joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022a78
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140022aa8
xor eax, eax
jmp 0x140022b6b
mov rbp, rbx
cmp word [rax], si
je 0x140022acd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140022ab4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140022ab0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400229c8
movsxd r14, eax
test eax, eax
jne 0x140022b0b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140022aa1
mov rcx, r14
call fcn.14001f0ec
mov rdi, rax
test rax, rax
jne 0x140022b24
xor ecx, ecx
call fcn.14001e468
jmp 0x140022b00
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400229c8
test eax, eax
jne 0x140022b55
mov rcx, rdi
call fcn.14001e468
jmp 0x140022b5f
xor ecx, ecx
call fcn.14001e468
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14002802c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140021acc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400280b6
cmp byte [rbp - 0x21], r15b
je 0x1400280b1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400280ec
call fcn.14001e6bc
test eax, eax
jne 0x1400280d8
cmp byte [rbp - 0x21], r15b
je 0x1400280d0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400280ec
cmp byte [rbp - 0x21], r15b
je 0x1400280e9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400210a8
test eax, eax
jne 0x14002818c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140021acc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14002812b
cmp byte [rbp - 0x21], r15b
je 0x140028160
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140028160
call fcn.14001e6bc
test eax, eax
jne 0x14002814c
cmp byte [rbp - 0x21], r15b
je 0x140028145
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140028160
cmp byte [rbp - 0x21], r15b
je 0x14002815d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400210a8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14002818c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14002818f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14002819d
mov rcx, rdi
call fcn.14001e468
cmp byte [rbp + 0x3f], r15b
je 0x1400281ac
mov rcx, qword [rbp + 0x27]
call fcn.14001e468
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14002a750
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002a778
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002a778
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1414d0058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1414d01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1414d0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414d006f
add dl, dl
jne 0x1414d0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414d00f6
xor eax, eax
add dl, dl
jne 0x1414d00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1414d01ad
add dl, dl
jne 0x1414d00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414d00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414d00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414d00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1414d00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1414d007e
mov eax, 1
add dl, dl
jne 0x1414d0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1414d0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414d00fb
sub eax, ebx
mov ebx, 1
jne 0x1414d014c
mov ecx, 1
add dl, dl
jne 0x1414d012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1414d013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414d0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414d007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1414d0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1414d0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1414d015d
cmp eax, 0x7d00
jae 0x1414d019b
cmp eax, 0x500
jb 0x1414d0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414d007e
cmp eax, 0x7f
ja 0x1414d019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1414d007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1414d01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1414d007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004058
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140008610
nop
cmp dword [0x14001db18], 1
je 0x140004004
mov dword [0x14001db14], 1
mov byte [0x14001db10], r12b
test ebx, ebx
jne 0x140003ff0
mov rcx, qword [0x14001fc30]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140003fdd
mov rcx, qword [0x14001fc28]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140003f7c
call fcn.140007f70
cmp qword [rdi], rax
jne 0x140003f7c
jmp 0x140003f62
cmp rdi, rsi
jb 0x140003fdd
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140007f70
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14001fc30]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14001fc28]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140003fbb
cmp r13, rax
je 0x140003fdb
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140003f62
lea rdx, [0x140018380]
lea rcx, [0x140018368]
call fcn.140003dac
lea rdx, [0x140018390]
lea rcx, [0x140018388]
call fcn.140003dac
nop
test r12d, r12d
je 0x140004013
mov ecx, 8
call fcn.140008510
test r12d, r12d
jne 0x14000403e
mov dword [0x14001db18], 1
lea ecx, [r12 + 8]
call fcn.140008510
mov ecx, r15d
call fcn.140003d40
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140003ecc

Function at 0x140004064
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140003ecc
Function at 0x14000fd5b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14001c908]
jne 0x140006cba
rol rcx, 0x10
test cx, 0xffff
jne 0x140006cb6
repz ret
ror rcx, 0x10
jmp 0x14000fcb4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001e410]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14001e508]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000fd39
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001e410]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000fd5b
mov rax, qword [rsp + 0x88]
mov qword [0x14001e508], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001e4a8], rax
mov rax, qword [0x14001e508]
mov qword [0x14001e380], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001e490], rax
mov dword [0x14001e370], 0xc0000409
mov dword [0x14001e374], 1
mov rax, qword [0x14001c908]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001c910]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001e408], eax
mov ecx, 1
call fcn.1400101dc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001a158]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001e408], 0
jne 0x14000fde2
mov ecx, 1
call fcn.1400101dc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000ff98
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140007f70
xor ebx, ebx
mov rdi, rax
cmp qword [0x14001e8e0], rbx
jne 0x14001009e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140010173
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140010173
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001e8e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001e8e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14001e8f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14001e900], rax
test rax, rax
je 0x140010095
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14001e8f8], rax
jmp 0x1400100a5
mov rax, qword [0x14001e8f8]
jmp 0x1400100ac
mov rax, qword [0x14001e8f8]
mov r11, qword [0x14001e900]
cmp rax, rdi
je 0x140010114
cmp r11, rdi
je 0x140010114
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14001e900]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140010114
test rax, rax
je 0x140010114
call rsi
test rax, rax
je 0x14001010e
lea rcx, [rsp + 0x88]
mov r9d, InitCommonControls
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14001010e
test byte [rsp + 0x38], 1
jne 0x140010114
bts ebp, 0x15
jmp 0x140010152
mov rcx, qword [0x14001e8e8]
cmp rcx, rdi
je 0x140010152
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140010152
call rax
mov rbx, rax
test rax, rax
je 0x140010152
mov rcx, qword [0x14001e8f0]
cmp rcx, rdi
je 0x140010152
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140010152
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001e8e0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140010173
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140010175
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140043920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x140043952
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x1400439fa
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x140043996
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x1400439e5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400439b2
mov dword [rsp + 0x1c], 1
jmp 0x1400439ba
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x1400439e3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x14004398c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x140043948
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret

Function at 0x140043ff0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x40], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x50], rax
mov eax, 0x6b
mov word [rsp + 0x20], ax
mov eax, 0x65
mov word [rsp + 0x22], ax
mov eax, 0x72
mov word [rsp + 0x24], ax
mov eax, 0x6e
mov word [rsp + 0x26], ax
mov eax, 0x65
mov word [rsp + 0x28], ax
mov eax, 0x6c
mov word [rsp + 0x2a], ax
mov eax, 0x33
mov word [rsp + 0x2c], ax
mov eax, 0x32
mov word [rsp + 0x2e], ax
mov eax, 0x2e
mov word [rsp + 0x30], ax
mov eax, 0x64
mov word [rsp + 0x32], ax
mov eax, 0x6c
mov word [rsp + 0x34], ax
mov eax, 0x6c
mov word [rsp + 0x36], ax
xor eax, eax
mov word [rsp + 0x38], ax
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x60]
call fcn.140043a10
test eax, eax
jne 0x1400440c3
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
jmp 0x1400440ec
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x30], 0
je 0x1400440ec
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x10]
cmp qword [rsp + 0x50], rax
jne 0x14004409c
mov rax, qword [rsp + 0x40]
add rsp, 0x68
ret
Function at 0x14000bdc0
Capabilities:
Open clipboard

Disassembly:
push rsi
mov edx, 0x48ccec83
mov dword [rcx + rsi], esp
push rbx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000be16
mov ecx, 0xc8000d
pop rbp
adc eax, 0x11a981
int1
sal byte [rdx + rdi*4 + 0x41], 0xb8
add dword [rax], eax
test dword [rax], eax
jmp 0x14000bdff
add byte [rdx - 0x7ffb450f], bl
add byte [rax], al
mov r9, rax
jmp [rax + riz - 0xff472d]
xor dword [0x16e421631], ebp
imul eax, ebx, 0x575acccc
push r14
push r13
push rbx
push rsp
push rsi
and al, 0x9d
push rbx
sub qword [rcx + 0x48d58478], 0xffffffffffffff89
invalid

Function at 0x140022c60
Capabilities:
Hide graphical window

Disassembly:
and rax, 0xffffffff89499289
enter 0xffffffffffffbb48, 0xd
mov ah, byte [rbx - 0x7ab7ff17]
leave
jne 0x140022cb1
mov rcx, qword [0x14012cef8]
mov qword [rsp + 0x20], 0
lea r9, [0x140022cc0]
or r10d, dword [r8 + rax]
call qword [0x140125288]
mov qword [0xdf12cff8], rax
mov rcx, rax
mov edx, 0x36000001
call qword [sym.imp.USER32.dll_ShowWindow]
loopne 0x140022cba
invalid
add rsp, 0xffffffffffffffe5
lahf
invalid
adc byte [rsi], bl
int3

Function at 0x14002cc50
Capabilities:
Encode data using xor

Disassembly:
push rsi
jg 0x14002cbf2
sub esp, 0x38
fmul dword [rcx + 0x4c894bce]
mov bh, 0xa7
mov qword [rsp + 0x60], r8
or cl, byte [rbx + 0xf5dd605]
add byte [rsi + 0x31], ch
loopne 0x14002ccb6
mov dword [rsp + 0x30], eax
cmp qword [rcx + 0x350001a0], 0
je 0x14002cce1
lea rsi, [rax]
and al, 0x60
imul ecx, dword [rcx + 0x48282444], 0x8948d189
ret 0x3fe8
invalid
add dword [rcx], eax
push rax
xor bl, ch
or dword [rax + 0x1d0be], eax
add byte ds:[rdx + rdx*4 + 0x48], dh
add dword [rsp], ebp
cmp byte [rsi + 0x3e0001d0], 0
je 0x14002cc7c
add qword [rsp], rbp
xor byte [rax + 0x31], cl
jnp 0x14002ccdb
cmp ebp, eax
in eax, dx
add byte [rax + 0x38c48392], dl
pop rdi
pop rsi
ret

Function at 0x1400d8797
Capabilities:
Get geographical location

Disassembly:
test ecx, ecx
jne 0x1400d87d1
fimul word [r11 + 0x28000000]
mov rcx, qword cs:[rsi - 0x6fffff68]
invalid
mov eax, dword [rdi]
shr eax, 2
not eax
and eax, 1
mov rcx, qword [rsp + 0x110]
lahf
xor ecx, edx
imul ecx, dword cs:[rdx], 0x8d4c08fe
pushfq
and al, 0x20
mov esp, 0x8b49fd00
pop rbx
sbb dh, bh
adc eax, 0x8bf86a48
jrcxz 0x1400d885e
ret
loope 0x1400d887b
pop rsp
and dword [rax], 0x56ff7766
add edx, 0x39001002
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor ebx, ebx
test eax, eax
jne 0x1400d8880
mov esp, edi
lea eax, [rbx + 1]
jmp 0x1400d88bf
mov rdx, qword [rax + 0x9100a0]
lea rdx, [rsp + 0x20]
add byte [rax - 0x73], cl
push rsp
and al, 0x20
add edx, esi
scasb al, byte [rdi]
add byte [rax], al
test eax, eax
jne 0x1400d8886
lea rax, [0x1400fb598]
nop
add byte [rsp + rdx + 0x16], dh
ret
mov rsi, rsi
and al, 0x10
add dword [rax], eax
add byte [rax + 0x33], cl
int3
Function at 0x14001123f
Capabilities:
Terminate process

Disassembly:
jmp 0x140013dd0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112c1
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015160
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015180
xor al, al
jmp 0x140015201
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015193
xor al, al
jmp 0x140015201
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400151bd
xor al, al
jmp 0x140015201
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400151d1
xor al, al
jmp 0x140015201
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400151e3
xor al, al
jmp 0x140015201
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400151ff
xor al, al
jmp 0x140015201
mov al, 1
add rsp, 0x38
ret
Function at 0x140013000
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001140b
movzx eax, al
test eax, eax
jne 0x140013020
mov ecx, 7
call fcn.140011366
nop
mov byte [rsp + 0x20], 0
call fcn.14001137f
mov byte [rsp + 0x21], al
cmp dword [0x14001f868], 1
jne 0x140013044
mov ecx, 7
call fcn.140011366
nop
jmp 0x14001309c
cmp dword [0x14001f868], 0
jne 0x140013097
mov dword [0x14001f868], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111d1
test eax, eax
je 0x140013078
mov eax, 0xff
jmp 0x1400131a1
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.140011375
mov dword [0x14001f868], 2
jmp 0x14001309c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011352
call fcn.1400112e4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400130f9
mov rcx, qword [rsp + 0x30]
call fcn.140011177
movzx eax, al
test eax, eax
je 0x1400130f9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.140011316
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001312d
mov rcx, qword [rsp + 0x38]
call fcn.140011177
movzx eax, al
test eax, eax
je 0x14001312d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113c0
nop
call fcn.140013250
mov dword [rsp + 0x28], eax
call fcn.1400112c1
movzx eax, al
test eax, eax
jne 0x14001314c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001315b
call fcn.1400113ca
nop
xor edx, edx
mov cl, 1
call fcn.140011163
mov eax, dword [rsp + 0x28]
jmp 0x1400131a1
add rsp, 0x68
ret
Function at 0x140780058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407801df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140780089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14078006f
add dl, dl
jne 0x140780096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407800f6
xor eax, eax
add dl, dl
jne 0x1407800a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407801ad
add dl, dl
jne 0x1407800b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407800c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407800d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407800dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407800ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14078007e
mov eax, 1
add dl, dl
jne 0x140780106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140780113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407800fb
sub eax, ebx
mov ebx, 1
jne 0x14078014c
mov ecx, 1
add dl, dl
jne 0x14078012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14078013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140780123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140780168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140780175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14078015d
cmp eax, 0x7d00
jae 0x14078019b
cmp eax, 0x500
jb 0x140780196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078007e
cmp eax, 0x7f
ja 0x14078019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14078007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407801d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14078007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20