joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x14001c340]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r14, rcx
mov edi, 1
mov rbx, qword [0x14001dea0]
movzx edx, dx
mov r8d, 0xf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140006621
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140006621
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140006621
xor r15d, r15d
mov r13d, 0x403
mov r12d, 0x1234
nop dword [rax]
movzx esi, word [rbx]
cmp r15w, si
je 0x140006621
movzx eax, word [rbx + 2]
mov ebp, dword [rbx + 4]
add rbx, 8
cmp r13w, ax
jne 0x140006592
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140008010
nop
mov edx, esi
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x143
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
mov eax, r15d
cmovne eax, edi
mov edi, eax
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x14000658d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
jmp 0x140006616
cmp r12w, ax
jne 0x140006616
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], 0xffffffffffffffff
lea rax, [rsp + 0x188]
mov qword [rsp + 0x180], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x180]
call fcn.140008010
mov rcx, qword [rsp + 0x180]
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x188]
cmp rcx, rax
je 0x1400065f0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov edx, esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x40b
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
nop
cmp rax, 0xffffffffffffffff
je 0x14000664e
add rbx, rbp
test edi, edi
jne 0x140006510
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140010860
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, r15d
jmp 0x140006623
Function at 0x14000f1c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rbx, rdx
mov rbp, rcx
call fcn.14000f300
mov rdi, 0xffffffffffffffff
mov rdx, rbx
mov rcx, rbp
lea r8d, [rdi + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14000f2e1
mov r8d, 0xf0
mov qword [rsp + 0x68], r15
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
mov r15d, ebx
test rax, rax
je 0x14000f23d
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
mov rdx, rsi
mov qword [rsp + 0x60], r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000f2c3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14000f2c3
mov rdx, r15
mov rcx, rax
call fcn.14000db90
mov rsi, rax
mov r9, r12
mov rax, qword [rsp + 0x80]
mov rdx, rsi
mov r8, r13
mov qword [rsp + 0x20], rax
mov rcx, rbp
call fcn.14000f770
mov rdi, rax
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x14000f2a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, r14
je 0x14000f2cb
test rsi, rsi
je 0x14000f2cb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x14000f2cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
test ebx, ebx
je 0x14000f2e1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x70]
mov rax, rdi
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f5a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14d, r9d
mov r15, r8
mov r12, rdx
mov r13d, ecx
xor edi, edi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rdi
cmp dword [0x14001d744], edi
jne 0x14000f685
mov eax, dword [0x14001d740]
test eax, eax
jne 0x14000f685
mov esi, edi
mov r8d, dword [0x14001d74c]
test r8d, r8d
je 0x14000f618
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14001d740]
mov r8d, dword [0x14001d74c]
test eax, eax
je 0x14000f625
mov ebx, 1
mov esi, ebx
jmp 0x14000f654
test r8d, r8d
jne 0x14000f638
call fcn.140001640
test eax, eax
jne 0x14000f638
lea ebx, [rax + 1]
jmp 0x14000f654
lea rdx, [rsp + 0x60]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x14000f68a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14000f675
cmp eax, 0x78
je 0x14000f675
cmp eax, 1
je 0x14000f675
cmp eax, 0x32
jne 0x14000f67d
mov dword [0x14001d740], ebx
mov esi, ebx
test esi, esi
jne 0x14000f68a
mov ebx, edi
jmp 0x14000f68a
mov ebx, 1
test ebx, ebx
jne 0x14000f6af
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8, r15
mov rdx, r12
mov ecx, r13d
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rsi, rax
mov qword [rsp + 0x68], rax
cmp dword [0x14001d744], 0
je 0x14000f73b
cmp dword [0x14001d740], 0
jne 0x14000f768
mov ebx, edi
test rsi, rsi
sete bl
test ebx, ebx
je 0x14000f74f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14000f768
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x14000f690
Function at 0x14000f770
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x38], 0xffffffffffffffff
xor edi, edi
mov qword [rsp + 0x30], rdi
cmp dword [0x14001d744], edi
jne 0x14000f855
mov eax, dword [0x14001d740]
test eax, eax
jne 0x14000f855
mov esi, edi
mov edx, dword [0x14001d74c]
test edx, edx
je 0x14000f7e9
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14001d740]
mov edx, dword [0x14001d74c]
test eax, eax
je 0x14000f7f6
mov ebx, 1
mov esi, ebx
jmp 0x14000f824
test edx, edx
jne 0x14000f808
call fcn.140001640
test eax, eax
jne 0x14000f808
lea ebx, [rax + 1]
jmp 0x14000f824
lea rdx, [rsp + 0x30]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x14000f85a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14000f845
cmp eax, 0x78
je 0x14000f845
cmp eax, 1
je 0x14000f845
cmp eax, 0x32
jne 0x14000f84d
mov dword [0x14001d740], ebx
mov esi, ebx
test esi, esi
jne 0x14000f85a
mov ebx, edi
jmp 0x14000f85a
mov ebx, 1
test ebx, ebx
jne 0x14000f884
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, r15
mov rdx, r12
mov rcx, r13
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp dword [0x14001d744], 0
je 0x14000f8bd
cmp dword [0x14001d740], 0
jne 0x14000f8eb
mov ebx, edi
cmp rsi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x14000f8d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14000f8eb
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
jmp 0x14000f865
Function at 0x14000f900
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov r12, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x68], rdi
cmp dword [0x14001d744], edi
jne 0x14000f9dc
mov eax, dword [0x14001d740]
test eax, eax
jne 0x14000f9dc
mov esi, edi
mov r8d, dword [0x14001d74c]
test r8d, r8d
je 0x14000f96f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14001d740]
mov r8d, dword [0x14001d74c]
test eax, eax
je 0x14000f97c
mov ebx, 1
mov esi, ebx
jmp 0x14000f9ab
test r8d, r8d
jne 0x14000f98f
call fcn.140001640
test eax, eax
jne 0x14000f98f
lea ebx, [rax + 1]
jmp 0x14000f9ab
lea rdx, [rsp + 0x68]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x14000f9e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14000f9cc
cmp eax, 0x78
je 0x14000f9cc
cmp eax, 1
je 0x14000f9cc
cmp eax, 0x32
jne 0x14000f9d4
mov dword [0x14001d740], ebx
mov esi, ebx
test esi, esi
jne 0x14000f9e1
mov ebx, edi
jmp 0x14000f9e1
mov ebx, 1
test ebx, ebx
jne 0x14000fa01
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov r8, r14
mov rdx, r15
mov rcx, r12
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov esi, eax
mov dword [rsp + 0x20], eax
cmp dword [0x14001d744], 0
je 0x14000fa28
cmp dword [0x14001d740], 0
jne 0x14000fa54
mov ebx, edi
test esi, esi
sete bl
test ebx, ebx
je 0x14000fa3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14000fa54
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x14000f9e7
Function at 0x14000fa60
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, rcx
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x20], edi
mov r14, qword [0x14001d768]
mov qword [rsp + 0x58], rdi
cmp dword [0x14001d744], edi
jne 0x14000fb3e
mov eax, dword [0x14001d740]
test eax, eax
jne 0x14000fb3e
mov esi, edi
mov ecx, dword [0x14001d74c]
test ecx, ecx
je 0x14000fad0
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14001d740]
mov ecx, dword [0x14001d74c]
test eax, eax
je 0x14000fadd
mov ebx, 1
mov esi, ebx
jmp 0x14000fb0b
test ecx, ecx
jne 0x14000faef
call fcn.140001640
test eax, eax
jne 0x14000faef
lea ebx, [rax + 1]
jmp 0x14000fb0b
lea rdx, [rsp + 0x58]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x14000fb43
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
add eax, 0xffffff82
cmp eax, 1
jbe 0x14000fb2e
cmp ecx, 0x78
je 0x14000fb2e
cmp ecx, 1
je 0x14000fb2e
cmp ecx, 0x32
jne 0x14000fb36
mov dword [0x14001d740], ebx
mov esi, ebx
test esi, esi
jne 0x14000fb43
mov ebx, edi
jmp 0x14000fb43
mov ebx, 1
test ebx, ebx
jne 0x14000fb63
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
test r14, r14
jne 0x14000fb83
lea rcx, str.GetSaveFileNameW
call fcn.14000f4d0
mov r14, rax
test rax, rax
je 0x14000fb96
mov qword [0x14001d768], rax
mov rcx, r12
mov rax, r14
call qword [0x140013710]
mov r15d, eax
mov dword [rsp + 0x20], eax
cmp dword [0x14001d744], 0
je 0x14000fba8
cmp dword [0x14001d740], 0
jne 0x14000fbd5
mov ebx, edi
test r15d, r15d
sete bl
test ebx, ebx
je 0x14000fbbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14000fbd5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, r15d
jmp 0x14000fb49

Function at 0x14000fbe0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x14001d74c]
mov rbx, rcx
test eax, eax
je 0x14000fc06
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14001d74c]
cmp dword [0x14001d740], 0
jne 0x14000fc5f
test eax, eax
jne 0x14000fc1c
call fcn.140001640
test eax, eax
je 0x14000fc30
mov rcx, qword [section..data]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x14000fc5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14000fc55
cmp eax, 0x78
je 0x14000fc55
cmp eax, 1
je 0x14000fc55
cmp eax, 0x32
je 0x14000fc55
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [0x14001d740], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14000fc70
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov word [rsp + 0x20], di
mov qword [rsp + 0x48], rdi
cmp dword [0x14001d744], edi
jne 0x14000fd3f
mov eax, dword [0x14001d740]
test eax, eax
jne 0x14000fd3f
mov esi, edi
mov edx, dword [0x14001d74c]
test edx, edx
je 0x14000fcd3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14001d740]
mov edx, dword [0x14001d74c]
test eax, eax
je 0x14000fce0
mov ebx, 1
mov esi, ebx
jmp 0x14000fd0e
test edx, edx
jne 0x14000fcf2
call fcn.140001640
test eax, eax
jne 0x14000fcf2
lea ebx, [rax + 1]
jmp 0x14000fd0e
lea rdx, [rsp + 0x48]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne esi, ebx
test esi, esi
jne 0x14000fd44
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x14000fd2f
cmp eax, 0x78
je 0x14000fd2f
cmp eax, 1
je 0x14000fd2f
cmp eax, 0x32
jne 0x14000fd37
mov dword [0x14001d740], ebx
mov esi, ebx
test esi, esi
jne 0x14000fd44
mov ebx, edi
jmp 0x14000fd44
mov ebx, 1
test ebx, ebx
jne 0x14000fd61
movzx eax, di
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov rcx, r14
call qword [sym.imp.USER32.dll_RegisterClassExW]
movzx esi, ax
mov word [rsp + 0x20], ax
cmp dword [0x14001d744], 0
je 0x14000fd84
cmp dword [0x14001d740], 0
jne 0x14000fdb1
mov ebx, edi
test si, si
sete bl
test ebx, ebx
je 0x14000fd98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14000fdb1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, si
jmp 0x14000fd4b
Function at 0x140011504
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001154e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001154e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001154e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001154e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001154e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140011550
xor al, al
add rsp, 0x28
ret
Function at 0x1400073d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rbp, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.140015e84
mov r15, rax
test rax, rax
je 0x1400074e3
xor edx, edx
mov r8d, 2
mov rcx, r12
call fcn.14000fc2c
test eax, eax
js 0x1400074e3
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.140018804
mov rbx, rax
cmp rax, rbp
jb 0x1400074de
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
nop dword [rax + rax]
cmp rbx, 0x2000
lea rsi, [rbx - 0x2000]
cmovb rsi, r13
sub rbx, rsi
cmp rbx, rbp
jb 0x1400074d4
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call fcn.14000fc2c
test eax, eax
js 0x1400074d4
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14000f8f4
cmp rax, rbx
jne 0x1400074d4
sub rbx, rbp
add rbx, 1
je 0x1400074bb
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax]
nop dword [rax + rax]
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.14002bae0
test eax, eax
je 0x1400074cd
dec rdi
sub rbx, 1
jne 0x1400074a0
lea rbx, [rbp - 1]
add rbx, rsi
test rsi, rsi
jne 0x140007440
jmp 0x1400074d4
lea r13, [rbx - 1]
add r13, rsi
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.140015e70
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18000b133
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push rsi
sub rsp, 0xb8
xor eax, eax
xor edx, edx
mov r8d, edx
mov dword [0x180066448], 0xd00
mov dword [0x18006644c], 0xa35
mov qword [rbp - 0x38], rcx
mov dword [rbp - 0x3c], eax
mov qword [rbp - 0x48], r8
jmp 0x18000b21b
mov dword [0x18006644c], 0x31f
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x50]
mov r8d, dword [rbp - 0x54]
call fcn.18000bf55
mov rcx, qword [rbp - 0x50]
add rcx, 0x4bd2
mov rdx, qword [rbp - 0x38]
mov qword [rdx], rcx
mov qword [rdx + 8], 0x1f0600
mov dword [0x180066448], 0x17da
mov rcx, qword [rbp - 0x50]
add rcx, 0x8f4
mov qword [rdx + 0x10], rcx
mov eax, dword [0x18006644c]
add eax, 0x739
mov dword [0x18006644c], eax
mov rcx, qword [rbp - 0x38]
mov qword [rcx + 0x18], 0x2030
xor eax, eax
add rsp, 0xb8
pop rsi
pop rbp
ret
mov rax, qword [rbp - 0x60]
lea rcx, [0x18000d593]
lea rdx, [0x18000d650]
mov r8b, byte [rdx + rax]
mov r9b, byte [rcx + rax]
sub r9b, r8b
mov byte [rbp + rax - 0x30], r9b
add rax, 1
cmp rax, 0xe
mov qword [rbp - 0x60], rax
je 0x18000b299
jmp 0x18000b1e1
mov rax, qword [rbp - 0x48]
mov ecx, dword [rbp - 0x3c]
lea rdx, section..data
mov r8, rax
add r8, 1
imul r9, rax, 0x168
mov r10, rdx
add r10, r9
add r10, 0x10
imul rax, rax, 0x168
add rdx, rax
add rdx, 0xc0
mov r11d, dword [rdx]
xor r11d, dword [r10]
add r11d, ecx
cmp r8, 0x3ec
mov ecx, r11d
mov dword [rbp - 0x3c], ecx
mov dword [rbp - 0x54], r11d
mov qword [rbp - 0x48], r8
jne 0x18000b21b
xor eax, eax
mov ecx, eax
mov dword [0x180066448], 0x125f
mov dword [0x18006644c], 0xe59
mov qword [rbp - 0x60], rcx
jmp 0x18000b1e1
lea rdx, [rbp - 0x30]
mov eax, dword [rbp - 0x54]
mov ecx, eax
mov r8d, ecx
mov dword [0x180066448], 0x2a84
mov dword [0x18006644c], 0xfffff3e5
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], r8
call fcn.18000bdbc
mov rcx, rax
mov rdx, qword [rbp - 0x68]
call fcn.18000abb1
xor r9d, r9d
mov ecx, r9d
mov r8d, 0x1000
mov r9d, 4
mov dword [0x180066448], 0x1961
mov rdx, qword [rbp - 0x70]
call rax
mov qword [rbp - 0x50], rax
xor eax, eax
mov ecx, eax
xor eax, eax
mov edx, dword [0x18006644c]
mov dword [rbp - 0x74], edx
mov qword [rbp - 0x80], rcx
mov dword [rbp - 0x84], eax
mov eax, dword [rbp - 0x84]
mov rcx, qword [rbp - 0x80]
mov edx, dword [rbp - 0x74]
lea r8, section..data
imul r9, rcx, 0x168
mov r10, r8
add r10, r9
add r10, 0xc0
mov r11d, dword [r10]
imul r9, rcx, 0x168
mov r10, r8
add r10, r9
add r10, 0x160
mov r9, qword [r10]
imul r10, rcx, 0x168
add r8, r10
add r8, 0x10
mov esi, dword [r8]
add edx, 0xfffff9d2
mov dword [0x180066448], edx
xor esi, r11d
mov edx, eax
mov r8d, edx
mov r10, qword [rbp - 0x50]
add r10, r8
mov edx, esi
mov r8d, edx
mov qword [rbp - 0x90], rcx
mov rcx, r10
mov rdx, r9
mov dword [rbp - 0x94], eax
mov dword [rbp - 0x98], esi
call fcn.18000c021
mov eax, dword [0x18006644c]
mov r11d, eax
add r11d, 0xf76
mov dword [0x180066448], r11d
mov r11d, dword [rbp - 0x98]
mov esi, dword [rbp - 0x94]
add r11d, esi
mov rcx, qword [rbp - 0x90]
add rcx, 1
cmp rcx, 0x3ec
mov dword [rbp - 0x74], eax
mov qword [rbp - 0x80], rcx
mov dword [rbp - 0x84], r11d
je 0x18000b16a
jmp 0x18000b311
Function at 0x18000b987
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov eax, dword [0x180066448]
mov qword [rbp - 8], rcx
mov dword [rbp - 0xc], eax
mov eax, 0x1165
lea rcx, [0x18000b7b4]
mov edx, dword [rbp - 0xc]
add edx, 0x540
mov dword [0x18006644c], edx
mov r8, qword [rbp - 8]
cmp r8, 0
mov dword [rbp - 0x10], eax
mov qword [rbp - 0x18], rcx
jne 0x18000ba37
mov rax, qword [rbp - 0x18]
mov ecx, dword [rbp - 0x10]
cmp word [rax], 0x5a4d
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x24], ecx
jne 0x18000b9f8
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rax + rcx]
mov dword [rbp - 0x28], edx
mov eax, dword [rbp - 0x28]
cmp eax, 0x4550
je 0x18000ba24
mov dword [0x18006644c], 0xa
mov rax, qword [rbp - 0x20]
add rax, 0xfffffffffffff000
and rax, 0xfffffffffffff000
mov ecx, dword [rbp - 0x24]
add ecx, 0x85b
mov dword [rbp - 0x10], ecx
mov qword [rbp - 0x18], rax
jmp 0x18000b9cb
mov eax, dword [rbp - 0x24]
mov dword [0x180066448], eax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x30], rax
jmp 0x18000ba52
mov dword [0x18006644c], 0x10eb
xor eax, eax
mov edx, eax
mov rcx, qword [rbp - 8]
call fcn.18000baaa
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
add rsp, 0x50
pop rbp
ret
Function at 0x140f58058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140f581df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f58089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f5806f
add dl, dl
jne 0x140f58096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f580f6
xor eax, eax
add dl, dl
jne 0x140f580a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f581ad
add dl, dl
jne 0x140f580b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f580c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f580d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f580dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f580ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f5807e
mov eax, 1
add dl, dl
jne 0x140f58106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f58113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f580fb
sub eax, ebx
mov ebx, 1
jne 0x140f5814c
mov ecx, 1
add dl, dl
jne 0x140f5812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f5813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f58123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f5807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f58168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f58175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f5815d
cmp eax, 0x7d00
jae 0x140f5819b
cmp eax, 0x500
jb 0x140f58196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f5807e
cmp eax, 0x7f
ja 0x140f5819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f5807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f581d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f5807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20