joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002c18
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov dword [rax + 8], ecx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
lea rcx, str..pipedialercontrol_redirect64
and dword [rax - 0x20], 0
mov edi, r8d
mov rsi, rdx
mov dword [rax - 0x28], 3
xor r8d, r8d
mov edx, 0xc0000000
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002cad
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rsi, rsi
je 0x140002ca4
test edi, edi
je 0x140002ca4
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140009902
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
neg dword [rsp + 0x20]
jl 0x1400d82e2
call fcn.1400a8ba2
neg dword [rsp + 0x68]
shr word [rsp + 0x68], 0x41
ja 0x140095b8e
shr r11d, 0x44
push rdi
bswap r11d
nop
jae fcn.1400c9142
movzx r11, r11w
movabs rbx, 0x9dbf291a7fbe69a9
movsx ebx, bx
call fcn.14007c08d
Function at 0x1400115e4
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov rsi, qword [rsp + rsi*8 + 0x50]
seto byte [rsp + 0x98]
jge 0x1400d7cc8

Function at 0x140014bde
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
pop rbp
push rsi
movabs rsi, 0xdc2a031afe151331
mov esi, 0xa4321a90
push rcx
push r9
pushfq
movabs r9, 0x4a269793a5aa149d
mov rcx, rsi
xor r9w, si
xchg qword [rsp + 0x20], rbp
push r10
push r13
movabs r13, 0x103e03429b09539
neg r9b
shl cl, 6
push rsi
seta sil
mov r10, rcx
shl r9d, 0xfb
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x30], rbp

Function at 0x140014c42
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rsi, qword [rsp + 0x10]
mov rsi, qword [rsi]
bswap rdx
mov r9, qword [rsp + 8]
shr dl, 0x35
sub bl, byte [rsp + 0xe]
bswap ebx
lea rsi, [rsi + 0x268357a6]
xor qword [rsp + 8], r14
call fcn.14008408d

Function at 0x140021590
Capabilities:
Acquire debug privileges
Extract resource via kernel32 functions
Set registry value

Disassembly:
seta r13b
xor r11b, 0xb8
cmovns r11d, r13d
jge 0x14006603e

Function at 0x14005baf1
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push r13
mov r13, r9
shr r9b, 0xb2
js 0x14005bb9c
cmp r13w, 0x6d8a
cmovle r9w, r13w
movsx r13w, r9b
add qword [rsp + 0x10], 0xfffffffffff9f2be
mov rbx, r9
lea rbx, [rbx*8 + 0x7f8e5a2d]
lea r13, [r13 + r9*8 - 0x31cee6e4]
test bx, 0xabe
push r9
bswap r9d
call fcn.1400a5314

Function at 0x14005d581
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov rcx, qword [rsp + 0x20]
pushfq
add qword [rsp + 8], 0xfffffffffff89292
shr r8b, 0xed
mov rsi, r8
not sil
lea r8, [rsi + rsi*2 - 0x7d51e9e4]
push rsi
lea rcx, [rcx + 1]
je 0x1400d3d0a
lahf
wait
xchg r10d, eax
mov bl, byte [rcx + 0x1c]
sar byte [rsi - 0x2045ee37], 0x43
mov ebp, 0x64213aa2
shr byte [rsi], 1
fld dword [rcx]
scasq rax, qword [rdi]
and edi, ebp
bnd jmp 0x1b114c65b
mov r8, qword [rsp]
js fcn.14001b470
shr byte [rsp], 0x82
xor r8d, esi
shl si, 0x43
mov qword [rsp + 0x30], rcx
js 0x1400bd3fd

Function at 0x14005ec2e
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov r15, qword [rsp + 0x18]
mov bpl, 0x86
lea rbx, [rbx - 0x7f5c4ae7]
je 0x140049dad
call fcn.1400d3612

Function at 0x140061014
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rbp, qword [rsp + 0x30]
lea r10, [r10*4 + 0x609c3f09]
mov r10b, 0x18
jbe 0x1400c3cbc
shr r10w, 0xbe
add qword [rsp + 8], 0xffffffffbff5bc20
shr r10w, 0x82
add r10b, 0x24
sub r10b, 8
lea rbp, [rbp + 1]
add r10, 0xffffffffc086ad87
test r10w, 0x4a9e
push r14
call fcn.14006aa33
Function at 0x14007402b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
xchg qword [rsp + r13 + 0x505d0c83], rcx
mov r11, qword [rsp + r13 + 0x505d0c63]
call fcn.14008e50c
jno 0x140074184
mov r8, qword [rsp + 8]
mov qword [rsp + 8], 0x6fb2f8d6
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1400e2912

Function at 0x140074046
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r10d, r9d
cmp ebx, 0x9b1dbb16
jo 0x14008e57a
call fcn.14001eb57
int3
shl bx, 0xc8
mov rax, qword [rsp + rbx - 0x798509c0]
mov rax, qword [rax + rbx - 0x79850a00]
and bl, 0x1b
movabs rbp, 0x198e5036c3a77898
jb 0x14007f41c
mov qword [rsp + rbx - 0x798509c0], rbx
mov r11, rbx
or r11, 0xffffffffc886999b
lea rax, [rax + r9 - 0x7fbe4b47]
shl word [rsp + rbx - 0x798509c0], 0x8b
movzx r9, bx
add qword [rsp + rbx - 0x798509d0], 0xfffffffffffb426c
xchg qword [rsp + r11*8 + 0x33c32370], rax
mov r9, qword [rsp + r11*8 + 0x33c32348]
push qword [rsp + 0x28]
popfq
mov r10, qword [rsp + 0x18]
mov rbp, qword [rsp + rbx - 0x798509f8]
mov r11, qword [rsp + r11 + 0x6786465]
lea rsp, [rsp + rbx - 0x798509d0]
ret
pushfq
movabs rbx, 0x532bd332c71d26be
sub bx, bx
push r9
or bl, 8
or rbx, 0xfffffffffd18a18d
push r10
mov qword [rsp + 0x30], rax
or rbx, 0x3388de16
mov r9, rbx
xor rbx, 0xffffffff8618f595
mov r10, r9
not r9d
ja 0x14000762d
sub eax, 0xdcd92ab2
clc
sar word [rcx - 0x7e], 0x87
mov bl, 0x4d
invalid
cmp byte [rsp + 0x50], 0x14
call fcn.1400d2a72
add qword [rsp + 0x28], 0xfffffffffffcbf14
push rdi
and r10, rbx
push rbp
push r11
jns 0x1400560c1

Function at 0x14007645a
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
call fcn.1400c278c
jae 0x1400b0c8c
int3
call fcn.14008a980
push rax
call fcn.1400c700c
jbe 0x1400024c4
mov qword [rsp + 0x38], rcx
je 0x14000d12b
xchg qword [rsp + 0x58], rax
mov r15, qword [rsp + 0x18]
sub r9w, word [rsp + 0x39]
call fcn.140015580
add ecx, 0xbd156698
xor r15b, byte [rsp + 0x38]
bswap rdi
or qword [rsp + 0x38], rdi
bswap edi
mov r11, qword [rsp + 0x28]
call fcn.1400d518b
ja 0x14005525f
cmp word [rsp + 0x38], 0xa30e
call fcn.1400962d7
call fcn.14006d4b0

Function at 0x140078db5
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
and word [rsp + 0x18], 0xbb9f
xor qword [rsp + 0x40], rbp
call fcn.14005dd76
xor dil, 0xab
cmp dil, 0x9d
add qword [rsp + 0x10], 0x16f79
movabs rdx, 0xa401a63f8c2ba487
push r12
add edx, 0x7407c40b
call fcn.1400092bd
mov rbx, qword [rbx]
push r13
pushfq
movabs r13, 0x5adb4bd4b8dea34
neg r13b
lea rbx, [rbx - 0x1d71f1e5]
call fcn.140058620
invalid
jle 0x1400dbb23
and r8w, r8w
je 0x1400cd4f2
shl ebx, 0xb0
mov bl, 0x32
cmp bx, word [rsp + 0x44]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rsp]
mov rcx, qword [rcx]
jge 0x1400bf7d6
jl 0x140053d27
test eax, 0xf56b07e2
add bl, dl
test eax, 0x494eb0ac
int1
sal byte [rdi - 0x75ad924d], cl
mov esp, ebp
movabs al, byte [0xe22dd3a7e271e97e]
fidivr dword [rcx + 0x1c]
sub dh, dl
loope 0x1400dbba4
adc al, byte [rdx]
mov byte [rbx + 0x5f01e00d], bh
add dword [rdi - 0x5a], edi
invalid
mov eax, dword [rsp + 0x54]
lea ecx, [rdx + 2]
invalid
Function at 0x14007a7ac
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
lea rdx, [rdx*4 - 0x11673376]
add qword [rsp], 0xcc85
and ebx, 0xe2311c80
add dl, 0x1e
sub rdx, rbx
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x18], rcx
mov ebx, 0x860161a0
jge 0x1400cd84e
add rbx, 0xffffffffb91faa83
shr rbx, 0xe9
je 0x14005f31e
jmp 0x143470246

Function at 0x14008d0fe
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push rax
call fcn.140087864
movabs r13, 0x18870fbc78ae46bd
ja 0x14009b4ab
mov r14, qword [rsp + 0x18]
sub r13d, dword [rsp + 0x4c]
add dword [rsp + r13 - 0x7b6fcd61], r13d
movsxd r13, r13d
or dword [rsp + r13 - 0x7b6fcd61], 0xc8923ea3
cmp word [rsp + r13 - 0x7b6fcd69], 0x4c8b
movsx r13d, r13w
mov r13, qword [rsp + 0x58]
jbe 0x140029302
test byte [rsp + 0x40], 0x9c

Function at 0x14008df53
Capabilities:
Packed with generic packer

Disassembly:
shl rsi, 0x48
mov rdx, rsi
test si, dx
push r15
lea rdx, [rsi*8 + 0x36214d22]
call fcn.1400c46b8

Function at 0x14008dfa4
Capabilities:
Packed with generic packer

Disassembly:
movabs rbx, 0x7438d43de03169bc
nop
movabs rsi, 0x5b8293a9b212cda7
mov r13, rsi
sub bl, 3
call fcn.1400826e6
cmovns bx, word [rsp + 0x10]
sete byte [rsp + r9 - 0x736c04a4]
mov rdx, qword [rsp + 0x48]
mov byte [rsp + 0x10], r8b
add qword [rsp], 0x726e5
lea r8, [rbx*8 + 0x20348d3d]
movzx ebx, word [rsp + 0x14]
mov rcx, qword [rsp + 0x38]
call fcn.1400ddc3b
movabs rbx, 0x5eaab53ae18c053d
xor bl, 0x81
shl r14b, 0xac
xor r9d, ebx
mov bx, r9w
neg r14
lea rdi, [rdi + r9 - 0x6f77c632]
shr r14b, 0xcc
shr r9w, 0xc5
cmovns r14, r9
neg r9w
mov qword [rsp + 0x18], rbx
push rcx
call fcn.1400aa4a1
add qword [rsp + 8], 0x21b63
shl r13b, 0xaf
mov r15, r13
mov qword [rsp + 0x20], r13
lea rcx, [rcx + 0x1da01401]
js 0x14006d2ba
shr r15w, 0x24
jbe 0x1400d7cb1
neg word [rsp + 0x20]
and r13, r15
bswap r15d
test byte [rsp + r15 - 0x300d6d4b], r13b
xchg qword [rsp + r15*2 - 0x601ada96], rcx
mov r13, qword [rsp + r15*2 - 0x601adac6]
call fcn.140015d0d
and qword [rsp + 0x40], 0x6dbc8e0b
add qword [rsp + 0x20], 0xffffffffbff2fb93
call fcn.140081a95
jl 0x14005f2a2
call fcn.14004ad3a

Function at 0x14008e540
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
call fcn.1400c3def
call fcn.1400cbf8c

Function at 0x14008e54a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r15, qword [rsp + r15*8 + 0x60]
call fcn.140021150
mov rsi, qword [rsp + r15 + 0x30]
add qword [rsp + r15 + 0x38], 0xffffffffbfff833a
and r15d, r15d
add qword [rsp + r15*2], 0xffffffffbff72f63
add r15, r15
jae 0x1400080d6
jno 0x14006aa07

Function at 0x14008e550
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
add word [rsp + 0x28], 0x48ab
xchg qword [rsp + 0x60], rax
mov r11, qword [rsp + 0x48]
xor qword [rsp + 0x28], 0x24362e24
je 0x140012610
shl dword [rsp + 8], 0x47
call fcn.140061cba

Function at 0x140092aba
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
movabs rdx, 0xb484a9acea30b407
sub bx, dx
cmp bl, dl
push r10
push 0x34270e11
Function at 0x140096c8e
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov rdi, qword [rsp + 0x38]
call fcn.1400a64dc
sub dword [rcx], edx
setne byte [rbx - 0x38a04986]
mov dword [rsp + 0x38], 0xb2bfe1a9
mov rdi, qword [rsp + 0x40]

Function at 0x140096cdf
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
jl 0x1400658c2
call fcn.1400913a5
xor ecx, ecx
call fcn.1400c48af
setae byte [rsp + 0x68]
xor dword [rsp + 0x68], 0x159af18f
ja 0x140051b1a
jle 0x1400929a8
xchg qword [rsp + r9 - 0x736c03f3], rsi
mov r14, qword [rsp + 0x50]
not r9b
xor r8b, byte [rsp + 0x17]
or r9b, byte [rsp + r9 - 0x736c049e]
and rdx, 0x59cbd14
add r8b, dl
jns 0x14005f2c2

Function at 0x140098e08
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
bswap rsi
jge 0x1400a995e

Function at 0x1400a0176
Capabilities:
Create thread

Disassembly:
adc eax, 0x243251
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
jge 0x14000263e
call fcn.1400a6cb1

Function at 0x1400a4c3a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jb 0x1400d82cc
movabs r12, 0x14330db683bdca10
push r14
mov qword [rsp + 0x20], rbx
movabs r14, 0x6288bcbdf41cc58a
call fcn.1400c8422

Function at 0x1400a54e3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
or r14d, 0xe41c62b7
bswap r9
call fcn.1400c1448

Function at 0x1400a7503
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x30], rdi
shl r11d, 0xeb
push r9
movabs r9, 0x818b0a24cf3e9fbb
push r13
ja 0x1400c10bc
neg r9b
add qword [rsp + 0x30], 0xfffffffffffce7db

Function at 0x1400a9fd3
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
lea rbx, [rbx + 1]
push r15
call fcn.140054294

Function at 0x1400b34c2
Capabilities:
Enumerate process modules

Disassembly:
adc eax, 0x243031
xor edi, edi
lea r8, [rbp + 0x380]
mov rcx, rax
mov dword [rbp + 0x380], edi
mov edx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140002c00
mov ecx, dword [rbp + 0x380]
shr ecx, 2
mov dword [rbp + 0x380], ecx
test ecx, ecx
je 0x140002c00
mov eax, edi
mov r9d, 1
mov ecx, dword [rbx + rax*4]
call fcn.1400010c0
inc edi
cmp edi, dword [rbp + 0x380]
jb 0x14000289f
jmp 0x140002c00
mov rbx, qword [rsp + 0x488]
add rsp, 0x450
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
neg sil
or sil, 0xaa
mov qword [rsp + 0x38], rsi
shr si, 0xa5
lea rdi, [rdi + 0x7995d49b]
shr r10, 0xf1
je 0x14008d210
call fcn.1400aa003
sahf
movabs al, byte [0x3002320600020601]
je 0x1400d12f4
mov r10w, dx
jne 0x14004d93b
je 0x1400be49e
mov rcx, qword [rsp + r10*8 - 0x3edc0ad8]
mov rcx, qword [rcx + r10*4 - 0x1f6e0578]
sub r10w, r11w
add r11d, r10d
xor dword [rsp + 0x40], 0x2a0321b2
add byte [rsp + 0x40], 0xb4
jno 0x140083ca5
jno 0x14000285e
call fcn.1400622b3
add eax, 0x30a1b44d
mov es, word [rdx]
adc edi, edi
je 0x1400b352c
xor byte [rbp + 0x24648d48], bl
ret
add byte [rbp + 5], al
add byte [rax], al
js 0x140090790
Function at 0x1400b38f6
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
cmp word [rsp + 0x10], 0xa283
jb 0x1400b4857
neg qword [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
call fcn.14005604f

Function at 0x1400b392b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub byte [rsp + 0x40], 0x80
or byte [rsp + 0x40], 0x22
jg 0x14005ec95
shr qword [rsp + 0x40], 0xef
xor qword [rsp + 0x40], 0xffffffff9310bb05
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x48]

Function at 0x1400c9bff
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
test dword [rsp + 0x28], 0x6201b89
jns 0x1400d3402
test bpl, bpl
je 0x14009a886
lea rdx, [rdx - 0x45b86c3]
jbe 0x140049dac
test ebp, 0x6e2a2e05
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x20], 0x921d5713
jo 0x14004c29c
neg qword [rsp + 0x20]
test bpl, 0x3d
xchg qword [rsp + 0x28], rdx
mov rbp, qword [rsp + 0x18]
not byte [rsp + 0x20]
jle 0x14000aec8
cmp word [rsp + 0x20], 0x2328
not byte [rsp + 0x20]
jbe 0x1400b7009
add word [rsp + 0x20], 0xef1c
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x28]
ret

Function at 0x1400d1339
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
not r15b
neg qword [rsp + 0x38]
not r15w
add ebp, 0x310c4392
xchg qword [rsp + 0x60], rdx
mov rdi, qword [rsp + 0x48]
jno 0x1400d739f

Function at 0x1400d1af0
Capabilities:
Encode data using xor

Disassembly:
xor ebx, dword [rsp + rbx*4 + 0x45]
setno byte [rsp + 0x28]
mov word [rsp + 0x40], 0xfe95
mov rbx, qword [rsp + 0x48]
shl dword [rsp + 0x40], 0xc
mov dword [rsp + 0x40], 0xdc9536aa
shl dword [rsp + 0x28], 0xdb
jno 0x14001c984
test qword [rsp + 0x40], 0x20e82b9
jge 0x14008841a

Function at 0x1400d63ea
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
add word [rsp + rdx - 0x3fffc43a], 0x85a8
xor bpl, 0x3d
or dx, word [rsp + rbp - 0x64e4c4b7]
shl dword [rsp + rbp - 0x64e4c4ef], 0xfa
jb 0x1400b3930
shl word [rsp + rdx*2 - 0x7fffebcc], 0x10
call fcn.14000b03e

Function at 0x1400d7c91
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
mov qword [rsp + r13 + 0x505d0c83], 0xffffffff9c8940b3
jl 0x1400cd3e0
mov r13, qword [rsp + r13 + 0x505d0c63]
shr qword [rsp + 0x40], 0xd5

Function at 0x1400daf44
Capabilities:
Encode data using xor

Disassembly:
push rax
call fcn.1400c95d6
add qword [rsp], 0xfffffffffffd289e
neg r12
or r12b, r12b
mov rdi, r12
lea r12, [r12 + rdi - 0x52caa2db]
setbe dil
not dil
mov rdi, qword [rsp]
mov rdi, qword [rdi]
shl r12b, 0x22
not r12b
or r12d, r12d
mov qword [rsp], r12
lea rdi, [rdi + 0xe1be6a7]
not r12d
or r12w, word [rsp + r12 - 0x6330a64c]
cmp byte [rsp + r12 - 0x6330ffff], 0xb6
movzx r12w, byte [rsp + r12 - 0x6330fffe]
jo 0x140076454
sub r12w, word [rsp + r12 - 0x63300053]
xchg qword [rsp + r12 - 0x63300039], rdi
mov r12, qword [rsp + r12 - 0x63300041]
call fcn.1400bb6e7
jl 0x1400bb807
Function at 0x1400dba5f
Capabilities:
Create thread

Disassembly:
mov rbp, qword [rsp + 0x10]
movzx rbp, word [rsp + rbp - 0x409704f1]
shl byte [rsp + rbp*4 - 0x13f4], 0xb
or bp, 0xf608
add ebp, 0x491f870e
mov rbp, qword [rsp + rbp - 0x49207dff]
mov rbp, qword [rbp + riz]
neg qword [rsp + 0x10]
jg 0x1400cdfe7
cmp qword [rsp + 0x10], 0xffffffffab0c1998
jae 0x1400cd85c

Function at 0x140237cb5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
rol r11d, 6
xor edi, edi
mov bl, r9b
movzx ebx, r8b
mov r9b, r10b
mov r11, rcx
xchg r9b, r9b
inc r9w
mov r8, rdi
nop
movzx r10, di
cmove r9w, si
movzx r9d, byte [r11]
movzx r10, di
inc r10b
movzx r10d, ax
movzx r10d, byte [rdx]
jmp 0x140237cfe
inc r11
jmp 0x140237d06
inc rdx
test r12b, cl
test r12b, 0x97
test bl, bl
jmp 0x140237d17
je 0x140237d3c
mov ecx, r8d
movzx ax, dh
mov eax, 0x662d11a9
rol eax, cl
cmp ebp, r13d
jmp 0x140237d33
add al, r8b
xor r9b, al
inc r8
test r9b, r9b
jmp 0x140237d44
je 0x140237d53
cmp r9b, r10b
je 0x140237ce6
cmp r9b, r10b
jmp 0x140237d5b
jae 0x140237d77
or eax, 0xffffffff
mov rbx, qword [rsp + 8]
movzx edi, bx
mov rdi, qword [rsp + 0x10]
jmp 0x140237d76
ret
mov rbx, qword [rsp + 8]
lahf
movzx ax, r11b
seta dil
movzx ax, r14b
mov eax, edi
movzx edi, si
mov rdi, qword [rsp + 0x10]
jmp 0x140237d9a
ret
Function at 0x1405ca058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405ca1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405ca089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ca06f
add dl, dl
jne 0x1405ca096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ca0f6
xor eax, eax
add dl, dl
jne 0x1405ca0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405ca1ad
add dl, dl
jne 0x1405ca0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ca0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ca0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ca0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405ca0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405ca07e
mov eax, 1
add dl, dl
jne 0x1405ca106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405ca113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ca0fb
sub eax, ebx
mov ebx, 1
jne 0x1405ca14c
mov ecx, 1
add dl, dl
jne 0x1405ca12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405ca13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ca123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ca07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405ca168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405ca175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405ca15d
cmp eax, 0x7d00
jae 0x1405ca19b
cmp eax, 0x500
jb 0x1405ca196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ca07e
cmp eax, 0x7f
ja 0x1405ca19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405ca07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405ca1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405ca07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001487
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14005b290]
mov dword [rax], 1
mov rax, qword [0x14005b2a0]
mov dword [rax], 1
mov rax, qword [0x14005b2b0]
mov dword [rax], 1
mov rax, qword [0x14005b230]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d8
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001504
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000152a
cmp eax, 0x20b
je 0x140001551
jmp 0x140001580
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000153d
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000156c
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140038760
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with crc32

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x140064448], 0
mov r12, rcx
mov r13, rdx
mov rdi, r8
je 0x1400387e8
lea rdx, [0x14005991a]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400388f0
mov rsi, qword [0x140064440]
jmp 0x1400387a5
lea rsi, [rdx + rax + 4]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rsi
mov ebx, eax
call sub.msvcrt.dll_strlen
lea rdx, [rsi + rax + 1]
mov eax, dword [rdx]
test ebx, ebx
jne 0x1400387a0
movzx r9d, word [rdx + 4]
lea r8, [rdx + 6]
mov rcx, r12
mov rdx, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.140036cf0
mov r8d, 0xa
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
mov r9d, dword [rax]
mov eax, dword [rax + 4]
lea rcx, [rdx + 8]
mov qword [0x140064440], rcx
test eax, eax
je 0x1400388d8
sub eax, 1
lea r8, [rdx + rax + 9]
mov eax, 0xffffffff
nop dword [rax + rax]
movzx edx, byte [rcx]
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
shr eax, 1
and edx, 1
add rcx, 1
neg edx
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
cmp r8, rcx
jne 0x140038840
not eax
cmp r9d, eax
jne 0x140038958
mov byte [0x140064448], 1
jmp 0x14003877d
cmp byte [0x140064438], 0
jne 0x140038794
mov rbx, qword [sym.imp.python311.dll_PyDict_New]
call rbx
mov qword [0x140064490], rax
call rbx
mov qword [0x140064488], rax
call rbx
mov qword [0x140064480], rax
call rbx
mov qword [0x1400644c0], rax
call rbx
mov qword [0x1400644b8], rax
call rbx
mov qword [0x1400644b0], rax
call rbx
mov qword [0x1400644a0], rax
call rbx
mov byte [0x140064438], 1
mov qword [0x140064498], rax
jmp 0x140038794
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x14003f3e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.1400508f0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.1400508f0
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop