mov esp, 0x10
lock add byte [rax], al
call 0x100411d59
movabs al, byte [0x3300000]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x1c0000], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
clc
rol dword [rax], cl
add byte [rax + 3], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], ch
je 0x100411e24
js 0x100411e35
add byte [rax], al
add byte [rax], bl
add byte [r8], al
add byte [rax], dl
add byte [rax], al
add byte [rax + rax], al
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], ah
push rax
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x40], spl
invalid
invalid
Function at 0x100411cf0
Capabilities:
Packed with generic packer

Disassembly:
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add al, 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add eax, 0x200
add byte [rax], al
add byte [rax], al
adc byte [rcx], al
add byte [rax], al
add al, 0
add byte [rbp + 0x30000f1], ch
add byte [rax], al
add byte [rax], 0
and byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, dl
add byte [rax], al
mov esp, 0x10
lock add byte [rax], al
call 0x100411d59
movabs al, byte [0x3300000]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x1c0000], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
clc
rol dword [rax], cl
add byte [rax + 3], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], ch
je 0x100411e24
js 0x100411e35
add byte [rax], al
add byte [rax], bl
add byte [r8], al
add byte [rax], dl
add byte [rax], al
add byte [rax + rax], al
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], ah
push rax
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x40], spl
invalid
invalid
Function at 0x100411d59
Capabilities:
Packed with generic packer

Disassembly:
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add al, 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add eax, 0x200
add byte [rax], al
add byte [rax], al
adc byte [rcx], al
add byte [rax], al
add al, 0
add byte [rbp + 0x30000f1], ch
add byte [rax], al
add byte [rax], 0
and byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add al, dl
add byte [rax], al
mov esp, 0x10
lock add byte [rax], al
call 0x100411d59
movabs al, byte [0x3300000]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x1c0000], dl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
clc
rol dword [rax], cl
add byte [rax + 3], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], ch
je 0x100411e24
js 0x100411e35
add byte [rax], al
add byte [rax], bl
add byte [r8], al
add byte [rax], dl
add byte [rax], al
add byte [rax + rax], al
add byte [rax + rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], ah
push rax
invalid
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax + 0x40], spl
invalid
invalid
Function at 0x140005425
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
sub rsp, 0x58
cmp byte [rcx + 0x79], 0
je 0x140005438
xor esi, esi
jmp 0x140005601
mov rdi, rcx
mov rsi, qword [rcx + 0x48]
test byte [rcx], 1
je 0x140005473
lea rdx, [rdi + 8]
mov r9, qword [rdi + 0x50]
cmp qword [rdi + 0x38], 0xffffffffffffffff
mov rax, qword [rdi + 0x58]
mov rcx, qword [rdi + 0x60]
je 0x140005568
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x140005577
cmp byte [rdi + 0x1a], 0
jne 0x14000558f
mov rax, qword [rdi + 0x50]
mov rcx, qword [rdi + 8]
mov dl, byte [rdi + 0x18]
mov r8d, edx
xor r8b, 1
mov byte [rdi + 0x18], r8b
test rcx, rcx
je 0x1400054ae
cmp rcx, rax
jae 0x1400054a8
cmp byte [rsi + rcx], 0xbf
jg 0x1400054ae
jmp 0x14000560b
jne 0x14000560b
cmp rcx, rax
je 0x140005586
movzx r9d, byte [rsi + rcx]
test r9b, r9b
js 0x1400054c6
mov r8d, r9d
jmp 0x140005522
mov r8d, r9d
and r8d, 0x1f
movzx r11d, byte [rsi + rcx + 1]
and r11d, 0x3f
cmp r9b, 0xdf
jbe 0x140005512
movzx r10d, byte [rsi + rcx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r9b, 0xf0
jb 0x14000551b
movzx r9d, byte [rsi + rcx + 3]
and r8d, 7
shl r8d, 0x12
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
or r8d, r9d
jmp 0x140005522
shl r8d, 6
or r8d, r11d
jmp 0x140005522
shl r8d, 0xc
or r8d, r10d
test dl, 1
jne 0x140005593
cmp r8d, 0x110000
je 0x14000558b
mov edx, 1
cmp r8d, 0x80
jb 0x14000555c
mov edx, 2
cmp r8d, 0x800
jb 0x14000555c
cmp r8d, 0x10000
mov edx, 4
sbb rdx, 0
add rcx, rdx
mov qword [rdi + 8], rcx
jmp 0x140005485
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x40]
mov r8, rsi
call fcn.140005665
jmp 0x1400055aa
test dl, 1
jne 0x140005596
mov byte [rdi + 0x1a], 1
xor eax, eax
jmp 0x1400055a5
mov rax, rcx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov eax, 1
mov qword [rsp + 0x40], rax
test byte [rsp + 0x40], 1
je 0x1400055cb
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rdi + 0x68]
sub rdx, rcx
add rsi, rcx
mov qword [rdi + 0x68], rax
jmp 0x140005601
cmp byte [rdi + 0x79], 0
jne 0x140005431
mov byte [rdi + 0x79], 1
cmp byte [rdi + 0x78], 1
jne 0x1400055e9
mov rsi, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
jmp 0x1400055fa
mov rsi, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
cmp rdx, rsi
je 0x140005431
sub rdx, rsi
add rsi, qword [rdi + 0x48]
mov rax, rsi
add rsp, 0x58
pop rdi
pop rsi
ret
ud2
Function at 0x140007b3c
Capabilities:
Write file on windows

Disassembly:
mov r9, rcx
mov ecx, 0xfffffff4
jmp fcn.140007b91
Function at 0x14000967c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1400096c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400096c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400096c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400096c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400096c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400096c8
xor al, al
add rsp, 0x28
ret