joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b41c0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x48]
test al, al
jne 0x14009352b
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x30]
mov edx, 1
add rsp, 0x20
pop rbx
jmp 0x1400b41c0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
lea rbx, [rcx + 0x48]
mov rcx, rbx
call qword [sym.imp.CONCRT140.dll_public:_void___cdecl_Concurrency::details::_ReentrantBlockingLock::_Acquire_void____ptr64]
mov rcx, qword [rdi + 0x70]
cmp rcx, 0xffffffffffffffff
jne 0x1400b41f1
mov rdi, rcx
jmp 0x1400b4211
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400b420f
xor edx, edx
mov rax, qword [rsp + 0x30]
div rsi
mov rdi, rax
jmp 0x1400b4211
xor edi, edi
mov rcx, rbx
call qword [sym.imp.CONCRT140.dll_public:_void___cdecl_Concurrency::details::_ReentrantBlockingLock::_Release_void____ptr64]
nop
mov rax, rdi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b4820
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rcx
add rcx, 0x48
call qword [sym.imp.CONCRT140.dll_public:_void___cdecl_Concurrency::details::_ReentrantBlockingLock::_Acquire_void____ptr64]
mov rcx, qword [rdi + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x1400b489e
mov rax, qword [rdi + 0x20]
xor ebp, ebp
test rax, rax
je 0x1400b4878
lea edx, [rbp + 1]
mov rcx, rax
call fcn.140094298
mov qword [rdi + 0x20], rbp
mov qword [rdi + 0x30], rbp
mov qword [rdi + 0x38], rbp
mov qword [rdi + 0x28], rbp
mov rcx, qword [rdi + 0x70]
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400b489e
xor edx, edx
mov rax, qword [rsp + 0x30]
div rsi
mov rsi, rax
mov qword [rdi], rax
jmp 0x1400b48a5
mov rsi, 0xffffffffffffffff
lea rcx, [rdi + 0x48]
call qword [sym.imp.CONCRT140.dll_public:_void___cdecl_Concurrency::details::_ReentrantBlockingLock::_Release_void____ptr64]
nop
mov rax, rsi
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b7040
Capabilities:
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rdx
mov rsi, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea ecx, [rbp + 0x20]
call fcn.14009425c
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1400b70a4
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
mov qword [rax], rbp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], 7
mov word [rax], bp
shr r8, 1
mov rcx, rax
call fcn.140095f30
jmp 0x1400b70a7
mov rbx, rbp
mov qword [r14], rbx
mov dword [rsp + 0x20], 1
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp rcx, rax
je 0x1400b7119
sub rax, rcx
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400b70ce
mov rcx, qword [rbx]
xor r8d, r8d
mov edx, eax
call qword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
test eax, eax
je 0x1400b7138
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400b70ea
mov rdx, qword [rbx]
mov rax, qword [rsi + 0x18]
mov rcx, qword [rbx + 0x10]
sub rcx, rax
lea rdi, [rdx + rax*2]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rsi + 0x18]
cmp qword [rbx + 0x10], rax
jb 0x1400b7132
mov qword [rbx + 0x10], rax
cmp qword [rbx + 0x18], 8
jb 0x1400b7115
mov rbx, qword [rbx]
mov word [rbx + rax*2], bp
mov rax, r14
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call fcn.1400058d0
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x28]
call fcn.1400b3bb0
lea rdx, [0x14010b118]
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400c9ae0
Capabilities:
Read http header

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
xor esi, esi
mov dword [rax - 0x18], esi
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
mov dword [rax - 0x18], 1
mov dword [rax + 0x18], esi
mov qword [rax - 0x20], rsi
lea rax, [rax + 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 0x14]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov edx, dword [rsp + 0x60]
mov rax, qword [rbx + 0x10]
cmp rdx, rax
ja 0x1400c9b5e
mov qword [rbx + 0x10], rdx
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400c9b58
mov rax, qword [rbx]
mov word [rax + rdx*2], si
jmp 0x1400c9b6c
xor r8d, r8d
sub rdx, rax
mov rcx, rbx
call fcn.140095c40
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400c9b79
mov r9, qword [rbx]
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r8 + 0x14]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x1400c9caf
mov r9, qword [rbx + 0x18]
cmp r9, 8
jb 0x1400c9bb7
mov rax, qword [rbx]
mov rcx, rax
jmp 0x1400c9bbd
mov rax, rbx
mov rcx, rbx
lea rdx, [r8 + r8]
add rax, rdx
cmp word [rcx], 0
jne 0x1400c9c3f
lea rdx, [rcx + 2]
cmp rdx, rax
je 0x1400c9be2
cmp word [rdx], 0
jne 0x1400c9c10
add rdx, 2
cmp rdx, rax
jne 0x1400c9bd3
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp r9, 8
jb 0x1400c9bf2
mov rax, qword [rbx]
mov word [rax], si
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
sub rax, 2
cmp word [rax], 0
je 0x1400c9c10
sub rax, rdx
lea r8, [rax + 2]
sar r8, 1
mov rcx, rbx
call fcn.140095f30
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
sub rax, 2
cmp word [rax], 0
jne 0x1400c9caf
nop dword [rax]
mov rcx, rax
sub rax, 2
cmp word [rax], 0
je 0x1400c9c50
sub rdx, rcx
mov rax, r8
cmp r9, 8
mov r9, rcx
jb 0x1400c9c77
sub r9, qword [rbx]
add rdx, qword [rbx]
mov rcx, qword [rbx]
jmp 0x1400c9c80
sub r9, rbx
add rdx, rbx
mov rcx, rbx
sar r9, 1
sar rdx, 1
sub rax, r9
cmp rax, rdx
cmovb rdx, rax
lea rcx, [rcx + r9*2]
sub r8, rdx
mov qword [rbx + 0x10], r8
sub r8, r9
lea r8, [r8*2 + 2]
lea rdx, [rcx + rdx*2]
call sub.VCRUNTIME140.dll_memmove
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c9cd0
Capabilities:
Read http header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401d8480]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, r8
mov r12, rdx
mov r14, rcx
mov rdi, qword [r8]
mov rbx, qword [rdi + 0x58]
mov r8, qword [rbx + 8]
lea rdx, [rdi + 0x58]
lea rcx, [rdi + 0x58]
call fcn.1400607a0
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
xor r15d, r15d
mov qword [rdi + 0x60], r15
mov dword [rbp - 0x40], r15d
mov qword [rsp + 0x28], r15
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 0x13]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov edx, dword [rbp - 0x40]
test rdx, rdx
jne 0x1400c9d71
mov qword [rbp - 0x20], rdx
mov word [rbp + rdx*2 - 0x30], r15w
jmp 0x1400c9d7d
xor r8d, r8d
lea rcx, [rbp - 0x30]
call fcn.140095c40
lea r9, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r9, qword [rbp - 0x30]
mov qword [rsp + 0x28], r15
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r8 + 0x13]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rbx, qword [rbp - 0x30]
mov dword [rax], r15d
mov r8d, 0xa
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
mov r15d, eax
cmp rbx, qword [rbp - 0x38]
je 0x1400c9eda
cmp dword [rdi], 0x22
je 0x1400c9ee7
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400c9e2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9e2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c9e2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140094298
mov rax, qword [rsi]
mov word [rax + 0x88], r15w
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.1400c9ae0
nop
mov rcx, qword [rsi]
add rcx, 0x90
cmp rcx, rax
je 0x1400c9e6d
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x1400c9e63
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
call fcn.140095f30
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400c9eb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c9eab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c9eab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140094298
mov rdx, qword [rsi]
add rdx, 0x58
mov rcx, r12
call fcn.1400aa1b0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400cd640
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, str.invalid_stoi_argument
call sub.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_
int3
lea rcx, str.stoi_argument_out_of_range
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x1400cd430
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400cd46a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400cd46f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400cd4b8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400e8d50]
cmp byte [rcx + rax], 0
je 0x1400cd4b8
dec r8
sub rdx, 1
jne 0x1400cd49e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x180001000
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180003008]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rax, 0x6578652e646d63
mov qword [rsp + 0x20], rax
cmp edx, 1
je 0x18000103e
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180001070
add rsp, 0x38
ret
mov edx, 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14083d688
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14083d80f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14083d6b9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14083d69f
add dl, dl
jne 0x14083d6c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14083d726
xor eax, eax
add dl, dl
jne 0x14083d6d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14083d7dd
add dl, dl
jne 0x14083d6e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083d6f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083d700
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083d70d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14083d71a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14083d6ae
mov eax, 1
add dl, dl
jne 0x14083d736
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083d743
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14083d72b
sub eax, ebx
mov ebx, 1
jne 0x14083d77c
mov ecx, 1
add dl, dl
jne 0x14083d75e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14083d76b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14083d753
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083d6ae
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14083d798
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14083d7a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14083d78d
cmp eax, 0x7d00
jae 0x14083d7cb
cmp eax, 0x500
jb 0x14083d7c6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083d6ae
cmp eax, 0x7f
ja 0x14083d7ce
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083d6ae
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14083d802
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14083d6ae
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004880
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x15
jb 0x140004890
mov byte [rcx + 0x19], 0
ret

Function at 0x14000c40c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c456
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c456
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c456
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c456
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c456
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c458
xor al, al
add rsp, 0x28
ret
Function at 0x140e56d27
Capabilities:
Authenticate hmac

Disassembly:
lea rsp, [rsp + 0x28]
mov qword [rbp + riz - 0x10], rsp
js 0x140e8bd72
mov r11d, 0x17117c8f
mov rax, qword [rbp + r11*4 - 0x5c45f23c]
lea rbp, [r11 + rbp - 0x17117c87]
movzx r11d, word [r11 + rsi - 0x17117c8f]
push 0x258f3285
jmp 0x140e43419
sbb rsp, rcx
jmp 0x140e6bdc5
jae 0x140e5c5f8

Function at 0x140e5c857
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp], 0xffffffffbf1cf288
xor dx, r11w
neg dx
shr qword [rsp], 9
sbb dx, 0xb87
neg byte [rsp + 1]
push 0x2eb91b29
jge 0x140e7d9a1
neg dx
add dx, 0x413e
call fcn.140e83ab6

Function at 0x140e7e0d8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rbx], r8d
call fcn.140e6aa7d
mov eax, dword [rbp + riz]
mov ecx, dword [rbp + 4]
mov edx, 0x44b1d423
cpuid
call fcn.140e89f84
jmp 0x140e60538
mov rax, qword [rbp + rbx*8]
jmp 0x140e678f5
jmp 0x140e6a883
jmp 0x140e8efae
mov dword [r9], r8d
lea rsp, [rsp + 8]
jmp fcn.140e6564c
cmp ebx, 1
call fcn.140e84d9b
mov ecx, 0xde8e8d8b
call fcn.140e7b56a
push 0x1039052b
cmp ebx, 4
call fcn.140e8e6b0
jmp 0x140e8df71
lea rsp, [rsp + 0x20]
jne 0x140e5098d
mov eax, 0x48af7625
call fcn.140e3f1c8
neg byte [rsp + 0x11]
sbb dx, 0x2f1e
call fcn.140e63cc0
mov ecx, 0x6815328d
movsx ebx, cx
mov rcx, qword [rcx + rbp - 0x6815328d]
lea rbp, [rbp + rbx*2 - 0x6512]
movzx eax, bx
mov r11, rcx
mov edx, eax
mov r8d, eax
mov ecx, 0xfcb9b2b7
mov r8, rbp
mov ebp, edx
jmp 0x140e4c651
mov r8d, 0xfe178a37
bt r8w, r8w
movzx ecx, word [r9 + riz]
or r8b, 0xab
not r8
imul r8w, r8w
adc r9, 1
inc r8d
add r8, r8
xor cx, r11w
ror cx, 1
rol r8b, 0xc1
rol r8d, 0x1e
inc cx
lea r8, [r8 + r8*2 - 0x51501b57]
imul r8w, r8w
sal r8w, 0xe9
rol cx, 1
or r8d, r8d
bts r8d, 0x98
xor cx, 0xa621
neg r8d
xor r11w, cx
neg r8w
rol r8b, 0xa4
imul r8d, r8d
add rcx, rsp
bts r8d, r8d
mov r8d, dword [rcx + riz]
push 0x59885d0d
sbb rbx, 4
push 0x5237cda1
jmp 0x140e45a4a
jmp 0x140e7b238
Function at 0x140002150
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000219a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000219a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000219a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000219a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000219a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000219c
xor al, al
add rsp, 0x28
ret
Function at 0x14001b924
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001b93a
mov al, 1
jmp 0x14001b99a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001b94b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001b998
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019a78
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b998
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001b998
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001b998
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001b99a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14001fdb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001fdd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001fdd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x510a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x510bc6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00bfe780]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0052d540
xorps xmm15, xmm15
mov r14, qword [0x00caf9c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x510a8b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x510aa0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x510ac5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x510ad9
cmp rbx, 0x1000
jae 0x510a95
nop dword [rax]
jmp 0x510b49
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x510aed
xor edx, edx
jmp 0x510b40
mov rcx, qword [0x00bfe780]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0052d540
xorps xmm15, xmm15
mov r14, qword [0x00caf9c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x510acf
jmp 0x510ab4
call fcn.00561480
xorps xmm15, xmm15
mov r14, qword [0x00caf9c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00531e60
lea rax, [0x0091e590]
mov ebx, 0x18
call fcn.00532760
mov rax, qword [rsp + 0x38]
call fcn.00532460
lea rax, [0x0091e740]
mov ebx, 0x19
call fcn.00532760
mov rax, qword [rsp + 0x30]
nop
call fcn.00532460
call fcn.005320c0
call fcn.00531ee0
lea rax, [0x00924183]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00530520
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0055d840
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00510a20
Function at 0x510c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x510e2a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00bfe788]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0052d5c0
xorps xmm15, xmm15
mov r14, qword [0x00caf9c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x510c79
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x510c8c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x510cb0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x510cc4
cmp rbx, 0x1000
jae 0x510c83
jmp 0x510d45
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x510cd6
xor esi, esi
jmp 0x510d36
mov rax, qword [0x00bfe788]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.0052d5c0
xorps xmm15, xmm15
mov r14, qword [0x00caf9c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x510cba
nop
jmp 0x510ca2
call fcn.00561480
xorps xmm15, xmm15
mov r14, qword [0x00caf9c0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x510dc5
call fcn.00531e60
lea rax, [0x0091f0eb]
mov ebx, 0x19
call fcn.00532760
mov rax, qword [rsp + 0x68]
call fcn.00532460
lea rax, [0x0091e740]
mov ebx, 0x19
call fcn.00532760
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00532460
call fcn.005320c0
call fcn.00531ee0
lea rax, [0x00916656]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00530520
cmp eax, 0x5af
je 0x510d68
call fcn.00531e60
lea rax, [0x0091f0eb]
mov ebx, 0x19
nop dword [rax]
call fcn.00532760
mov rax, qword [rsp + 0x38]
call fcn.00532460
lea rax, [0x0091e740]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00532760
mov eax, dword [rsp + 0x34]
call fcn.00532460
call fcn.005320c0
call fcn.00531ee0
lea rax, [0x00922e64]
mov ebx, 0x1f
call fcn.00530520
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0055d840
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00510c00