joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [str.t_t_]
mov dword [rax], 1
mov rax, qword [str.x_t_]
mov dword [rax], 1
mov rax, qword [str._t_]
mov dword [rax], 1
mov rax, qword [str.P_t_]
mov dword [rax], 1
mov rax, qword [0x140087b70]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140007e39
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp + 0x20]
je 0x140007e8a
mov rcx, qword [rbp + 0x10]
call sym.checkErr__stdZsyncio_u165__iobuf_
jmp 0x140007e8b
nop
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rbp
ret

Function at 0x140009083
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x18], 0
je 0x1400090ab
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen_char___clone_lto_priv1_
mov rdx, rax
jmp 0x1400090b0
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140012eeb
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140017302
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rax, str.echoBinSafe
mov qword [rbp - 0x48], rax
lea rax, str.C:Users_adminDesktop_nim_2.0.2lib_system.nim
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov word [rbp - 0x30], 0
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.nimFrame_TFrame____clone_lto_priv8_
mov qword [rbp - 0x40], 0xac5
lea rax, [0x140093420]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x40], 0xd
lea rax, str.C:Users_adminDesktop_nim_2.0.2lib_systemiterators.nim
mov qword [rbp - 0x38], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x40], 0xe
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jge 0x14001746a
mov qword [rbp - 0x40], 0xac6
lea rax, str.C:Users_adminDesktop_nim_2.0.2lib_system.nim
mov qword [rbp - 0x38], rax
cmp qword [rbp - 8], 0
js 0x1400173bd
mov rax, qword [rbp - 8]
cmp rax, qword [rbp + 0x18]
jl 0x1400173d1
mov rax, qword [rbp + 0x18]
lea rdx, [rax - 1]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.raiseIndexError2_long_long__long_long_
mov rax, qword [rbp - 8]
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x10], rax
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea rax, [rbp - 0x70]
mov r8d, 0
mov rdx, rax
call sym.writeWindows__system_u9051__iobuf__NimStringV2__bool_
mov qword [rbp - 0x40], 0x10
lea rax, str.C:Users_adminDesktop_nim_2.0.2lib_systemiterators.nim
mov qword [rbp - 0x38], rax
mov edx, 0
mov rax, qword [rbp - 8]
add rax, 1
jno 0x140017444
mov edx, 1
mov rcx, rax
lea rax, [rbp - 0x58]
mov qword [rax], rcx
mov rax, rdx
and eax, 1
test al, al
je 0x14001745d
call sym.raiseOverflow__
mov rax, qword [rbp - 0x58]
mov qword [rbp - 8], rax
jmp 0x14001738b
nop
mov qword [rbp - 0x40], 0xae1
lea rax, str.C:Users_adminDesktop_nim_2.0.2lib_system.nim
mov qword [rbp - 0x38], rax
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 1
mov edx, 1
lea rax, [0x140082749]
mov rcx, rax
call sym.fwrite
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x40], 0xae2
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sub.msvcrt.dll_fflush
mov dword [rbp - 0x1c], eax
mov qword [rbp - 0x40], 0xae6
lea rax, [0x140093420]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
call sym.popFrame____clone_lto_priv8_
nop
add rsp, 0x90
pop rbp
ret
Function at 0x14005beec
Capabilities:
Hash data using sha256

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
lea rax, str.init
mov qword [rbp - 0x28], rax
lea rax, str.C:Users_admin.nimblepkgs2_nimcrypto_0.6.0_08bf76f6be37823d74cc4e91e2df0d8ee3ed8b3d_nimcrypto_sha2.nim
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], 0
mov word [rbp - 0x10], 0
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.nimFrame_TFrame____clone_lto_priv29_
mov qword [rbp - 0x20], 0x85
mov rax, qword [rbp + 0x10]
mov dword [rax], 0
mov qword [rbp - 0x20], 0x86
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0
mov qword [rbp - 0x20], 0x91
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0x6a09e667
mov qword [rbp - 0x20], 0x92
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 0xbb67ae85
mov qword [rbp - 0x20], 0x93
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x10], 0x3c6ef372
mov qword [rbp - 0x20], 0x94
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 0xa54ff53a
mov qword [rbp - 0x20], 0x95
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x18], 0x510e527f
mov qword [rbp - 0x20], 0x96
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x1c], 0x9b05688c
mov qword [rbp - 0x20], 0x97
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1f83d9ab
mov qword [rbp - 0x20], 0x98
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x24], 0x5be0cd19
call sym.popFrame____clone_lto_priv29_
nop
add rsp, 0x50
pop rbp
ret
Function at 0x14006d8a8
Capabilities:
Hash data with md5

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
lea rax, str.md5Init
mov qword [rbp - 0x28], rax
lea rax, str.C:Users_admin.nimblepkgs2checksums_0.1.0_3b0211c13e33fa7c8bbf1504604206d983fd3491checksumsmd5.nim
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], 0
mov word [rbp - 0x10], 0
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.nimFrame_TFrame____clone_lto_priv35_
mov qword [rbp - 0x20], 0x126
mov rax, qword [rbp + 0x10]
mov dword [rax], 0x67452301
mov qword [rbp - 0x20], 0x127
mov rax, qword [rbp + 0x10]
mov dword [rax + 4], 0xefcdab89
mov qword [rbp - 0x20], 0x128
mov rax, qword [rbp + 0x10]
mov dword [rax + 8], 0x98badcfe
mov qword [rbp - 0x20], 0x129
mov rax, qword [rbp + 0x10]
mov dword [rax + 0xc], 0x10325476
mov qword [rbp - 0x20], 0x12a
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x10], 0
mov qword [rbp - 0x20], 0x12b
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x14], 0
mov qword [rbp - 0x20], 0x12c
mov rcx, qword [rbp + 0x10]
call sym._ZL143clearBuffer__OOZOOZOnimbleZpkgs50Zchecksums4548O49O484551b48504949c4951e5151fa55c56bbf49534852544852504854d575651fd51525
call sym.popFrame____clone_lto_priv35_
nop
add rsp, 0x50
pop rbp
ret

Function at 0x140078000
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140078c32
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140093e08]
test eax, eax
je 0x140078cca
lea rax, [0x140093de0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140093e10]
mov qword [rbp - 8], rax
jmp 0x140078cae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140078ca2
cmp qword [rbp - 0x10], 0
je 0x140078ca2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140078c68
lea rax, [0x140093de0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140078ccb
nop
add rsp, 0x30
pop rbp
ret
Function at 0x140078dd0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140078df8
mov eax, 0
jmp 0x140078e46
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140078e21
mov eax, 0
jmp 0x140078e46
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140078e41
mov eax, 0
jmp 0x140078e46
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140078e4c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140078eca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140078ec1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140078ec1
mov rax, qword [rbp - 8]
jmp 0x140078edf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140078e94
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140055c50
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140055c5d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140055c6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140055c55
lea eax, [rcx + 1]
jmp 0x140055c7b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140055c8e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140055c74
sub eax, 3
jb 0x140055cae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140055cfd
sar eax, 1
movsxd rbp, eax
jb 0x140055ce4
jmp 0x140055cbc
add ebx, ebx
jne 0x140055cba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140055ce4
inc ecx
add ebx, ebx
jne 0x140055cca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140055ce4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140055cdd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140055ccc
add ecx, 2
jmp 0x140055ce9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140055c12
jmp 0x140055c5d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1a00
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140055d4d
cmp rsi, rcx
jae 0x140055d55
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140055d34
cmp al, 0x8f
ja 0x140055d34
cmp byte [rsi - 2], 0xf
je 0x140055d3a
sub al, 0xe8
cmp al, 1
ja 0x140055d1e
cmp rsi, rcx
jae 0x140055d55
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140055d24
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140055d55
lodsb al, byte [rsi]
jmp 0x140055d34
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x53000]
mov eax, dword [rdi]
or eax, eax
je 0x140055db2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x55444]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140055d62
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140055dac
mov qword [rbx], rax
add rbx, 8
jmp 0x140055d82
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140055dec
cmp al, 0xef
ja 0x140055dde
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140055dbe
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140055dcd
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140055e6b], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140055e6b
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140055e5b
sub rsp, 0xffffffffffffff80
jmp 0x1400014e0
Function at 0x140243ea0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140243ead
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140243ebd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140243ea5
lea eax, [rcx + 1]
jmp 0x140243ecb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140243ede
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140243ec4
sub eax, 3
jb 0x140243efe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140243f4d
sar eax, 1
movsxd rbp, eax
jb 0x140243f34
jmp 0x140243f0c
add ebx, ebx
jne 0x140243f0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140243f34
inc ecx
add ebx, ebx
jne 0x140243f1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140243f34
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140243f2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140243f1c
add ecx, 2
jmp 0x140243f39
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140243e62
jmp 0x140243ead
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xc3400
mov dl, 0x2c
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140243f9d
cmp rsi, rcx
jae 0x140243fa5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140243f84
cmp al, 0x8f
ja 0x140243f84
cmp byte [rsi - 2], 0xf
je 0x140243f8a
sub al, 0xe8
cmp al, 1
ja 0x140243f6e
cmp rsi, rcx
jae 0x140243fa5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140243f74
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140243fa5
lodsb al, byte [rsi]
jmp 0x140243f84
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x23f000]
mov eax, dword [rdi]
or eax, eax
je 0x14024400e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2441e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140243fb2
jns 0x140243fe7
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140243ff1
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140244008
mov qword [rbx], rax
add rbx, 8
jmp 0x140243fd2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140244048
cmp al, 0xef
ja 0x14024403a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14024401a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140244029
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14024409c
sub rsp, 0xffffffffffffff80
jmp 0x1400c0570
Function at 0x1400370a0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400370ad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400370bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400370a5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1400370d5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400370c2
sub eax, 3
jb 0x1400370ef
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140037126
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140037116
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140037114
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140037103
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140037062
jmp 0x1400370ad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x12800
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140037172
cmp rsi, rcx
jae 0x14003717a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140037159
cmp al, 0x8f
ja 0x140037159
cmp byte [rsi - 2], 0xf
je 0x14003715f
sub al, 0xe8
cmp al, 1
ja 0x140037143
cmp rsi, rcx
jae 0x14003717a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140037149
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003717a
lodsb al, byte [rsi]
jmp 0x140037159
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x35000]
mov eax, dword [rdi]
or eax, eax
je 0x1400371d7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x478f4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140037187
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400371d1
mov qword [rbx], rax
add rbx, 8
jmp 0x1400371a7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140037211
cmp al, 0xef
ja 0x140037203
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400371e3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400371f2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140037265
sub rsp, 0xffffffffffffff80
jmp 0x140001614
Function at 0x140774058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407741df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140774089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077406f
add dl, dl
jne 0x140774096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407740f6
xor eax, eax
add dl, dl
jne 0x1407740a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407741ad
add dl, dl
jne 0x1407740b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407740c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407740d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407740dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407740ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14077407e
mov eax, 1
add dl, dl
jne 0x140774106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140774113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407740fb
sub eax, ebx
mov ebx, 1
jne 0x14077414c
mov ecx, 1
add dl, dl
jne 0x14077412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140774123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140774168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140774175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077415d
cmp eax, 0x7d00
jae 0x14077419b
cmp eax, 0x500
jb 0x140774196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077407e
cmp eax, 0x7f
ja 0x14077419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407741d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14077407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400061c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x1400061e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x40]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x1400061d0
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x1400061f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140039240]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov esi, 0xffffffff
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x140006266
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140006240
jmp 0x14000626a
mov esi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140007280
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret