joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b0f20
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg rbx, r8
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
mov rdi, rdx
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
mov byte [rax + rcx], 0xa
add byte [rax + rcx], 0x12
add byte [rax + rcx], 0x4d
sub byte [rax + rcx], 0x19
xor byte [rax + rcx], 0x18
xor byte [rax + rcx], 0xc8
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b0fb6
cmp r8d, 0x38
jae 0x1401b1020
mov ecx, r8d
mov eax, 0x1e596093
sub eax, 0x725d23b
xor eax, 0x34c9a907
xor eax, 0x1968c10f
add eax, 0x3f68daca
xor eax, 0x4d930e1b
xor eax, 0x77482970
xor eax, 0x4320e649
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fe116
jmp 0x1401b1020
cmp r8d, 0x40
jae 0x1401b0ff1
mov ecx, r8d
mov eax, 0x234f4960
xor eax, 0x26c1cd38
xor eax, 0xcb15d28
add eax, 0x4ad3ce33
sub eax, 0x416ce142
sub eax, 0x12a6c621
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fe116
xchg rdx, r10
mov r10, rbx
xchg rdx, r10
xchg r15, rbx
mov rcx, r15
xchg r15, rbx
call fcn.1401b13a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
xchg r13, rax
mov qword [rbx + 0x30], r13
xchg r13, rax
mov edx, dword [rbx + 0x40]
xchg r11, rbx
mov rcx, r11
xchg r11, rbx
shl edx, 2
shl edx, 1
add rdx, qword [rbx + 0x48]
xchg r14, rax
mov r14, rdx
xchg r14, rax
mov qword [rbx + 0x48], rdx
shr rax, 7
shr rax, 1
mov byte [rbx + 0x3e], al
xchg r15, rax
mov r15, rdx
xchg r15, rax
shr rax, 0xe
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3d], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
shr rax, 0x12
shr rax, 3
shr rax, 2
shr rax, 1
mov byte [rbx + 0x3c], al
mov rax, rdx
shr rax, 4
shr rax, 0x11
shr rax, 1
shr rax, 3
shr rax, 1
shr rax, 5
shr rax, 1
mov byte [rbx + 0x3b], al
xchg rdx, rcx
mov rax, rcx
xchg rcx, rdx
shr rax, 0xc
shr rax, 0x18
shr rax, 4
mov byte [rbx + 0x3a], al
xchg rdx, r15
mov rax, r15
xchg rdx, r15
mov byte [rbx + 0x3f], dl
shr rdx, 0x22
shr rdx, 5
shr rdx, 8
shr rdx, 4
shr rdx, 4
shr rdx, 1
mov byte [rbx + 0x38], dl
xchg rbx, r8
mov rdx, r8
xchg r8, rbx
shr rax, 0x11
shr rax, 0x18
shr rax, 4
shr rax, 2
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.1401b13a0
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x265b4b7b
add ecx, 0xa3601b2
sub ecx, 0x2c488d47
add ecx, 0x3e6bc1b9
add ecx, 0xbdfdf76
add ecx, 0x15372910
add ecx, 0x18d2821b
sub ecx, 0x73c69fe5
xor ecx, 0x8d76c43
lea rdi, [rdi + 1]
sub ecx, r8d
add r8d, 8
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b110c
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ba6c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9cc0
xchg r14, rdx
mov r14, qword [rbx + 0x28]
xchg rdx, r14
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9ca5
mov r8, qword [rcx - 8]
nop
add rdx, 0x7b43a6a6
sub rdx, 0x7b43a67f
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9cd6
xchg rdi, r8
mov rcx, rdi
xchg r8, rdi
call fcn.1401fd0ac
xor eax, eax
mov qword [rbx + 0x18], rax
xchg rdi, rax
mov qword [rbx + 0x20], rdi
xchg rdi, rax
xchg rdi, rax
mov qword [rbx + 0x28], rdi
xchg rdi, rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
jmp 0x1401ba6c0
call 0x14090a313
int3
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
xchg rbp, rbx
mov rbp, qword [rcx]
xchg rbx, rbp
mov rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0x616c53bb
add qword [rax], 0x19842e22
xor qword [rax], 0x3928d0f9
sub qword [rax], 0x36a5ac8f
add qword [rax], 0x6301cc12
sub qword [rax], 0x21d31cfa
xor qword [rax], 0x1ca1e21c
sub qword [rax], 0x157cd80c
xor qword [rax], 0x3d43d9a5
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba798
xchg rdi, r12
mov qword [rsp + 0x30], r12
xchg rdi, r12
nop dword [rax + rax]
xchg rdi, r13
mov r13, qword [rbx]
xchg r13, rdi
lea rdx, [rbx + 0x10]
xchg rsi, r12
mov rcx, r12
xchg r12, rsi
call fcn.1401b3760
mov edx, 0x4ca5c1db
sub edx, 0x3f810414
add edx, 0x6c0a6b1
xor edx, 0x3ddd38d4
add edx, 0x1f8ba8d8
sub edx, 0x4dc40534
mov rcx, rbx
call fcn.1401fd0ac
mov rbx, rdi
test rdi, rdi
jne 0x1401ba741
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi]
mov edx, 0xcc7ba1b
add edx, 0x17c15f22
xor edx, 0x76e53e8
xor edx, 0x4b13aae6
sub edx, 0x47b67791
sub edx, 0x18a9908f
sub edx, 0x894d7c3
xchg rbx, r10
mov r10, qword [rsp + 0x38]
xchg rbx, r10
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
jmp fcn.1401fd0ac
Function at 0x1401ba7f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9d53
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9d38
xchg r8, r14
mov r14, qword [rcx - 8]
xchg r14, r8
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9d6a
xchg r8, rcx
mov r8, rcx
xchg rcx, r8
call fcn.1401fd0ac
xor eax, eax
mov qword [rbx + 0x18], rax
xchg rcx, rax
mov qword [rbx + 0x20], rcx
xchg rcx, rax
xchg r10, rax
mov qword [rbx + 0x28], r10
xchg r10, rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp 0x1401ba7f0
call 0x140773292
int3
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, rcx
xchg r8, rax
mov r8, qword [rbx + 8]
xchg r8, rax
mov qword [rax], 0x4da1bf97
sub qword [rax], 0x36d8d98e
sub qword [rax], 0x5580f80
add qword [rax], 0x1844728a
add qword [rax], 0x25d178a5
sub qword [rax], 0x4f86c1b8
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba8bf
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
xchg r13, rdi
mov r13, qword [rbx]
xchg r13, rdi
lea rcx, [rbx + 0x10]
call fcn.1401ba910
mov edx, 0x6787657a
xor edx, 0x5839da34
xor edx, 0x44937d30
add edx, 0x32728fc
sub edx, 0x103d1014
xor edx, 0x6b423474
xor edx, 0x7c049143
xor edx, 0x79517e11
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401fd0ac
xchg rcx, rdi
mov rbx, rcx
xchg rcx, rdi
test rdi, rdi
jne 0x1401ba853
xchg r14, rdi
mov r14, qword [rsp + 0x30]
xchg rdi, r14
mov rcx, qword [rsi]
mov edx, 0x2701c090
xor edx, 0x7790d287
xor edx, 0x36cc944a
sub edx, 0x5f3b5567
add edx, 0x66e48ee9
sub edx, 0x159a03b0
add edx, 0xb18a50
sub edx, 0x591e463f
xchg r12, rbx
mov r12, qword [rsp + 0x38]
xchg r12, rbx
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
jmp fcn.1401fd0ac
Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa
Function at 0x1407eb745
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x14038c969

Function at 0x140d974b5
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret
Function at 0x140002ea0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rbp + 0x190], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi - 1]
lea r8, str.cs2.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
test eax, eax
jle 0x140002fc7
mov r8, qword [rsp + 0x40]
cmp rbx, r8
ja 0x140002f3f
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
mov word [rax + rbx*2], si
jmp 0x140002f93
mov rdx, rbx
sub rdx, r8
mov rdi, qword [rsp + 0x48]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140002f86
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x30]
cmp rdi, 8
cmovae r9, qword [rsp + 0x30]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140002f7b
movzx eax, si
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], si
jmp 0x140002f93
mov r9, rdx
lea rcx, [rsp + 0x30]
call fcn.1400034b0
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, str.cs2.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000304b
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x7c]
sub rdi, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x140003033
add rax, 2
test ecx, ecx
jne 0x140003020
test edx, edx
je 0x140003047
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140002ffd
mov esi, dword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14000309a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003095
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003095
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003944
mov eax, esi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140003690
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400030d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
mov edi, edx
mov ebx, esi
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x20], edi
jne 0x140003154
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140003154
cmp byte [rsp + 0x30], sil
jne 0x140003180
test rbx, rbx
jne 0x140003100
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140003690
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rax, rbx
jmp 0x14000315b

Function at 0x140003bec
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1400040c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000410e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000410e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000410e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000410e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000410e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004110
xor al, al
add rsp, 0x28
ret
Function at 0x1400125a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400125cd
xor al, al
jmp 0x14001272f
mov rax, qword [0x1400326b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400326b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400326c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400326c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400326d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400326d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400326e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400326e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400326f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140012721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140012679
mov r11d, 2
jmp 0x14001269d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140012693
mov r11d, 1
jmp 0x14001269d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140012745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400126e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400126fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14001270a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140012718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140012660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14001272a
Function at 0x140311fe8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdi
test r13b, 0x36
sbb dil, 0x22
movsx edi, r10w
push r12
push r8
push r15
cmc
btr rdi, r12
cmp r10w, di
push r13
bsr di, r15w
shr di, cl
push rax
rcl al, cl
and ah, 0x7f
bt ax, 0xc4
push rdx
xchg di, dx
neg di
bsf rax, rbp
push rbp
push r9
rdtsc
cmovne r9, r9
clc
push r11
bsf r11w, dx
push r14
shrd rdx, r14, 0x20
add r9d, esi
lahf
push r10
btr rax, 0xa8
cmp si, ax
movsxd r9, r10d
push rbx
push rcx
movzx ax, r13b
movzx ebx, cx
or r9b, 0xe6
movabs rax, 0
bswap r10w
shrd ebx, r15d, 0x11
push rax
sbb rdi, 0x3dcc301f
jmp 0x14026209c
add rbx, rax
jmp rbx
mov r11, qword [rsp + 0x90]
bt r9d, 0x18
mov bl, r9b
movsx edi, r11w
bswap r11d
bts edi, r13d
xor r11d, 0x1b0f4c22
movsx di, dil
rcr dh, 0xf2
btc bx, cx
rol r11d, 1
shr rdx, cl
inc r9b
and r10w, 0x7848
xor r11d, 0x33214e16
movsx bx, r8b
cwd
inc r11d
movsx r10, si
movsx r10d, sp
bswap r10w
ror r11d, 2
lea r11, [r11 + rax]
bsr bx, sp
ror bx, 0x81
movabs rdi, 0x100000000
add r11, rdi
clc
and bh, 0x89
mov r9, rsp
and al, 0x72
cqo
sbb ebx, esi
sub rsp, 0x180
btr r10w, 0x2c
rcr dh, cl
bts ax, bp
and rsp, 0xfffffffffffffff0
rdtsc
mov r10, r11
stc
mov bl, r14b
movabs rdx, 0
sub r10, rdx
lea rbx, [0x140262150]
mov eax, dword [r11]
add r11, 4
xor eax, r10d
jmp 0x1402a8b63
push rsi
jmp 0x140218477
inc eax
cmc
bswap eax
rol eax, 1
test si, 0xfa7
cmc
clc
bswap eax
push r10
xor dword [rsp], eax
test rdx, 0x8f813ef
bsr r10d, ebx
sub r10, 0xf122dfe
pop r10
test rax, 0x1b1d7213
cmp bp, 0x6e8f
movsxd rax, eax
cmp rax, rcx
jmp 0x14023e66d
pushfq
clc
jmp 0x1402681c2
Function at 0x140774cfc
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfq
clc
jmp 0x1408335b5
mov r11, qword [rsp + 0x90]
bt r9d, 0x18
mov bl, r9b
movsx edi, r11w
bswap r11d
bts edi, r13d
xor r11d, 0x1b0f4c22
movsx di, dil
rcr dh, 0xf2
btc bx, cx
rol r11d, 1
shr rdx, cl
inc r9b
and r10w, 0x7848
xor r11d, 0x33214e16
movsx bx, r8b
cwd
inc r11d
movsx r10, si
movsx r10d, sp
bswap r10w
ror r11d, 2
lea r11, [r11 + rax]
bsr bx, sp
ror bx, 0x81
movabs rdi, 0x100000000
add r11, rdi
clc
and bh, 0x89
mov r9, rsp
and al, 0x72
cqo
sbb ebx, esi
sub rsp, 0x180
btr r10w, 0x2c
rcr dh, cl
bts ax, bp
and rsp, 0xfffffffffffffff0
rdtsc
mov r10, r11
stc
mov bl, r14b
movabs rdx, 0
sub r10, rdx
lea rbx, [0x14081bf1d]
mov eax, dword [r11]
add r11, 4
xor eax, r10d
jmp 0x14082fa4e
inc eax
cmc
bswap eax
rol eax, 1
test si, 0xfa7
cmc
clc
bswap eax
push r10
xor dword [rsp], eax
test rdx, 0x8f813ef
bsr r10d, ebx
sub r10, 0xf122dfe
pop r10
test rax, 0x1b1d7213
cmp bp, 0x6e8f
movsxd rax, eax
cmp rax, rcx
jmp 0x140855c96
push rsi
jmp 0x140877bb2
add rbx, rax
jmp rbx
push rdi
test r13b, 0x36
sbb dil, 0x22
movsx edi, r10w
push r12
push r8
push r15
cmc
btr rdi, r12
cmp r10w, di
push r13
bsr di, r15w
shr di, cl
push rax
rcl al, cl
and ah, 0x7f
bt ax, 0xc4
push rdx
xchg di, dx
neg di
bsf rax, rbp
push rbp
push r9
rdtsc
cmovne r9, r9
clc
push r11
bsf r11w, dx
push r14
shrd rdx, r14, 0x20
add r9d, esi
lahf
push r10
btr rax, 0xa8
cmp si, ax
movsxd r9, r10d
push rbx
push rcx
movzx ax, r13b
movzx ebx, cx
or r9b, 0xe6
movabs rax, 0
bswap r10w
shrd ebx, r15d, 0x11
push rax
sbb rdi, 0x3dcc301f
jmp 0x14081be69
Function at 0x1406330b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140633237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406330e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406330c7
add dl, dl
jne 0x1406330ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14063314e
xor eax, eax
add dl, dl
jne 0x1406330fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140633205
add dl, dl
jne 0x14063310e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063311b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140633128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140633135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140633142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406330d6
mov eax, 1
add dl, dl
jne 0x14063315e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14063316b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140633153
sub eax, ebx
mov ebx, 1
jne 0x1406331a4
mov ecx, 1
add dl, dl
jne 0x140633186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140633193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14063317b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406330d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406331c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406331cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406331b5
cmp eax, 0x7d00
jae 0x1406331f3
cmp eax, 0x500
jb 0x1406331ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406330d6
cmp eax, 0x7f
ja 0x1406331f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406330d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14063322a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406330d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x408270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov ebx, edx
mov rax, qword [rbp + 0x28]
mov r13d, dword [rax + 0x18]
mov rcx, qword [rbp + 0x28]
call fcn.004085c0
mov esi, eax
test sil, sil
jne 0x408432
test ebx, ebx
je 0x408432
xor rdi, rdi
test r13d, r13d
jle 0x408357
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov dword [rbp + 0x3c], 0
test r13d, r13d
jle 0x408336
cmp ebx, 0xffffffff
je 0x4082e3
call sub.kernel32.dll_GetTickCount
sub eax, r14d
cmp eax, ebx
jb 0x4082e3
xor rsi, rsi
jmp 0x408432
mov rax, qword [rbp + 0x28]
cmp dword [rax], 1
jg 0x408336
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0
jne 0x408324
xor eax, eax
mov ecx, 1
mov rdx, qword [rbp + 0x28]
lock cmpxchg dword [rdx], ecx
test eax, eax
jne 0x408324
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov sil, 1
jmp 0x408432
lea rcx, [rbp + 0x3c]
call fcn.00407f40
sub r13d, 1
test r13d, r13d
jg 0x4082ca
nop
cmp ebx, 0xffffffff
je 0x408357
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jb 0x408352
xor rsi, rsi
jmp 0x408432
sub eax, r14d
sub ebx, eax
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x40828d
mov edx, ecx
add edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x408357
nop
call sub.kernel32.dll_GetTickCount
mov r14d, eax
mov rcx, qword [rbp + 0x28]
call fcn.004084e0
xor rcx, rcx
mov rdx, rax
mov r8d, ebx
mov rax, qword [0x0048a990]
call qword [rax + 0x20]
test eax, eax
sete sil
cmp ebx, 0xffffffff
je 0x4083c1
call sub.kernel32.dll_GetTickCount
mov ecx, eax
sub ecx, r14d
cmp ecx, ebx
jae 0x4083be
sub eax, r14d
sub ebx, eax
jmp 0x4083c1
xor rbx, rbx
test sil, sil
je 0x4083f3
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov eax, ecx
test eax, 1
jne 0x4083f0
mov edx, ecx
sub edx, 2
or edx, 1
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x4083c6
mov dil, 1
nop
jmp 0x408410
mov rax, qword [rbp + 0x28]
mov ecx, dword [rax]
mov edx, ecx
sub edx, 2
mov eax, ecx
mov r8, qword [rbp + 0x28]
lock cmpxchg dword [r8], edx
cmp eax, ecx
jne 0x4083f3
mov dil, 1
test dil, dil
je 0x40837a
nop
test sil, sil
je 0x408432
call sub.kernel32.dll_GetCurrentThreadId
mov rcx, qword [rbp + 0x28]
mov dword [rcx + 8], eax
mov dword [rcx + 4], 1
mov eax, esi
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret