joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e8fcc
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140123c20
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x538
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xe6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x558]
mov rax, qword [0x140349e40]
xor rax, rbp
mov qword [rbp + 0x508], rax
mov qword [rbp + 0x308], 0
lea rcx, [0x14036e877]
call fcn.1400eb8ad
nop
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 0xf
call fcn.1400e922e
mov qword [rbp + 0x268], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400e9bd4
nop
mov dword [rbp + 0x284], 0
call fcn.1400eadfe
mov dword [rbp + 0x2a4], eax
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x2e8], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400e769a
mov qword [rbp + 0x4d8], rax
lea rax, [rbp + 0x3c]
mov qword [rbp + 0x2c8], rax
cmp qword [rbp + 0x2c8], 0
jne 0x140123d08
mov qword [rbp + 0x4e0], 0
jmp 0x140123df3
mov rcx, qword [rbp + 0x2c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0x3fffffff
jle 0x140123d39
mov qword [rbp + 0x4e8], 0
jmp 0x140123de5
movsxd rax, dword [rbp + 0x284]
shl rax, 1
mov qword [rbp + 0x4f0], rax
movsxd rcx, dword [rbp + 0x284]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x4f8], rcx
mov rcx, qword [rbp + 0x4f8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x4f8]
ja 0x140123d7d
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e7cfd
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x500], rax
lea r8, [rbp + 0x308]
mov rdx, qword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x500]
call fcn.1400ebf47
add qword [rbp + 0x500], 0x20
mov r9d, dword [rbp + 0x2a4]
mov rax, qword [rbp + 0x4f0]
mov r8d, eax
mov rdx, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x500]
call fcn.1400e8941
mov qword [rbp + 0x4e8], rax
mov rax, qword [rbp + 0x4e8]
mov qword [rbp + 0x4e0], rax
mov rdx, qword [rbp + 0x4d8]
mov rcx, qword [rbp + 0x4e0]
call fcn.1400ebfa6
test eax, eax
jne 0x140123e35
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
mov dword [rbp + 0x4a4], eax
mov rcx, qword [rbp + 0x538]
call fcn.1400e7d34
mov eax, dword [rbp + 0x4a4]
jmp 0x140123e77
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400eae67
test eax, eax
jne 0x140123cd0
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rbp + 0x4c4], 0
mov rcx, qword [rbp + 0x538]
call fcn.1400e7d34
mov eax, dword [rbp + 0x4c4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402cdf50]
mov r8, qword [rbp + 0x308]
call fcn.1400e9f08
mov rax, rdi
mov rcx, qword [rbp + 0x508]
xor rcx, rbp
call fcn.1400e92d8
lea rsp, [rbp + 0x518]
pop rdi
pop rbp
ret
Function at 0x1400e9855
Capabilities:
Terminate process

Disassembly:
jmp 0x1402b4b80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400e9e54
Capabilities:
Write file on windows

Disassembly:
jmp 0x140155e20
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14036ead1]
call fcn.1400eb8ad
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400e9ebd
Capabilities:
Get geographical location

Disassembly:
jmp 0x140290b70
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140290bad
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1400eb87b
add rsp, 0x58
ret

Function at 0x1400ea0b1
Capabilities:
Read file on windows

Disassembly:
jmp 0x140155da0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14036ead1]
call fcn.1400eb8ad
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400ea0cf
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140157e00
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x14036ead1]
call fcn.1400eb8ad
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1402cf600]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x140157f46
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x140157e9a
mov dword [rbp + 0x160], 1
jmp 0x140157ea4
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x140157f41
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x140157f1b
cmp qword [rbp + 0x198], 2
jb 0x140157f1b
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140157f1b
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140157f1b
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140157e65
jmp 0x140157fe0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x140157fe0
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x140157fb7
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140157fb7
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140157fb7
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x140157f46
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400ea291
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402b6410
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1402b6430
xor al, al
jmp 0x1402b64b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1402b6443
xor al, al
jmp 0x1402b64b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1402b646d
xor al, al
jmp 0x1402b64b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1402b6481
xor al, al
jmp 0x1402b64b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1402b6493
xor al, al
jmp 0x1402b64b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1402b64af
xor al, al
jmp 0x1402b64b1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400eae4e
Capabilities:
Create directory

Disassembly:
jmp 0x1402921b0
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140349e40]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1402921ed
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x140292262
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x140292250
mov edx, 1
mov ecx, 2
call fcn.1400e729e
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1400e8473
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x140292250
mov edx, 0x10
mov ecx, dword [rsp + 0x48]
call fcn.1400e78c0
movzx eax, al
test eax, eax
jne 0x140292250
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e92d8
add rsp, 0x68
ret
Function at 0x1400eb330
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140157ce0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x14036ead1]
call fcn.1400eb8ad
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1402cf600]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x140157d60
mov dword [rbp + 0x120], 1
jmp 0x140157d6a
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x140157db3
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x140157d2b
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400eb3bc
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x14011d460
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7f8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x166
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x818]
mov rax, qword [0x140349e40]
xor rax, rbp
mov qword [rbp + 0x7c8], rax
mov qword [rbp + 0x508], 0
lea rcx, [0x14036e588]
call fcn.1400eb8ad
nop
mov dword [rbp + 0x10], 0x438
mov rax, qword [rbp + 0x7f0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call fcn.1400e922e
mov qword [rbp + 0x468], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400e9cf1
nop
mov dword [rbp + 0x484], 0
call fcn.1400eadfe
mov dword [rbp + 0x4a4], eax
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4e8], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400e769a
mov qword [rbp + 0x798], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
jne 0x14011d550
mov qword [rbp + 0x7a0], 0
jmp 0x14011d63b
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x3fffffff
jle 0x14011d581
mov qword [rbp + 0x7a8], 0
jmp 0x14011d62d
movsxd rax, dword [rbp + 0x484]
shl rax, 1
mov qword [rbp + 0x7b0], rax
movsxd rcx, dword [rbp + 0x484]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x7b8], rcx
mov rcx, qword [rbp + 0x7b8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x7b8]
ja 0x14011d5c5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e7cfd
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x7c0], rax
lea r8, [rbp + 0x508]
mov rdx, qword [rbp + 0x7b8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400ebf47
add qword [rbp + 0x7c0], 0x20
mov r9d, dword [rbp + 0x4a4]
mov rax, qword [rbp + 0x7b0]
mov r8d, eax
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400e8941
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x7a0], rax
mov rdx, qword [rbp + 0x798]
mov rcx, qword [rbp + 0x7a0]
call fcn.1400ebfa6
test eax, eax
jne 0x14011d680
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x768], rax
mov rcx, qword [rbp + 0x7f8]
call fcn.1400e7d34
mov rax, qword [rbp + 0x768]
jmp 0x14011d6c4
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400e7aa5
test eax, eax
jne 0x14011d518
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rbp + 0x788], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400e7d34
mov rax, qword [rbp + 0x788]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402cd970]
mov r8, qword [rbp + 0x508]
call fcn.1400e9f08
mov rax, rdi
mov rcx, qword [rbp + 0x7c8]
xor rcx, rbp
call fcn.1400e92d8
lea rsp, [rbp + 0x7d8]
pop rdi
pop rbp
ret
Function at 0x1400eb7c2
Capabilities:
Write file on windows

Disassembly:
jmp 0x140285e80
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140349e40]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x14036f65e]
call fcn.1400eb8ad
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x140285ee7
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140285eee
mov al, 1
jmp 0x14028605e
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.1400e838d
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.1400e838d
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.1400ea97b
movzx eax, al
test eax, eax
je 0x140285f51
xor al, al
jmp 0x14028605e
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x140285fc4
cmp dword [rbp + 0x160], 1
je 0x140285fcf
cmp dword [rbp + 0x160], 3
je 0x14028604d
jmp 0x14028605c
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14028601f
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14028601f
xor al, al
jmp 0x14028605e
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14028603a
mov dword [rbp + 0x154], 1
jmp 0x140286044
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14028605e
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14028605e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14031f3d0]
call fcn.1400eac6e
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.1400e92d8
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1402b5230
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400ebb41
movzx eax, al
test eax, eax
jne 0x1402b5250
mov ecx, 7
call fcn.1400eace1
nop
mov byte [rsp + 0x20], 0
call fcn.1400eae12
mov byte [rsp + 0x21], al
cmp dword [0x140354450], 1
jne 0x1402b5274
mov ecx, 7
call fcn.1400eace1
nop
jmp 0x1402b52cc
cmp dword [0x140354450], 0
jne 0x1402b52c7
mov dword [0x140354450], 1
lea rdx, [0x1402c7d68]
lea rcx, [0x1402c7a38]
call fcn.1400e9210
test eax, eax
je 0x1402b52a8
mov eax, 0xff
jmp 0x1402b53d1
lea rdx, [0x1402c7928]
lea rcx, [section..rdata]
call fcn.1400eadd6
mov dword [0x140354450], 2
jmp 0x1402b52cc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400eac05
call fcn.1400ea485
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1402b5329
mov rcx, qword [rsp + 0x30]
call fcn.1400e8ba8
movzx eax, al
test eax, eax
je 0x1402b5329
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140371020]
nop
call fcn.1400ea7a0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1402b535d
mov rcx, qword [rsp + 0x38]
call fcn.1400e8ba8
movzx eax, al
test eax, eax
je 0x1402b535d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400eb682
nop
call fcn.1402b5440
mov dword [rsp + 0x28], eax
call fcn.1400ea291
movzx eax, al
test eax, eax
jne 0x1402b537c
mov ecx, dword [rsp + 0x28]
call fcn.1400e7550
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1402b538b
call fcn.1400eb74a
nop
xor edx, edx
mov cl, 1
call fcn.1400e8a09
mov eax, dword [rsp + 0x28]
jmp 0x1402b53d1
add rsp, 0x68
ret
Function at 0x180044630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, dword [rsp + 0x80]
mov r13, r9
mov r12, r8
mov rbp, rdx
mov r14, rcx
lea r15d, [rax + 8]
cmp eax, r15d
jae case.0x18004469b.5
mov ebx, dword [rsp + 0x80]
lea edi, [rax - 0x128]
lea rdx, [0x180000000]
cmp edi, 0x19
ja case.0x18004469b.7
movzx eax, byte [rdx + rdi + 0x447dc]
mov ecx, dword [rdx + rax*4 + 0x447bc]
add rcx, rdx
jmp rcx
movzx ecx, byte [r12]
shl qword [rbp + 0x10], cl
mov eax, dword [r12]
sub dword [rbp + 0x18], eax
jmp case.0x18004469b.7
mov esi, dword [r13]
xor ebx, ebx
xor r8d, r8d
test esi, esi
jle case.0x18004469b.7
mov r11d, dword [r12]
xor eax, eax
test r11d, r11d
jle 0x18004470f
mov ecx, dword [r14]
mov r10d, r8d
imul ecx, r8d
sar r10d, 8
movsxd r9, ecx
add r9, rbp
mov ecx, eax
lea r9, [r9 + 1]
sar ecx, 8
movzx edx, cl
movzx ecx, byte [r9 - 1]
xor edx, ecx
movzx ecx, r8b
xor edx, ecx
movzx ecx, r10b
xor edx, ecx
movzx ecx, al
xor edx, ecx
inc eax
add ebx, edx
cmp eax, r11d
jl 0x1800446e2
inc r8d
cmp r8d, esi
jl 0x1800446c7
lea rdx, [0x180000000]
jmp case.0x18004469b.7
call qword [0x180063810]
mov qword [rsp + 0x20], rax
lea rdx, [0x180000000]
jmp case.0x18004469b.7
mov rax, qword [rbp + 0x47fc8]
mov eax, dword [rax + 0x340]
imul eax, dword [r13]
add eax, dword [r12]
cdqe
imul rcx, rax, 0x16
mov rax, qword [rbp + 0x49830]
movzx ecx, word [rcx + rax + 2]
imul rax, rcx, 0xf20
lea rcx, [rbp + 0xb7b8]
add rcx, rax
mov qword [rsp + 0x20], rcx
jmp case.0x18004469b.7
cmp byte [0x180063839], 0
je 0x180044790
inc edi
lea eax, [rdi + 0x128]
cmp eax, r15d
jb 0x180044680
jmp case.0x18004469b.5
xor eax, eax
jmp 0x18004479d
mov dword [rsp + 0x20], ebx
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001196c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400119b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400119b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400119b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400119b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400119b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400119b8
xor al, al
add rsp, 0x28
ret

Function at 0x1400160a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400160c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400160c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x181e32058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x181e321df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x181e32089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181e3206f
add dl, dl
jne 0x181e32096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181e320f6
xor eax, eax
add dl, dl
jne 0x181e320a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x181e321ad
add dl, dl
jne 0x181e320b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181e320c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181e320d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181e320dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x181e320ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x181e3207e
mov eax, 1
add dl, dl
jne 0x181e32106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x181e32113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181e320fb
sub eax, ebx
mov ebx, 1
jne 0x181e3214c
mov ecx, 1
add dl, dl
jne 0x181e3212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181e3213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181e32123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181e3207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x181e32168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x181e32175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x181e3215d
cmp eax, 0x7d00
jae 0x181e3219b
cmp eax, 0x500
jb 0x181e32196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181e3207e
cmp eax, 0x7f
ja 0x181e3219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x181e3207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x181e321d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x181e3207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20