joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002160
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400021f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400021f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x86da870b
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400021f2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400021d0
cmp r8d, 0x33b622b2
je 0x1400021fc
test r9d, r9d
jne 0x1400021b0
mov rax, qword [rax]
jmp 0x140002180
mov edx, dword [rbx + 0x24]
mov rcx, rsi
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
jmp rax

Function at 0x140002230
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov rbp, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x140002268
mov rbp, qword [rcx]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400022f6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400022f6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0xf9d2ed4f
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400022f1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400022d0
cmp r8d, 0xff448f0d
je 0x1400022fb
test r9d, r9d
jne 0x1400022b0
mov rax, qword [rax]
jmp 0x140002280
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rdx + rax*4]
add r8, r10
mov edx, 6
mov rcx, rbp
call r8
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140002355
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140002350
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000238a
mov rcx, r8
call fcn.14000793c
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400078e0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140003a40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x150
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, qword [0x14000c6d0]
xor r14d, r14d
mov qword [rsp + 0x28], rcx
mov rsi, rcx
test rax, rax
jne 0x140003b3f
mov rax, qword gs:[0x60]
mov qword [rsp + 0x178], rbp
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov r11, rbp
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140003b18
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140003b18
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0xbc15b79e
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140003b13
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140003af0
cmp edx, 0x6772c516
je 0x140003bb7
test r8d, r8d
jne 0x140003ad0
mov rax, qword [r11]
mov r11, rax
cmp rax, rbp
je 0x140003b2d
cmp qword [rax + 0x30], r14
jne 0x140003aa0
mov rax, r14
mov rbp, qword [rsp + 0x178]
mov qword [0x14000c6d0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rsi + 0x18], r14
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140003b70
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140003c8a
mov qword [rsi + 0x18], 0xf
cmp rbx, 0x10
jae 0x140003bd3
mov r8, rbx
mov qword [rsi + 0x10], rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], r14b
jmp 0x140003c63
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140003b30
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140003c08
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140007900
test rax, rax
je 0x140003c2f
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140003c43
mov ecx, 0x16
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140003c36
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003c90
jmp 0x140003bed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140003c43
call fcn.140007900
mov r14, rax
mov r8, rbx
mov qword [rsi], r14
lea rdx, [rsp + 0x30]
mov qword [rsi + 0x10], rbx
mov rcx, r14
mov qword [rsi + 0x18], rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov rax, rsi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400078e0
mov rbx, qword [rsp + 0x180]
add rsp, 0x150
pop r14
pop rdi
pop rsi
ret
call fcn.1400011a0
int3
call fcn.140001100
int3
Function at 0x140007740
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400077a1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140007760
mov ecx, dword [r9]
jmp 0x140007888
cmp ecx, 0x4e0
jb 0x140007888
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400077c0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140007810
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140008274
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400082be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400082be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400082be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400082be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400082be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400082c0
xor al, al
add rsp, 0x28
ret
Function at 0x1408951a0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1408951ad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1408951bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1408951a5
lea eax, [rcx + 1]
jmp 0x1408951cb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1408951de
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1408951c4
sub eax, 3
jb 0x1408951fe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14089524d
sar eax, 1
movsxd rbp, eax
jb 0x140895234
jmp 0x14089520c
add ebx, ebx
jne 0x14089520a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140895234
inc ecx
add ebx, ebx
jne 0x14089521a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140895234
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14089522d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14089521c
add ecx, 2
jmp 0x140895239
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140895162
jmp 0x1408951ad
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x891000]
mov eax, dword [rdi]
or eax, eax
je 0x1408952b9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x8955cc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14089525d
jns 0x140895292
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14089529c
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1408952b3
mov qword [rbx], rax
add rbx, 8
jmp 0x14089527d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1408952fd
cmp al, 0xef
ja 0x1408952e5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1408952c5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1408952d4
mov eax, dword [rdi]
add rdi, 4
jmp 0x1408952d4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140895351
sub rsp, 0xffffffffffffff80
jmp 0x14007a690
Function at 0x1409f7e18
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409f7f9f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409f7e49
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409f7e2f
add dl, dl
jne 0x1409f7e56
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409f7eb6
xor eax, eax
add dl, dl
jne 0x1409f7e65
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409f7f6d
add dl, dl
jne 0x1409f7e76
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409f7e83
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409f7e90
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409f7e9d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409f7eaa
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409f7e3e
mov eax, 1
add dl, dl
jne 0x1409f7ec6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409f7ed3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409f7ebb
sub eax, ebx
mov ebx, 1
jne 0x1409f7f0c
mov ecx, 1
add dl, dl
jne 0x1409f7eee
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409f7efb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409f7ee3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409f7e3e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409f7f28
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409f7f35
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409f7f1d
cmp eax, 0x7d00
jae 0x1409f7f5b
cmp eax, 0x500
jb 0x1409f7f56
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409f7e3e
cmp eax, 0x7f
ja 0x1409f7f5e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409f7e3e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409f7f92
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409f7e3e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140eda7c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140eda7cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140eda7dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140eda7c5
lea eax, [rcx + 1]
jmp 0x140eda7eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140eda7fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140eda7e4
sub eax, 3
jb 0x140eda81e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140eda86d
sar eax, 1
movsxd rbp, eax
jb 0x140eda854
jmp 0x140eda82c
add ebx, ebx
jne 0x140eda82a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140eda854
inc ecx
add ebx, ebx
jne 0x140eda83a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140eda854
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140eda84d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140eda83c
add ecx, 2
jmp 0x140eda859
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140eda782
jmp 0x140eda7cd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xecc000]
mov eax, dword [rdi]
or eax, eax
je 0x140eda8cd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xeda588]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140eda87d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140eda8c7
mov qword [rbx], rax
add rbx, 8
jmp 0x140eda89d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140eda911
cmp al, 0xef
ja 0x140eda8f9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140eda8d9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140eda8e8
mov eax, dword [rdi]
add rdi, 4
jmp 0x140eda8e8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140eda990], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140eda990
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140eda980
sub rsp, 0xffffffffffffff80
jmp 0x1400014c0
Function at 0x140001010
Capabilities:
Create directory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
call qword [sym.imp.shlwapi.dll_PathSkipRootW]
mov rsi, qword [sym.imp.kernel32.dll_CreateDirectoryW]
mov rbx, rax
test rax, rax
jne 0x14000103c
jmp 0x140001060
add rbx, 2
movzx eax, word [rbx]
test ax, ax
je 0x140001060
cmp ax, 0x5c
jne 0x140001038
xor eax, eax
xor edx, edx
mov rcx, r12
mov word [rbx], ax
call rsi
mov edx, 0x5c
mov word [rbx], dx
jmp 0x140001038
xor edx, edx
mov rcx, r12
call rsi
mov r8d, eax
mov eax, 1
test r8d, r8d
jne 0x14000108a
mov rax, qword gs:[0x30]
cmp dword [rax + 0x68], 0xb7
sete al
movzx eax, al
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140001540
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor edx, edx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rcx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14000156a
add rsp, 0x28
ret
test byte [0x140010000], 2
jne 0x14000157e
mov ecx, 1
call qword [sym.imp.kernel32.dll_ExitProcess]
lea r9, str.out_of_memory_n
lea r8, global___func__.2
mov ecx, 1
lea rdx, [0x140010000]
call sym.wine_dbg_log.constprop.0
jmp 0x140001573
Function at 0x1400016a0
Capabilities:
Enumerate processes

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x170
lea r13, [0x140010000]
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x40]
mov qword [rsp + 0x38], 0
test byte [0x140010000], 8
jne 0x140001810
xor edx, edx
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400017a8
lea rbx, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x130
mov esi, edi
mov rdx, rbx
call sym.Process32First
test eax, eax
jne 0x14000172b
jmp 0x1400017e0
mov rdx, rbx
mov rcx, r12
call sym.Process32Next
test eax, eax
je 0x1400017e0
cmp esi, dword [rsp + 0x48]
jne 0x140001718
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.kernel32.dll_OpenProcess]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140001870
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov ecx, 1
mov dword [rsp + 0x20], 0x1cff
mov r9d, 0xffffffff
call qword [sym.imp.user32.dll_MsgWaitForMultipleObjects]
test eax, eax
jne 0x140001830
nop word [rax + rax]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001790
call qword [sym.imp.kernel32.dll_CloseHandle]
test r12, r12
jne 0x1400017bf
add rsp, 0x170
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
test byte [0x140010000], 2
jne 0x1400018b8
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x14000178a
mov rcx, r12
call qword [sym.imp.kernel32.dll_CloseHandle]
nop
add rsp, 0x170
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
test byte [0x140010000], 4
je 0x140001780
mov dword [rsp + 0x20], edi
lea r9, str.Unable_to_find_current_process_id__ld_when_listing_processes_n
mov rdx, r13
mov ecx, 2
lea r8, str.WaitForParentProcess
call sym.wine_dbg_log.constprop.0
jmp 0x140001780
lea r9, str.Waiting_for_parent_process_n
lea r8, str.WaitForParentProcess
mov rdx, r13
mov ecx, 3
call sym.wine_dbg_log.constprop.0
jmp 0x1400016d8
test byte [0x140010000], 2
je 0x140001780
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
lea r9, str.Unable_to_wait_for_parent_process__error__ld_n
mov rdx, r13
mov ecx, 1
lea r8, str.WaitForParentProcess
mov dword [rsp + 0x20], eax
call sym.wine_dbg_log.constprop.0
jmp 0x140001780
test byte [0x140010000], 4
je 0x140001790
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
lea r9, str.OpenProcess_failed_pid_ld__error__ld_n
mov rdx, r13
mov ecx, 2
lea r8, str.WaitForParentProcess
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call sym.wine_dbg_log.constprop.0
jmp 0x140001780
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x68]
lea r9, str.CreateToolhelp32Snapshot_failed__error__ld_n
mov rdx, r13
mov ecx, 1
lea r8, str.WaitForParentProcess
mov dword [rsp + 0x20], eax
call sym.wine_dbg_log.constprop.0
jmp 0x1400017b5
Function at 0x1400018f0
Capabilities:
Check if process is running under wine
Set registry value

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x40
mov r12, rcx
mov rbx, rdx
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareWineMenuFiles
call qword [sym.imp.advapi32.dll_RegCreateKeyW]
test eax, eax
jne 0x140001980
mov r13, qword [rsp + 0x38]
test r13, r13
je 0x14000198c
cmp word [rbx], 0
mov rax, rbx
je 0x1400019a6
nop
add rax, 2
cmp word [rax], 0
jne 0x140001930
sub rax, rbx
sar rax, 1
lea eax, [rax + rax + 2]
mov rdx, r12
mov r9d, 1
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov rcx, r13
mov r12d, eax
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, r12d
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
mov rdx, qword gs:[0x30]
mov dword [rdx + 0x68], eax
mov rax, qword gs:[0x30]
mov r12d, dword [rax + 0x68]
mov eax, r12d
add rsp, 0x40
pop rbx
pop r12
pop r13
ret
mov eax, 2
jmp 0x140001944

Function at 0x140001a80
Capabilities:
Encode data using xor

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rdx
movzx edx, word [rdx]
mov ebx, ecx
test dx, dx
je 0x140001b4c
lea r11, [rsi + 2]
xor eax, eax
mov ecx, 0x10
nop dword [rax]
mov r10d, eax
shr ax, 1
xor r10d, edx
mov r8d, eax
xor r8w, 0xa001
and r10d, 1
cmovne eax, r8d
shr dx, 1
sub ecx, 1
jne 0x140001aa8
movzx edx, word [r11]
add r11, 2
test dx, dx
jne 0x140001aa0
movzx r12d, ax
mov rcx, rsi
mov edx, 0x5c
mov rdi, qword [sym.imp.ucrtbase.dll_wcsrchr]
call rdi
lea rdx, [rax + 2]
test rax, rax
cmovne rsi, rdx
mov edx, 0x2e
mov rcx, rsi
call rdi
test rax, rax
je 0x140001b2f
sub rax, rsi
mov r8, rax
sar r8, 1
mov dword [rsp + 0x20], ebx
mov r9, rsi
mov edx, r12d
lea rcx, str._04X__.s._d
call dbg.heap_wprintf
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
ret
cmp word [rsi], 0
je 0x140001b51
mov rax, rsi
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140001b40
jmp 0x140001b06
xor r12d, r12d
jmp 0x140001adb
xor r8d, r8d
jmp 0x140001b0f

Function at 0x140001d30
Capabilities:
Query or enumerate registry key

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rdi, qword [sym.imp.advapi32.dll_RegEnumKeyExW]
mov r13, qword [sym.imp.kernel32.dll_HeapFree]
mov r14, qword gs:[0x30]
mov rsi, rcx
mov dword [rsp + 0x4c], 0x800
mov ebx, edx
mov ecx, 0x800
lea rbp, [rsp + 0x4c]
jmp 0x140001d8f
cmp eax, 0xea
jne 0x140001de0
mov rax, qword [r14 + 0x60]
shl dword [rsp + 0x4c], 1
mov r8, r12
xor edx, edx
mov rcx, qword [rax + 0x30]
call r13
mov ecx, dword [rsp + 0x4c]
call dbg.xmalloc
mov r9, rbp
mov edx, ebx
mov rcx, rsi
mov qword [rsp + 0x38], 0
mov r12, rax
mov r8, rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
jne 0x140001d70
mov rax, r12
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, r12
xor edx, edx
xor r12d, r12d
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140001dcc