joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800441c0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18006c9a8]
mov edx, 0x210
call fcn.180029360
cmp byte [rax], 0
je 0x180044236
xor edx, edx
mov ecx, 0x210
call fcn.18002b890
test al, al
je 0x180044236
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180044236
mov rbx, qword [0x18006c9a8]
cmp byte [rbx + 0x37b9], 0
je 0x180044222
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.18001e390
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov rcx, qword [0x18006c9a8]
mov edx, 0x214
call fcn.180029360
cmp byte [rax], 0
je 0x1800442a6
xor edx, edx
mov ecx, 0x214
call fcn.18002b890
test al, al
je 0x1800442a6
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1800442a6
mov rbx, qword [0x18006c9a8]
cmp byte [rbx + 0x37b9], 0
je 0x180044292
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.18001e390
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov rcx, qword [0x18006c9a8]
mov edx, 0x212
call fcn.180029360
cmp byte [rax], 0
je 0x180044316
xor edx, edx
mov ecx, 0x212
call fcn.18002b890
test al, al
je 0x180044316
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180044316
mov rbx, qword [0x18006c9a8]
cmp byte [rbx + 0x37b9], 0
je 0x180044302
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.18001e390
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov rcx, qword [0x18006c9a8]
mov edx, 0x216
call fcn.180029360
cmp byte [rax], 0
je 0x180044386
xor edx, edx
mov ecx, 0x216
call fcn.18002b890
test al, al
je 0x180044386
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x180044386
mov rbx, qword [0x18006c9a8]
cmp byte [rbx + 0x37b9], 0
je 0x180044372
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.18001e390
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x18004a040
Capabilities:
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov dword [rsp + 0x60], 8
mov r14, rdx
mov dword [rsp + 0x50], ebx
xor edx, edx
mov dword [rsp + 0x68], ebx
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, str.HTTPREAD
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x28], rbx
lea rdx, str.http:__ossweb_img.qq.com_images_lol_img_item_2056.png
mov rcx, rax
mov dword [rsp + 0x20], 0x80000002
xor r9d, r9d
xor r8d, r8d
mov rsi, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8, [rsp + 0x50]
mov edx, 0x20000005
mov rdi, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x18004a103
mov ecx, eax
mov qword [r14], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x68]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x18004a119
xor r8d, r8d
lea rdx, str.http:__ossweb_img.qq.com_images_lol_img_item_2056.png
lea rcx, str._Error_Http:_s__ReadFileLen:_d_n
call fcn.18001cda0
test rdi, rdi
je 0x18004a127
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test rsi, rsi
je 0x18004a135
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x18004f080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x148]
mov rsi, rcx
mov edi, r8d
mov rbx, rdx
movabs rcx, 0x100000001b3
movabs r10, 0xcbf29ce484222325
mov r11, qword [rax + 0x28]
nop word [rax + rax]
movsx r9, byte [r11]
lea r11, [r11 + 1]
xor r10, r9
imul r10, rcx
test r9b, r9b
jne 0x18004f0c0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], r10
lea rcx, [0x18006cc50]
call fcn.180016120
mov rdx, qword [rax + 8]
cmp qword [rax], rdx
je 0x18004f2e0
lea rdx, [rsp + 0x30]
lea rcx, [0x18006cc50]
call fcn.180016120
movsxd rcx, dword [rsi + 0x28]
mov rax, qword [rax]
movss xmm2, dword [rax + rcx*4 - 4]
lea eax, [rdi - 4]
xor ecx, ecx
cmp eax, 1
jbe 0x18004f1eb
movss xmm0, dword [rbx + 0x15a8]
lea rdx, [rbx + 0x4e08]
cmp edi, 3
jne 0x18004f1b0
mov r8d, ecx
mov r9, rdx
mov rax, qword [r9]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f15d
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0xc2e
je 0x18004f16c
inc r8
add r9, 8
cmp r8, 6
jl 0x18004f141
jmp 0x18004f174
addss xmm0, dword [0x1800628f4]
mov rax, qword [rdx]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f190
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0xc01
je 0x18004f1a2
inc rcx
add rdx, 8
cmp rcx, 6
jl 0x18004f174
jmp 0x18004f2ae
addss xmm0, dword [0x180062900]
jmp 0x18004f2ae
mov rax, qword [rdx]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f1cc
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0xc59
je 0x18004f1de
inc rcx
add rdx, 8
cmp rcx, 6
jl 0x18004f1b0
jmp 0x18004f2ae
addss xmm0, dword [0x1800628e4]
jmp 0x18004f2ae
mov rdx, rcx
lea rax, [rbx + 0x51e0]
cmp dword [rax], 0x209b
je 0x18004f212
inc rdx
add rax, 4
cmp rdx, 6
jl 0x18004f1f5
movss xmm0, dword [rsp + 0x30]
jmp 0x18004f220
movss xmm0, dword [rsp + 0x30]
addss xmm0, dword [0x1800628ec]
lea rdx, [rbx + 0x4e08]
mov r8, rcx
mov r9, rdx
nop dword [rax]
mov rax, qword [r9]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f24c
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0xc56
je 0x18004f25b
inc r8
add r9, 8
cmp r8, 6
jl 0x18004f230
jmp 0x18004f263
addss xmm0, dword [0x1800628dc]
mov rax, qword [rdx]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f27f
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0x19dd
je 0x18004f28e
inc rcx
add rdx, 8
cmp rcx, 6
jl 0x18004f263
jmp 0x18004f296
addss xmm0, dword [0x1800628ec]
movabs rax, qword [0x14197d200]
cmp dword [rax + 8], 0xc
jne 0x18004f2ae
addss xmm0, dword [0x180062920]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18004f2cd
movaps xmm1, xmm0
addss xmm1, dword [0x180062930]
divss xmm0, xmm1
mulss xmm0, xmm2
subss xmm2, xmm0
movaps xmm0, xmm2
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xorps xmm0, xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18004f300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rcx + 0x148]
mov rbx, rcx
movabs rcx, 0x100000001b3
movabs r10, 0xcbf29ce484222325
mov r11, qword [rax + 0x28]
nop dword [rax + rax]
movsx r9, byte [r11]
lea r11, [r11 + 1]
xor r10, r9
imul r10, rcx
test r9b, r9b
jne 0x18004f330
mov rax, qword [0x18006cc38]
mov rcx, qword [0x18006cc40]
movaps xmmword [rsp + 0x20], xmm7
cmp rax, rcx
je 0x18004f374
nop dword [rax]
cmp qword [rax + 8], rdx
jne 0x18004f36b
cmp qword [rax], r10
je 0x18004f382
add rax, 0x18
cmp rax, rcx
jne 0x18004f360
xorps xmm0, xmm0
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret
movss xmm7, dword [rax + 0x10]
ucomiss xmm7, dword [0x180062990]
jp 0x18004f392
je 0x18004f374
movabs rax, 0x14198a1b8
movaps xmmword [rsp + 0x30], xmm6
mov rcx, rbx
movss xmm6, dword [rax]
call fcn.18004f080
addss xmm0, xmm7
xorps xmm1, xmm1
movaps xmm7, xmmword [rsp + 0x20]
subss xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
maxss xmm0, xmm1
add rsp, 0x40
pop rbx
ret
Function at 0x1800541a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x90
mov r11, rdx
mov r9, rcx
lea r10, [rcx + 0x4128]
cmp byte [rcx + 0x1330], 0
jne 0x180054217
mov word [rcx + 0x1331], 1
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0xa0], rax
mov byte [rcx + 0x1334], al
movzx eax, byte [rsp + 0xa1]
mov byte [rcx + 0x1335], al
movzx eax, byte [rsp + 0xa2]
mov byte [rcx + 0x1336], al
movzx eax, byte [rsp + 0xa3]
mov byte [rcx + 0x1337], al
mov byte [rcx + 0x1338], 0
mov byte [rcx + 0x1330], 1
mov dword [rsp + 0xb0], r8d
mov eax, dword [rcx + 0x1334]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rcx + 0x1331]
test al, al
je 0x18005425a
xor ecx, ecx
mov edx, eax
nop dword [rax + rax]
mov eax, dword [rsp + rcx + 0xa0]
not eax
xor dword [rsp + rcx + 0xb0], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x180054240
movzx eax, byte [r9 + 0x1332]
mov ecx, 4
sub rcx, rax
cmp rcx, 4
jae 0x18005428a
movzx eax, byte [rsp + rcx + 0xa0]
not al
xor byte [rsp + rcx + 0xb0], al
inc rcx
cmp rcx, 4
jb 0x180054270
movzx eax, byte [r9 + 0x1338]
inc al
and eax, 3
mov ecx, eax
mov eax, dword [rsp + 0xb0]
mov dword [r9 + rcx*4 + 0x133c], eax
mov byte [r9 + 0x1338], cl
mov dword [r10 + 0x38], r8d
mov r9, qword [r10 + 0x18]
movabs rdx, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movsx rcx, byte [r9]
lea r9, [r9 + 1]
xor rdx, rcx
imul rdx, rbx
test cl, cl
jne 0x1800542d0
movabs rax, 0x2374c594f5e76f06
cmp rdx, rax
jne 0x18005430b
lea eax, [r8 - 0x1d]
cmp eax, 7
ja 0x180054382
mov byte [r10 + 0x9c], cl
jmp 0x1800543b7
movabs rax, 0xf9bdf861cccd5fd1
cmp rdx, rax
jne 0x180054330
lea eax, [r8 - 0x1a]
cmp eax, 6
ja 0x180054382
mov byte [r10 + 0x9c], 0
jmp 0x1800543b7
movabs rax, 0xb4d052affec8dc8e
cmp rdx, rax
jne 0x180054345
cmp r8d, 0x10
jmp 0x180054358
movabs rax, 0x311a797a90e58f21
cmp rdx, rax
jne 0x180054364
cmp r8d, 6
jne 0x180054382
mov byte [r10 + 0x9c], 0
jmp 0x1800543b7
movabs rcx, 0x2f2959b508f215d2
movabs rax, 0xecc3c7c77aebb7ea
cmp rdx, rcx
je 0x1800543a5
cmp rdx, rax
je 0x1800543a5
cmp byte [r10 + 0x9c], 0xff
je 0x1800543b7
movabs rax, 0xeb5bc0df5355fba6
cmp rdx, rax
je 0x1800543b7
mov byte [r10 + 0x9c], 0xff
jmp 0x1800543b7
cmp r8d, 7
jne 0x1800543d2
cmp rdx, rcx
je 0x1800543dd
mov rax, qword [r10]
mov qword [r10 + 8], rax
mov dl, 1
mov rcx, r10
movabs rax, 0x1401a4050
call rax
nop
add rsp, 0x90
pop rbx
ret
cmp r8d, 6
jne 0x1800543b0
cmp rdx, rax
jne 0x1800543b0
mov rax, qword [r10]
mov qword [r10 + 8], rax
mov dword [rsp + 0x80], 1
mov byte [rsp + 0x78], 0
mov dword [rsp + 0x70], 0
lea rax, [0x1800623d8]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x50], 0xff
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x40], 1
mov byte [rsp + 0x38], 0
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
xor r9d, r9d
mov rdx, r11
mov rcx, r10
movabs rax, 0x1401ba4a0
call rax
nop
add rsp, 0x90
pop rbx
ret
Function at 0x1800544e0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 8
movzx eax, byte [rcx + 0x2b]
mov rdx, rcx
xor r10d, r10d
mov dword [r11 + 8], r10d
mov rax, qword [rcx + rax*8 + 8]
movabs rcx, 0x14154f6d0
mov qword [r11 + 0x10], rax
movdqu xmm3, xmmword [rcx]
movzx ecx, byte [rdx + 0x29]
test cl, cl
je 0x18005462f
lea r8, [r11 + 0x10]
lea r9, [r11 + 8]
sub r8, rdx
sub r9, rdx
test cl, 0xf8
jbe 0x1800545ed
lea rax, [r11 + 0x10]
mov qword [r11 + 0x18], rbx
sub r8, rax
mov qword [rsp], rdi
lea rax, [r11 + 0x10]
sub r9, rax
lea rcx, [r11 + 0x10]
sub rcx, 0x20
lea rax, [rsp + 0x18]
lea rbx, [r8 + rdx]
lea rdi, [r8 + rdx]
mov r8, rdx
lea r11, [r9 + rdx]
sub r8, rax
movdqu xmm0, xmmword [rbx + rcx + 0x20]
add r10, 8
movdqu xmm1, xmmword [r8 + rcx + 0x20]
lea rcx, [rcx + 0x40]
andnps xmm1, xmm3
xorps xmm1, xmm0
movups xmmword [rdi + rcx - 0x20], xmm1
movdqu xmm0, xmmword [r11 + rcx - 0x20]
movdqu xmm1, xmmword [r8 + rcx - 0x10]
andnps xmm1, xmm3
xorps xmm1, xmm0
movups xmmword [r11 + rcx - 0x20], xmm1
movdqu xmm0, xmmword [rcx]
movdqu xmm2, xmmword [r8 + rcx]
andnps xmm2, xmm3
xorps xmm2, xmm0
movups xmmword [rcx], xmm2
movdqu xmm1, xmmword [r8 + rcx + 0x10]
movdqu xmm0, xmmword [r11 + rcx]
andnps xmm1, xmm3
xorps xmm1, xmm0
movups xmmword [r11 + rcx], xmm1
movzx r9d, byte [rdx + 0x29]
mov eax, r9d
and eax, 0xf8
cmp r10, rax
jb 0x180054564
mov rax, qword [rsp + 0x18]
movzx ecx, r9b
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x20]
movzx r8d, cl
cmp r10, r8
jae 0x180054678
test cl, cl
je 0x180054678
lea rcx, [rsp + 0x18]
sub rdx, rcx
lea rax, [rsp + 0x18]
nop
mov rcx, qword [rdx + rax]
lea rax, [rax + 8]
not rcx
xor qword [rax - 8], rcx
sub r8, 1
jne 0x180054610
mov rax, qword [rsp + 0x18]
add rsp, 8
ret
movzx r8d, byte [rdx + 0x2a]
test r8b, r8b
je 0x180054678
mov ecx, 8
sub cl, r8b
cmp cl, 8
jae 0x180054678
movzx eax, cl
lea rcx, [rsp + 0x18]
add rcx, rax
lea rax, [rsp + 0x18]
sub rdx, rax
nop dword [rax]
movzx eax, byte [rdx + rcx]
lea rcx, [rcx + 1]
not al
xor byte [rcx - 1], al
sub r8, 1
jne 0x180054660
mov rax, qword [rsp + 0x18]
add rsp, 8
ret
Function at 0x140001c80
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140001ae8
Function at 0x1400010e0
Capabilities:
Allocate or change rwx memory
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov esi, 0x1f4
xor r12d, r12d
movabs rbp, 0x4e94914f0000
movabs r13, 0x7fffffffffffffff
movabs r15, 0xb2f4fc0794908cf3
movabs r14, 0x431bde82d7b634db
movabs rbx, 0x7ffffffffa0a1eff
dec esi
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
lea rcx, [rsp + 0x30]
call fcn.140001000
mov rax, qword [rsp + 0x30]
lea rdi, [rax + 0x5f5e100]
cmp rax, rbx
jl 0x140001171
mov rdi, r13
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140001192
imul rax, rcx, 0x64
jmp 0x140001203
cmp rbx, 0x16e3600
jne 0x1400011e5
mov rax, r15
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r15
imul rcx, rcx, 0x3b9aca00
imul rcx
lea rax, [rcx + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r8, 0x3b9aca00
jmp 0x140001200
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jge 0x140001252
mov rcx, rdi
sub rcx, rax
cmp rcx, rbp
jle 0x140001224
mov edx, 0x5265c00
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140001171
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140001246
inc edx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140001171
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cmp byte [r12], 0xfc
jne 0x140001285
cmp byte [1], 0x48
je 0x14000128e
test esi, esi
je 0x1400012dd
jmp 0x14000113b
lea r9, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, str.User_Agent
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov r8d, 0xc00
mov rbx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001330
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001c90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001cda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001cda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001cda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001cda
cmp dword [rcx + 0x84], 0xe
jbe 0x140001cda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001cdc
xor al, al
add rsp, 0x28
ret

Function at 0x180a6f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180a6f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180a6f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a6f06f
add dl, dl
jne 0x180a6f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a6f0f6
xor eax, eax
add dl, dl
jne 0x180a6f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180a6f1ad
add dl, dl
jne 0x180a6f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a6f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a6f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a6f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180a6f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180a6f07e
mov eax, 1
add dl, dl
jne 0x180a6f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180a6f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a6f0fb
sub eax, ebx
mov ebx, 1
jne 0x180a6f14c
mov ecx, 1
add dl, dl
jne 0x180a6f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180a6f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a6f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a6f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180a6f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180a6f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180a6f15d
cmp eax, 0x7d00
jae 0x180a6f19b
cmp eax, 0x500
jb 0x180a6f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a6f07e
cmp eax, 0x7f
ja 0x180a6f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180a6f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180a6f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180a6f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xchg dword [rdi - 0x5050079], eax
cli
push qword [rdi + 0x77]
ja 0x14003f627
invalid
fstp st(5)
invalid
mov ch, 0xb5
mov ch, 0xff
outsb dx, byte [rsi]
outsb dx, byte [rsi]
outsb dx, byte [rsi]
invalid
Function at 0x14481
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rbp
sub rsp, 0x90
mov ebp, r8d
mov r8, rcx
mov r15, rdx
test r9, r9
je 0x1454b
mov rax, r9
and rax, 0xf
neg rax
and rax, 0xf
mov r10d, dword [rax + r9]
cmp r10d, 0x2052494a
je 0x142f3
mov eax, 0xffffffef
add rsp, 0x90
pop rbp
pop r14
pop r15
ret
test rcx, rcx
je 0x1454b
mov r10, qword [rsp + 0xd0]
test r10, r10
je 0x1454b
test rdx, rdx
je 0x1454b
test ebp, ebp
jle 0x14325
mov r10d, dword [rax + r9 + 8]
cmp r10d, 4
je 0x14337
mov eax, 0xffffff89
add rsp, 0x90
pop rbp
pop r14
pop r15
ret
test ebp, 0xf
je 0x14351
mov eax, 0xffffff84
add rsp, 0x90
pop rbp
pop r14
pop r15
ret
mov r14, qword [rsp + 0xd0]
xor r10d, r10d
movzx r11d, byte [r10 + r14]
mov byte [rsp + r10 + 0x60], r11b
add r10, 1
cmp r10, 0x10
jl 0x1435c
test rcx, 3
jne 0x14386
test rdx, 3
je 0x1446f
cmp ebp, 0x10
jl 0x1453c
mov qword [rsp + 0x48], rcx
mov r8d, ebp
lea r15, [rsp + 0x70]
lea r14, [rsp + 0x80]
xor r11d, r11d
lea r10, [r9 + rax + 0x110]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov rsi, r10
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r13
sar r8d, 3
shr r8d, 0x1c
add r8d, ebp
sar r8d, 4
xor ebp, ebp
mov r12, rax
mov ebx, r8d
mov r13, r9
mov edi, r11d
mov r8, qword [rsp + 0x48]
xor ecx, ecx
movsxd rdx, ebp
movzx eax, byte [rdx + r8]
mov byte [rsp + rcx + 0x70], al
add rdx, 1
add rcx, 1
cmp rcx, 0x10
jl 0x143f7
mov r8d, dword [r12 + r13 + 0xc]
mov rcx, r15
mov rdx, r14
mov r9, rsi
call fcn.00018e98
mov r8, qword [rsp + 0x50]
movdqa xmm0, xmmword [r14]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [r14], xmm0
xor ecx, ecx
movsxd rdx, ebp
movzx eax, byte [rsp + rcx + 0x80]
mov byte [rdx + r8], al
add rdx, 1
add rcx, 1
cmp rcx, 0x10
jl 0x1443b
movdqa xmm0, xmmword [r15]
movdqa xmmword [rsp + 0x60], xmm0
add ebp, 0x10
add edi, 1
cmp edi, ebx
jb 0x143ed
jmp 0x14523
cmp rcx, rdx
je 0x14386
cmp ebp, 0x10
jl 0x1453c
mov qword [rsp + 0x20], rbx
mov r10d, ebp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r12
mov r12, rax
mov qword [rsp + 0x40], r13
xor r14d, r14d
lea r11, [r9 + rax + 0x110]
mov qword [rsp + 0x50], r11
sar r10d, 3
shr r10d, 0x1c
add r10d, ebp
sar r10d, 4
xor ebp, ebp
mov dword [rsp + 0x48], r10d
mov edi, ebp
mov rbp, rdx
mov rbx, rcx
mov rsi, r8
mov r13, r9
mov r9, qword [rsp + 0x50]
mov r8d, dword [r12 + r13 + 0xc]
mov rcx, rbx
mov rdx, rbp
call fcn.00018e98
mov r11d, dword [rsp + 0x48]
movsxd r10, edi
movdqu xmm0, xmmword [r10 + r15]
pxor xmm0, xmmword [rsp + 0x60]
movdqu xmmword [r10 + r15], xmm0
add rbx, 0x10
movdqu xmm1, xmmword [rsi + r10]
movdqa xmmword [rsp + 0x60], xmm1
add rbp, 0x10
add edi, 0x10
add r14d, 1
cmp r14d, r11d
jb 0x144d4
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x90
pop rbp
pop r14
pop r15
ret
mov eax, 0xfffffff8
add rsp, 0x90
pop rbp
pop r14
pop r15
ret