joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0040aa90]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x0040aaa0]
mov dword [rax], 1
mov rax, qword [0x0040aab0]
mov dword [rax], 1
mov rax, qword [0x0040aa80]
mov dword [rax], 1
mov rax, qword [0x0040a960]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x0040aa70]
mov dword [0x0040d008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x0040aa30]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x0040a910]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401550
Capabilities:
Execute command

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
call sym.__main
mov dword [rbp + 0xbc], 0x14
mov qword [rbp + 0xb0], 0xffffffffffffffff
mov dword [rbp + 0xac], 0
lea rax, [rbp + 0xac]
mov rcx, rax
mov rax, qword [sym.imp.LibFT260.dll_FT260_CreateDeviceList]
call rax
mov eax, dword [rbp + 0xac]
mov edx, eax
lea rcx, str.Number_of_devices_:__d_n_n
call sym.printf_char_const__::_
movzx eax, word [0x00409012]
movzx edx, ax
movzx eax, word [0x00409010]
movzx eax, ax
lea rcx, [rbp + 0xb0]
mov r9, rcx
mov r8d, 0
mov ecx, eax
mov rax, qword [sym.imp.LibFT260.dll_FT260_OpenByVidPid]
call rax
mov dword [rbp + 0xbc], eax
cmp dword [rbp + 0xbc], 0
je 0x401607
mov eax, dword [rbp + 0xbc]
mov ecx, eax
call sym.FT260StatusToString_FT260_STATUS_
mov rdx, rax
lea rcx, str.Open_device_by_vid_pid_NG__status:__s_n
call sym.printf_char_const__::_
jmp 0x401626
lea rcx, str.Open_device_by_vid_pid_OK_n
call sym.printf_char_const__::_
mov rax, qword [rbp + 0xb0]
mov rcx, rax
mov rax, qword [sym.imp.LibFT260.dll_FT260_Close]
call rax
lea rcx, [0x0040a062]
call sym.printf_char_const__::_
lea rcx, str.PAUSE
call sym.system
mov eax, 0
add rsp, 0x140
pop rbp
ret
Function at 0x4023d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0040d884]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x402558
mov rax, qword [0x0040d888]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40241c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x4024a5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x402400
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x40258d
mov rax, qword [0x0040d888]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0040d888]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x402570
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x40249e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x402500
add dword [0x0040d884], 1
cmp edi, 8
jae 0x4024d3
test dil, 4
jne 0x402544
test edi, edi
je 0x4024c8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40255f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x4024c8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x4024ec
jmp 0x4024c8
add rsi, qword [0x0040d888]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40249e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x4024c8
xor esi, esi
jmp 0x402427
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x4024c8
mov rax, qword [0x0040d888]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x402ce0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0040db60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0040db40]
test rbx, rbx
je 0x402d34
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402d2b
test rsi, rsi
je 0x402d2b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402d10
lea rcx, [0x0040db60]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x402f70
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402f80
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402f90
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402fd1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402fc8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402fd3
add rax, 0x28
cmp rax, r9
jne 0x402fb4
xor eax, eax
ret

Function at 0x403070
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0040a960]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x4030dd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4030dd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4030dd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4030d4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4030df
add rax, 0x28
cmp rax, r9
jne 0x4030c0
xor eax, eax
add rsp, 0x28
ret

Function at 0x4031e0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x0040a960]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x403200
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4031f8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40325d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403254
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x403264
add rax, 0x28
cmp rax, r9
jne 0x403240
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x403280
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x0040a960]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x4032ee
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4032ee
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x4032ee
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x4032ee
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x4032e5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x4032f5
add rcx, 0x28
cmp rcx, rax
jne 0x4032d0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x403308
jmp 0x4032ee
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x403316
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x4032ee
test r9d, r9d
jg 0x403300
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x408250
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
test al, 0x17
out dx, eax
mov edx, 0x38277942
or byte [rdx + 0x5d04767d], 0x42
mov esp, 0x9d440cae
hlt
Function at 0x1400045e0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
call fcn.140007880
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x50]
call fcn.1400078e0
movzx eax, al
test eax, eax
je 0x140004624
lea rcx, [rsp + 0xd8]
call fcn.140007890
jmp 0x140004886
mov rcx, qword [rsp + 0xd0]
call fcn.140006820
test rax, rax
je 0x140004690
mov rcx, qword [rsp + 0xd0]
call fcn.140006820
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0xd0]
call fcn.140006770
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
jae 0x140004690
lea rcx, [rsp + 0xd8]
call fcn.140004890
mov byte [rsp + 0x42], al
mov rcx, qword [rsp + 0xd0]
call fcn.1400065d0
movzx ecx, byte [rsp + 0x42]
mov byte [rax], cl
mov eax, dword [rsp + 0xd8]
jmp 0x140004886
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x80], 0
jne 0x1400046ac
call fcn.140007880
jmp 0x140004886
mov rcx, qword [rsp + 0xd0]
call fcn.140006180
mov rax, qword [rsp + 0xd0]
cmp qword [rax + 0x68], 0
jne 0x140004722
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0xd8]
call fcn.140004890
mov byte [rsp + 0x43], al
mov rdx, qword [rsp + 0x68]
movzx ecx, byte [rsp + 0x43]
call fcn.1400030f0
movzx eax, al
test eax, eax
je 0x140004710
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x48], eax
jmp 0x140004719
call fcn.140007880
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
jmp 0x140004886
mov qword [rsp + 0x88], 0x20
lea rcx, [rsp + 0xd8]
call fcn.140004890
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xb0]
lea rcx, [rsp + 0x41]
mov rdx, qword [rsp + 0xd0]
add rdx, 0x74
lea r8, [rsp + 0x78]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, rcx
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
call fcn.140005fc0
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400047c6
cmp dword [rsp + 0x44], 1
je 0x1400047c6
cmp dword [rsp + 0x44], 3
je 0x140004845
jmp 0x140004881
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x14000481a
mov rax, qword [rsp + 0xd0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x58]
mov edx, 1
lea rcx, [rsp + 0x90]
call fcn.140013bb4
cmp qword [rsp + 0x58], rax
je 0x14000481a
call fcn.140007880
jmp 0x140004886
mov rax, qword [rsp + 0xd0]
mov byte [rax + 0x71], 1
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x80], rax
je 0x14000483e
mov eax, dword [rsp + 0xd8]
jmp 0x140004886
call fcn.140007880
jmp 0x140004886
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 0x80]
movzx ecx, byte [rsp + 0x40]
call fcn.1400030f0
movzx eax, al
test eax, eax
je 0x140004872
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x4c], eax
jmp 0x14000487b
call fcn.140007880
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
jmp 0x140004886
call fcn.140007880
add rsp, 0xc8
ret
Function at 0x140006230
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14000625b
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140006262
mov al, 1
jmp 0x1400063ba
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140007880
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140007880
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.1400078e0
movzx eax, al
test eax, eax
je 0x1400062b9
xor al, al
jmp 0x1400063ba
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.140007b20
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140006328
cmp dword [rsp + 0x30], 1
je 0x140006334
cmp dword [rsp + 0x30], 3
je 0x1400063a8
jmp 0x1400063b8
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14000637f
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call fcn.140013bb4
cmp qword [rsp + 0x48], rax
je 0x14000637f
xor al, al
jmp 0x1400063ba
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140006399
mov dword [rsp + 0x34], 1
jmp 0x1400063a1
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400063ba
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400063ba
xor al, al
add rsp, 0xa8
ret

Function at 0x1400196d0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400194fc
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403a6599

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403a8046

Function at 0x1400eb605
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov rdx, rcx
mov ch, al
cmovne rcx, r10
lea rcx, [0x1400ba2a8]
jmp fcn.1404ad938

Function at 0x1400f53f4
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
jmp 0x1401b109a
jmp 0x14043efb0
push rsi
neg eax
btc ax, si
movzx ax, r12b
push rdi
movzx rsi, r11w
shl ax, cl
sub rsp, 0x28
jmp 0x14043efce
mov rsi, rcx
neg ah
shl al, cl
mov rcx, qword [rcx + 0x18]
btr rax, r14
sal ax, 0xbd
sbb ah, 0xe8
mov rax, qword [rcx]
test edx, eax
xor edx, edx
test r14, 0x332c1938
cmp bpl, r15b
sub r8d, r8d
jmp 0x14043effd
call qword [rax + 0x188]
mov edi, eax
movsx cx, al
lea rcx, [rsi + 0x30]
call fcn.140452b9a
test edi, edi
je 0x14043f050
cmp edi, 0x8899000c
jmp 0x14043f025
jne 0x14043f06d
mov rcx, rsi
sub di, r8w
add rsp, 0x28
not edi
mov sil, 0xd0
movsx esi, r15w
pop rdi
cmovbe si, r11w
pop rsi
jmp 0x14043f04b
jmp fcn.14043ecab
nop
add rsp, 0x28
bswap si
pop rdi
mov esi, 0x1db472f6
setp sil
movsx rsi, r10w
pop rsi
jmp 0x14043f06c
ret
mov ecx, edi
sbb sil, bpl
sar r8b, cl
movabs r8, 0xad4a5352d2edebd0
bswap edi
mov dl, 3
movsx r9, si
rcr di, cl
mov r9d, 0x54
setae sil
rcr dil, cl
add rsp, 0x28
pop rdi
movsx esi, r15w
bswap si
pop rsi
jmp fcn.1403a8612

Function at 0x140133e6e
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
jmp 0x140243963
jmp fcn.1404a9cfa
sub edx, edx
jmp 0x1401e7f60
Function at 0x14018c160
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
xadd r9d, r11d
xchg r8b, r9b
movzx r8d, word [rax + 0x58]
sub r10, rbp
bsr r11d, r11d
cmp r8, rdx
cmovb r9d, r9d
mov r11b, 0x37
movsxd r9, r10d
cmovae r8, rdx
ror r9w, cl
mov r9, qword [rax + 0x60]
movzx r11w, bl
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
cmp al, 0x12
test r11w, r11w
jmp 0x1402070f1
je 0x1401ad00e
mov word [r10], r11w
dec r11w
movsxd r11, eax
add r10, 2
movsx r11, r11w
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x140278b8b
je 0x1400fca85
cmp rdx, 0x104
movsx r8, si
mov r8d, 0x104
jmp 0x140117632
cmovb r8, rdx
jmp 0x140246f01
cmp r8, rax
jmp 0x140104c26
je 0x14020d892
sub edx, edx
add r9b, r9b
shr r9b, cl
lea r9, [0x1400b8f10]
cmp r12w, r11w
jmp 0x14025560c
jne 0x140142681
sub r8, rax
test r8, r8
jmp 0x1401ad008
movzx eax, word [0x1400b8f10]
cmp bpl, sil
test ax, ax
jmp 0x14010fc80
cmovb r8, rdx
test ax, ax
cmp r14b, 0x23
test ax, ax
jmp 0x1401779a4
test r11w, r11w
jmp 0x14018a444
je 0x1401ad014
mov word [r10], 0
movzx eax, word [0x1400b8f10]
add r8b, cl
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x14018e188
je 0x14018a44d
xor eax, eax
cmc
nop word [rax + rax]
clc
cmp rsi, r14
jmp 0x140142681
inc rdx
test r15b, 0xb2
cmp r14d, r10d
test r14b, r9b
test ax, ax
jne 0x14025560c
sub r8, rdx
stc
test r8, r8
jmp 0x14023ead8
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x14020d878
je 0x140240234
mov word [rcx], 0
jmp 0x140240234
ret
jmp 0x1401779aa
cmp r8, rdx
jmp 0x14028a1ff
inc rax
jmp 0x1401a8d0a
je 0x14023eade
mov word [rcx], ax
shld ax, dx, 0xe6
add rcx, 2
jmp 0x14020e3f3

Function at 0x1401db2cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1404c8dc2
lea rdx, [0x1400c1c90]
movzx rcx, r14w
lea rcx, [0x1400c1b90]
jmp 0x1400e021c
mov qword [rsp + 8], rbx
cmc
mov qword [rsp + 0x10], rsi
clc
push rdi
btr si, 0x4f
sub rsp, 0x20
setp dil
mov rsi, rdx
movzx di, r14b
movsx rdi, di
mov rdi, rcx
cmp r8d, 0x313b6ef5
jmp 0x1404c8df7
cmp rcx, rdx
je 0x1404c8ebe
mov rbx, rcx
test bpl, r9b
add ax, 0x362a
bts eax, edx
mov rax, qword [rbx]
cmc
test rax, rax
jmp 0x1404c8e19
je 0x1404c8e32
call qword [case.0x140441677.0]
test al, al
jmp 0x1404c8e2c
je 0x1404c8e4a
add rbx, 0x10
cmp r9w, 0x28a4
cmp rbx, rsi
jmp 0x1404c8e44
jne 0x1404c8e0d
cmp rbx, rsi
jmp 0x1404c8e52
je 0x1404c8ebe
cmp rbx, rdi
jmp 0x1404c8e60
je 0x1404c8eb2
add rbx, 0xfffffffffffffff8
test dl, spl
cmp ebx, 0x3beb0196
cmp qword [rbx - 8], 0
je 0x1404c8e97
mov rax, qword [rbx]
test rax, rax
jmp 0x1404c8e89
je 0x1404c8e97
sub ecx, ecx
call qword [case.0x140441677.0]
sub rbx, 0x10
lea rax, [rbx + 8]
stc
cmp r14b, 0x94
cmp rax, rdi
jmp 0x1404c8eac
jne 0x1404c8e73
xor al, al
jmp 0x1404c8eb9
jmp 0x1404c8ec0
mov al, 1
mov rbx, qword [rsp + 0x30]
bts rdi, rcx
xor di, 0x259b
movzx esi, bx
mov rsi, qword [rsp + 0x38]
shl dil, cl
setne dil
bt rdi, 0xc4
add rsp, 0x20
movzx rdi, r11w
mov rdi, r10
pop rdi
jmp 0x1404c8ef3
ret
Function at 0x1401dbf4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jne 0x14019390f
movzx eax, byte [rcx - 1]
dec rcx
stc
cmp al, 0x30
jmp 0x140193909
test al, al
jmp 0x1401692e5
je 0x1401b84a4
sub al, 0x45
test si, sp
stc
test al, 0xdf
je 0x1401b84a4
movzx eax, byte [rcx + 1]
jmp 0x1401b8498
je 0x1401fd4b7
movzx edx, al
nop dword [rax + rax]
movzx eax, dl
cmp dl, r9b
je 0x1401fd4b7
movzx eax, byte [rcx + 1]
mov dl, dil
cqo
movzx dx, dh
inc rcx
bsf dx, r12w
bts dx, bx
movzx edx, al
clc
test sp, si
cmc
test al, al
jmp 0x1401fd4b1
jne 0x14019393e
ret
je 0x1400eb2ca
cmp al, r9b
movsxd rax, ebx
movsx rax, r15w
mov rdx, rax
lea rdx, [rcx - 1]
movsx eax, r13w
mov eax, 0xf8c672d
cmovne rdx, rcx
inc ah
sal rax, 0x4f
sbb ax, 0x1491
nop dword [rax]
movzx eax, byte [r8]
clc
lea rdx, [rdx + 1]
test rsi, 0xa1b0fc8
test cl, r8b
stc
mov byte [rdx], al
cmp spl, 0x4b
test r15w, di
lea r8, [r8 + 1]
test bl, r9b
test al, al
jmp 0x14017e96d
inc rcx
stc
test al, al
jne 0x1401156e4
movzx eax, byte [rcx - 1]
setnp r8b
bswap r8w
mov r8, rcx
jmp 0x1401f27d1
mov rax, qword [rdx]
xchg dh, dh
rcl dx, 0xca
xor r9b, 0xf3
mov rdx, qword [rax + 0xf8]
bsr r9w, bx
shrd r9, r15, 0x62
mov rax, qword [rdx]
movzx r9, r12w
movzx r9d, byte [rax]
movzx eax, byte [rcx]
jmp 0x1400ec207
dec rcx
cmp al, 0x30
jmp 0x1400eb2c4
jne 0x1401692f3
inc rcx
test al, al
jmp 0x14027f2f1
je 0x14017e973
movzx eax, byte [rcx]
test al, al
jmp 0x1401156de